ZaiRoN
October 24th, 2002, 23:54
from Kayaker's last post:
"Yes, I've definitely just become a real fan of IDC scripts, lol. Made very good use of Toteu's Icedump-to-IDA script for a start, pretty sweet. I see there's a few interesting script examples at the Datarescue site as well, particulary the Bit Fields tutorial. For a long time I've been wanting to come up with an app/technique to identify the MSG parameter of SendMessage/ SendDlgItemMessage calls, a suitable script just might be the ticket and I think I'll play with the idea..."
This might be an interesting project
I have wrote a little script and might be a good starting point for those who want to try. The program look for Msg parameter of SendMessage functions:
nothing special, i'm not a guru_script. there are many useless messages; only for debug, you can cut.
from now, everyone can put here his ideas, comments, source and everything else.
for informations on idc take a look at: http://www.datarescue.com/idabase/
there's also an interesting directory under ida called 'IDC' with lots of scripts
I hope that it is what kayaker wanted to make...
good work!
regards,
ZaRoN
"Yes, I've definitely just become a real fan of IDC scripts, lol. Made very good use of Toteu's Icedump-to-IDA script for a start, pretty sweet. I see there's a few interesting script examples at the Datarescue site as well, particulary the Bit Fields tutorial. For a long time I've been wanting to come up with an app/technique to identify the MSG parameter of SendMessage/ SendDlgItemMessage calls, a suitable script just might be the ticket and I think I'll play with the idea..."
This might be an interesting project
I have wrote a little script and might be a good starting point for those who want to try. The program look for Msg parameter of SendMessage functions:
Code:
#include <idc.idc>
static main()
{
auto start, end, temp;
start = SegStart(BeginEA()); // start address
end = SegEnd(BeginEA()); // end address
// you can cut this message. i have put them for...indeed i don't know whypp
Message("\n\n\nSimple script that try to find SendMessageA function";
Message("and try to identify his Msg parameter."
Message("\nSearch starts from address: "+atoa(start)+"\n\n"
// walk through the entire section
for (start;start<end;start=NextAddr(start))
{
temp = Rfirst0(start);
if (Name(temp) == "SendMessageA"
{ // the function has been found
Message(atoa(start)+" refers to "+Name(temp));
// walk back and looks for 'push Msg'
start = PrevAddr(start);
while (GetOpnd(start,0) == 0)
{
Message("\nno valid instruction at: "+atoa(start));
start = PrevAddr(start);
}
Message("\npush hWnd found at: "+atoa(start));
start = PrevAddr(start);
while (GetOpnd(start,0) == 0)
{
Message("\nno valid instruction at: "+atoa(start));
start = PrevAddr(start);
}
// i have found the param...
Message("\nmsg param pushed at:" +atoa(start)+" is: "+GetOpnd(start, 0));
// now we have the Msg and we can make the check!
// we can use a very long switch that covers each wm_command
// or maybe we can work directly on a specific file
// filled with commands and values
start = start + ItemSize(start);
start = start + ItemSize(start);
start = start + ItemSize(start);
Message("\nrestart from: "+atoa(start)+"\n\n"
}
}
Message("\ngame over!!!\n"
}
nothing special, i'm not a guru_script. there are many useless messages; only for debug, you can cut.
from now, everyone can put here his ideas, comments, source and everything else.
for informations on idc take a look at: http://www.datarescue.com/idabase/
there's also an interesting directory under ida called 'IDC' with lots of scripts
I hope that it is what kayaker wanted to make...
good work!
regards,
ZaRoN
