PDA

View Full Version : Launcher idea


mint77
December 25th, 2012, 18:59
I was told by some at MSDN that the buffer for the Run command was about 26 "commands" and there was no way to increase it.

I looked into a launcher but it didn't look like what I want.

I am going to look to see if there is a way to have a buffer that could contain up to 50 run commands.

I already have some code for a "key keeper." :biggrin:

Ideally it would delete duplicate entries so it doesn't contain 3 instances of the same command.

For example I run this a lot, %SystemRoot%\explorer.exe /e,c:

What do you feel about this idea ?

Kayaker
December 25th, 2012, 21:10
I edited your attachment so it was the jpg instead of a zip file, so people could simply see what you're talking about.

Yeah, nothing wrong with the idea, sounds like a good reversing project. Where does this combobox/buffer reside? One thought that comes to mind is if the file is under WFP (windows file protection), in which case any hard changes will be detected, no?

blabberer
December 26th, 2012, 03:08
Quote:
I was told by some at MSDN that the buffer for the Run command was about 26 "commands" and there was no way to increase it.

well msdn ppl usually KNOW what they are talking about while i usually blabber

it seems now i have gone blind too apart from drooling mouth do i see a 27th entry { oh my hearts goes to mshearts }

mint77
December 26th, 2012, 09:08
Thanks.

I see that you were viewing the process with Windbg. I tried Process Explorer but it doesn't pick it up.

I tried Windbg but thought I needed like 1 Gb of symbols to run it.

Are there any other programs that will work.?

Andy

blabberer
December 29th, 2012, 06:59
Quote:

Are there any other programs that will work.?

Andy


you need symbols but let windbg get it as it pleases

for 4 os spread over several vms over a period of about ~5 years i just managed to break the 1 gb barrier

so you have got time to worry about it


SysinternalsSuite>du.exe -q f:\SYMBOLS\
Files: 1911
Directories: 3003
Size: 1,100,235,333 bytes
Size on disk: 882,714,222 bytes



i expanded the short answer into a better single post

http://www.woodmann.com/forum/entry.php?245-Reversing-RunDialog-(Start-Run-or-Winkey-R)-to-Add-a-27th-entry-to-RunMRU-list

see if you can find anything interesting in it

mint77
December 29th, 2012, 09:02
Thanks for all the work and detailed explanation.

I have been using Ollydbg and IDA, and just this week made some progress with getting Windbg setup.

Windbg was not seeing where my symbols where, so I let it just search the net for what it wants.

It may be harder to learn but I think it can do more than Ollydbg.

I now compile with debug information stored.

Unlike Olly, you can't just open an .exe and see all the instructions laid out.

Dr. Watson shows up sometimes, but no bluescreens so far. :-)

Andy

blabberer
December 29th, 2012, 14:17
Quote:

Unlike Olly, you can't just open an .exe and see all the instructions laid out.


if you mean disassembly stack,register and memory window all in one glance
you have to set up windbg like that using save workspace

do this

open a blank windbg (start->debug....>windbg)

do not open any exe or any program

just click on the windows (either buttons or alt+1 , 4, 5, 6 ,7)

position them like you wish or like ollydbg windows (drag around to dock it within windows at top or bot or left right half area

and then close windbg

it will ask do you want to save workspace
say yes

and from next time onwards when you open windbg it will be as you laid it out

2700