dion
January 21st, 2013, 18:11
Hi,
i've been trying to figured out what kind of code that can produce similar output such as :
i tried to figure out the parameters of GameInit(). by trial and error, i got the following code (which a little bit match) :
but it's not right. the disassemble form of the above code is :
so for 1st param, i got a near match, eax+20h instead of eax+1Ch. i looked into CWnd structure, it's wierd. it's said m_hWnd is first data member. looking from the number, it should have previous data member. but it seems i can not find them in the list (i.e. type "m_pMainWnd->" then see the list in MSVC IDE and compile and see the code). anyone can help or give a hint?
thanks
i've been trying to figured out what kind of code that can produce similar output such as :
Code:
.text:004070A2 mov ecx, offset CWnd1
.text:004070A7 mov [esi+70h], eax
.text:004070AA call ?GetMainWnd@CWinThread@@UAEPAVCWnd@@XZ ; CWinThread::GetMainWnd(void)
.text:004070AF xor ebx, ebx
.text:004070B1 cmp eax, ebx
.text:004070B3 jnz short loc_4070B9
.text:004070B5 xor eax, eax
.text:004070B7 jmp short loc_4070BC
.text:004070B9 ; ---------------------------------------------------------------------------
.text:004070B9
.text:004070B9 loc_4070B9: ; CODE XREF: gamestart-2BDj
.text:004070B9 mov eax, [eax+1Ch]
.text:004070BC
.text:004070BC loc_4070BC: ; CODE XREF: gamestart-2B9j
.text:004070BC mov ecx, [esi+40h]
.text:004070BF push offset off_4E6A98
.text:004070C4 push ecx
.text:004070C5 push eax
.text:004070C6 call dword ptr [esi+70h] ; GameInit()
i tried to figure out the parameters of GameInit(). by trial and error, i got the following code (which a little bit match) :
Code:
CWinThread* pThread = AfxGetThread();
CWnd* m_pMainWnd = pThread->GetMainWnd();
HWND test = m_pMainWnd->m_hWnd;
but it's not right. the disassemble form of the above code is :
Code:
102: CWinThread* pThread = AfxGetThread();
004012FD call AfxGetThread (00401854)
00401302 mov dword ptr [ebp-8],eax
103:
104: CWnd* m_pMainWnd = pThread->GetMainWnd();
00401305 mov eax,dword ptr [ebp-8]
00401308 mov edx,dword ptr [eax]
0040130A mov esi,esp
0040130C mov ecx,dword ptr [ebp-8]
0040130F call dword ptr [edx+7Ch]
00401312 cmp esi,esp
00401314 call _chkesp (0040191a)
00401319 mov dword ptr [ebp-0Ch],eax
105:
106: HWND test = m_pMainWnd->m_hWnd;
0040131C mov eax,dword ptr [ebp-0Ch]
0040131F mov ecx,dword ptr [eax+20h] ;<<<<<<<< see this
00401322 mov dword ptr [ebp-10h],ecx
so for 1st param, i got a near match, eax+20h instead of eax+1Ch. i looked into CWnd structure, it's wierd. it's said m_hWnd is first data member. looking from the number, it should have previous data member. but it seems i can not find them in the list (i.e. type "m_pMainWnd->" then see the list in MSVC IDE and compile and see the code). anyone can help or give a hint?
thanks