winapiexec is a small tool that allows to run WinAPI functions through command line parameters.
Syntax
The syntax is:
winapiexec.exe library.dll@FunctionName 123 unicode_text "a space"
If you don’t specify a library or use “k”, kernel32.dll is used.
If you specify “u” as a library, user32.dll is used.
Numbers are detected automatically. You can use hex numbers (like 0xFE) and use the minus sign (e.g. -5).
Strings are Unicode by default.
You can use special prefixes to specify parameter types:
$s:ansi – an ANSI string.
$u:unicode – a Unicode string (it’s Unicode by default, but you can use it to force numbers as strings).
$b:1024 – a zero-bytes buffer with the size you specify, in bytes.
$$:1 – a reference to another parameter, you can also use $$:0 for the program’s name (argv[0]).
$a:0,1,two,3 – an array of parameters, divided by commas. You can use all the prefixes here. Each parameter is a 32-bit number (64-bit for winapiexec64).
$a[1,2,$a[3,4],5] – an alternative syntax for an array of parameters. Allows to have nested arrays.
$$:3@2 – a reference to an item in an array of parameters, can have more than one indirection.
While referencing another parameter, note that they are processed by the order of execution, which means there’s no point to reference a parameter at the right side relative to the referencing one.
Also note that when a function returns, its first parameter (like library.dll@FunctionName) is replaced with the return value.
You can execute multiple WinAPI functions, one after the other, using a comma:
winapiexec.exe library.dll@FunctionName1 123 , library.dll@FunctionName2 456
You can also have nested functions, using parentheses:
winapiexec.exe library.dll@FunctionName1 ( library.dll@FunctionName2 456 )
In this case the return value of the internal function is passed as a parameter to the external function.
Download
winapiexec.zip (6.02 kB)
Source code
https://github.com/m417z/winapiexec
Read More…
