Log in

View Full Version : Nag problem


Tyelcon
November 17th, 2002, 23:58
Hi,
I got the following code in WinDbg through bp UpdateWindow. However, when using wida to edit it, it cannot find the code. Same in hiew. I thought perhaps the 7's should be 0's, but that didn't help. Any thoughts on how I can edit it? Thanks.
Tyelcon

77d5ea3c 0f83fcdf0100 jnb USER32!TrackPopupMenu+0xac4 (77d7ca3e)
77d5ea42 33c9 xor ecx,ecx
77d5ea44 8a8e5816d477 mov cl,[esi+0x77d41658]
77d5ea4a 83e13f and ecx,0x3f
77d5ea4d ff148d581ad477 call dword ptr [USER32!CreateWindowExA+0x584 (77d41a58)+ecx*4]
77d5ea54 e91d86feff jmp USER32!SendMessageA+0x47 (77d47076)
77d5ea59 33c0 xor eax,eax
77d5ea5b 40 inc eax
77d5ea5c 50 push eax
77d5ea5d ff7508 push dword ptr [ebp+0x8]
77d5ea60 894510 mov [ebp+0x10],eax
77d5ea63 e8bf92feff call USER32!ShowWindow (77d47d27)
77d5ea68 ff7508 push dword ptr [ebp+0x8]
77d5ea6b e84692feff call USER32!UpdateWindow (77d47cb6)
77d5ea70 53 push ebx
77d5ea71 53 push ebx
77d5ea72 ff7508 push dword ptr [ebp+0x8]
77d5ea75 6a10 push 0x10
77d5ea77 e8ca91feff call USER32!NotifyWinEvent (77d47c46)
77d5ea7c e9529cfeff jmp USER32!IsDialogMessageW+0x1bb (77d486d3)
77d5ea81 817de413010000 cmp dword ptr [ebp-0x1c],0x113
77d5ea88 74cf jz USER32!LockSetForegroundWindow+0x98 (77d5ea59)
77d5ea8a 817de418010000 cmp dword ptr [ebp-0x1c],0x118
77d5ea91 74c6 jz USER32!LockSetForegroundWindow+0x98 (77d5ea59)
77d5ea93 817de404010000 cmp dword ptr [ebp-0x1c],0x104
77d5ea9a 0f85339cfeff jne USER32!IsDialogMessageW+0x1bb (77d486d3)
77d5eaa0 e9b19cfeff jmp USER32!IsDialogMessageW+0x23e (77d48756)
77d5eaa5 3bc3 cmp eax,ebx

squidge
November 18th, 2002, 00:09
It looks like you have landed in the heart of one of the system API's. If you used softice to get here, you may want to use the F12 key a few times once landing to get back to application code.

If you really want to edit it, try looking at the file user32.dll, but I don't think you want to do that.

Tyelcon
November 18th, 2002, 05:04
Oh I see, thanks. Does anyone know how to f12 in WinDbg?

squidge
November 18th, 2002, 08:47
Ah, WinDbg... You could possibly examine the stack for return addresses to your app code? (assuming you know the valid addresses for it)