Very Basic Help Required Assembling a .asm

;----------------------------------------------------------------
; JSteg Data Extractor v0.1 (18 February 2004)
; Freeware, Open Source, GPL, Copyleft, whatever you want.
;----------------------------------------------------------------
;
; I don't feel like writing any comment today. Maybe later.
; Everything is explained on the webpage anyway.
;
; Guillermito
; guillermito@pipo.com
; http://www.guillermito2.net
; February 18th 2004
;
; Assemble it with:
;      TASM32 /ml /m3 /z /t JSteg_Data_Extractor
;      TLINK32 -Tpe -aa JSteg_Data_Extractor,,,import32 
;      UPX -9 JSteg_Data_Extractor.exe

callW macro   x
extrn x:PROC
call x
endm

   .486
   .model flat

.data

openfilename_struct:
lStructSize            dd openfilename_struct_size
hwndOwner              dd 0
hInstance              dd 0
lpstrFilter            dd offset filter
lpstrCustomFilter      dd 0
nMaxCustFilter         dd 0
nFilterIndex           dd 0
lpstrFile              dd offset namebuffer
nMaxFile               dd 255
lpstrFileTitle         dd 0
nMaxFileTitle          dd 32
lpstrInitialDir        dd 0
lpstrTitle             dd 0
Flags                  dd 1000h+4h+200000h
nFileOffset            dw 0
nFileExtension         dw 0
lpstrDefExt            dd 0
lCustData              dd 0
lpfnHook               dd 0
lpTemplateName         dd 0
openfilename_struct_size equ $-offset openfilename_struct
filter                 db "Jpeg files (.jpg,.jpeg)",0,"*.jpg;*.jpeg",0,0
namebuffer             db 255 dup(0)

jpeg_struct:
dwWidth                dd ?             ;Width of the picture
dwHeight               dd ?             ;Height of the picture
BMPWidth               dd ?             ;Width of the bitmap
BMPHeight              dd ?             ;Height of the bitmap
lpBitMap               dd ?             ;Bitmap address

library_name           db "jpeglib.dll",0
library_handle         dd ?
function1              db "Mapping2BMP",0
function2              db "Kill_JPEG",0
offs_function1         dd ?
offs_function2         dd ?
jpg_handle             dd ?
jpg_filemappinghandle  dd ?
jpg_startoffilemapping dd ?

remember_call_value    dd ?
remember_call_position dd ?
new_jump               dd ?

mem_buffer             dd ?
mem_buffer_current     dd 0

file_name              db "extracted.bin",0
file_handle            dd ?
file_nb_bytes_read     dd ?
file_size              dd ?

message                dd ?
message1               db "Cannot open jpeg",0
message2               db "Cannot alloc memory",0
message3               db "Cannot map jpeg",0
message3b              db "File is not a jpeg",0
message4               db "Cannot load lib",0
message5               db "Cannot find function in lib",0
message6               db "Cannot patch lib",0
message7               db "Cannot write file",0
message8               db "No hidden message",0
message_ok             db "Done",0

size_hidden_data       dd ?

.code

programme:

;-------- choose a file -------------

push offset openfilename_struct
callW GetOpenFileNameA             ;choose file
test eax, eax
jz stop1

;-------- open it --------------

push 0
push 80h                          ;FILE_ATTRIBUTE_NORMAL
push 3                            ;OPEN_EXISTING
push 0
push 0
push 80000000h+40000000h          ;GENERIC_READ+GENERIC_WRITE
push [lpstrFile]
callW CreateFileA                 ;open file
mov message, offset message1
inc eax
jz stop1
dec eax
mov jpg_handle, eax

;---------- get its size ---------

push 0
push jpg_handle
callW GetFileSize                 ;get file size in bytes
mov message, offset message1
inc eax
jz stop2
dec eax
mov file_size, eax

;--------- alloc memory for buffer --------

mov eax, file_size
shl eax, 4
push eax                         ;number of bytes to allocate
push 40h                         ;40h=LMEM_ZEROINIT
callW LocalAlloc
mov message, offset message2
test eax, eax
jz stop2
mov mem_buffer, eax
mov mem_buffer_current, eax

;--------- prepare the mapping ------------

xor eax, eax
push eax                ;name of file-mapping object
push eax                ;low-order 32 bits of object size  
push eax                ;high-order 32 bits of object size
push 4                  ;protection for mapping object
push eax                ;optional security attributes
push jpg_handle         ;handle of file to map
callW CreateFileMappingA
mov message, offset message3
test eax, eax
jz stop3
mov jpg_filemappinghandle, eax

;--------- map the jpeg -----------

xor eax, eax
push eax                   ;number of bytes to map
push eax                   ;low-order 32 bits of file offset
push eax                   ;high-order 32 bits of file offset
push 6                     ;access mode
push jpg_filemappinghandle ;file-mapping object to map into address space  
callW MapViewOfFile
mov message, offset message3
test eax, eax
jz stop4
mov jpg_startoffilemapping, eax

;-------- be sure it looks like a jpeg -----------------

mov message, offset message3b
mov ax, word ptr [eax]
cmp ax, 0d8ffh
jnz stop5

;------ open jpeglib dll --------------

push offset library_name
callW LoadLibraryA
mov message, offset message4
test eax, eax
jz stop5
mov library_handle, eax

;------ get the address of Mapping2BMP --------------

push offset function1
push library_handle
callW GetProcAddress
mov message, offset message5
test eax, eax
jz stop6
mov offs_function1, eax

;------ get the address of Kill_JPEG --------------

push offset function2
push library_handle
callW GetProcAddress
mov message, offset message5
test eax, eax
jz stop6
mov offs_function2, eax

;------------ install the hook on jpeglib ------------

mov esi, library_handle
mov ecx, 20000
cherche:
lodsd
cmp eax, 0e89be258h
je maybe
sub esi, 3
loop cherche
mov message, offset message6
jmp stop6

maybe:
mov eax, [esi]
cmp eax, 0fffff8eeh
jne cherche

mov remember_call_position, esi
mov remember_call_value, eax

mov ebx, offset hook_jpeglib
sub ebx, remember_call_position    ;relatif
sub ebx, 4
mov [esi], ebx

mov eax, remember_call_position    ;absolu
add eax, remember_call_value
add eax, 4
mov new_jump, eax

;---------- call jpeglib and get the DCT through the hook ----------------

push offset jpeg_struct
push jpg_startoffilemapping
mov eax, offs_function1
call eax

;---------- call jpeglib to close the jpg ----------------

push offset jpeg_struct
mov eax, offs_function2
call eax

;----- get 1st header: size of size ---------------

xor eax, eax
xor ebx, ebx
mov ecx, 5
mov esi, mem_buffer
extract_size_of_size:
lodsb
and eax, 1
dec ecx
rol eax, cl
or ebx, eax
inc ecx
loop extract_size_of_size

;---- no message if size of size is zero ------------

mov message, offset message8
test ebx, ebx
jz stop6

;----- get 2nd header: size ---------------
  
mov ecx, ebx
push ebx
xor ebx, ebx
extract_size:
lodsb
and eax, 1
dec ecx
rol eax, cl
or ebx, eax
inc ecx
loop extract_size

;---- no message if size is zero ------------

mov message, offset message8
test ebx, ebx
jz stop6

;---- no message if size is > capacity of the JPEG ------------

mov eax, mem_buffer_current
sub eax, mem_buffer
sub eax, 5
pop edx
sub eax, edx
mov message, offset message8
cmp eax, ebx
jb stop6

;----- get raw data ---------------

mov ecx, ebx
mov size_hidden_data, ecx
mov edi, mem_buffer
extract_data:
push ecx
mov ecx, 8
xor ebx, ebx
  extract_one_byte:
  lodsb
  and eax, 1
  dec ecx
  rol eax, cl
  or ebx, eax
  inc ecx
  loop extract_one_byte
xchg eax, ebx
stosb
pop ecx
loop extract_data

;------- open a new file on the disk ----------------

push 0                  ;handle of file with attributes to copy
push 80h                ;file attributes (80h=FILE_ATTRIBUTE_NORMAL)
push 2                  ;how to create (2=OPEN_ALWAYS)
push 0                  ;address of security descriptor 
push 0                  ;share mode (0=Prevents the file from being shared)
push 40000000h          ;access (read-write) mode (40000000h=GENERIC_WRITE)
push offset file_name   ;address of name of the file
call CreateFileA
mov message, offset message7
inc eax
jz stop6
dec eax
mov file_handle, eax

;------- write buffer in it ----------------

push 0
push offset file_nb_bytes_read  ;address of number of bytes written 
push size_hidden_data           ;number of bytes to write
push mem_buffer
push file_handle                ;handle of file to write to
callW WriteFile
mov message, offset message7
test eax, eax
jz stop7

;---------- all done -------------

mov message, offset message_ok

;------- close and clean stuff ----------------

stop7:
push file_handle
callW CloseHandle

stop6:
push library_handle
callW FreeLibrary

stop5:
push jpg_startoffilemapping
callW UnmapViewOfFile

stop4:
push jpg_filemappinghandle
callW CloseHandle

stop3:
push mem_buffer
callW LocalFree

stop2:
push jpg_handle
callW CloseHandle

stop1:
push 0
push message
push message
push 0
callW MessageBoxA

push -1
callW ExitProcess

;---------------- the hook ---------------

hook_jpeglib:                ;the hook calls here, return address on stack

pusha
mov esi, 10003597h           ;where the DCT are in the lib memory
mov edi, mem_buffer_current  ;where we are going to store them
mov ecx, 64                  ;there are 64 quantized DCT coefficients 
copy_DCT:
lodsb
cmp al, 0                    ;remove the null ones
je pas_stosb
cmp al, 1                    ;remove the ones equal to 1
je pas_stosb
stosb
pas_stosb:
lodsw                        ;jump over 3 zeroes
lodsb
loop copy_DCT
mov mem_buffer_current, edi
popa
mov eax, new_jump            ;were the original unhooked call was supposed to go
jmp eax

end programme

; Assemble it with:
;      TASM32 /ml /m3 /z /t JSteg_Data_Extractor
;      TLINK32 -Tpe -aa JSteg_Data_Extractor,,,import32 
;      UPX -9 JSteg_Data_Extractor.exe

TASM.EXE /ml /m3 /z /t JSteg_Data_Extractor.asm