EXE files and apis

I didnt understand what you want to do exactly Warren, you want your code to execute before the original application code? If yes, you can just add your assembly code to end of pe and do a jump to and back. Also i didnt understand what you mean by illegal operation, if you are just trying to intercept erros in a debug application then you could just use dbghelp to dump stack details and save a crash dump report to later analyses and replication of the process. Please explain and i will give you more details.

Cya

[Nacho_dj]

Hello:

If you disassemble the code of your a.exe, you could see imports (with wdasm32, for instance) and there all the apis used by the application. Then, select in the import window "ExitProcess" and display it, then you are getting a "call [<address of ExitProcess>]".

You could write down in your new code a call like that you have got, or a jmp to the RVA of that call.

Cheers

Nacho_dj

[MaRKuS-DJM]

you don't need an API.
MOV EAX,101
PUSH 0 (exit code)
PUSH -1
MOV EDX,ESP
INT 2E

code directly converted in short form from Debug Me 0.2 / Teerayoot

Originally Posted by MaRKuS-DJM

you don't need an API.
MOV EAX,101
PUSH 0 (exit code)
PUSH -1
MOV EDX,ESP
INT 2E

Very interesting, but does this code work on Windows 9x? I think no. Maybe INT 20 (VxDCall) is usable for this...
Interrupts are platform dependent and using call to ExitProcess is much more versatelite. Interrupts are good to avoiding fast detection 'cause I look first for some API call or SEH usage but not for INT's.

[MaRKuS-DJM]

yeah, i forgot to mention this only works on NT-based systems. Windows ME for example will show you the blue screen of death also a way to get the application to shutdown, but not very nice