Hi Guys

I have a litlle reverseme made in Delphi 6 and i do not understand how it works in hex.

for ex. in the app we have a TButton disabled and i know that the value is 08 and for the enabled it works with 00. Now where can i check all this values ? are there some kind of Winuser.h for Delphi ?

Thnks

Melvill

Yup, from your Delphi install directory, look here:

Source\Rtl\Win\Windows.pas

This is basically the Windows.h header file in delphi format. If your Delphi was installed in D: for example, look in:

d:\Program Files\Borland\Delphi6\Source\Rtl\Win\windows.pas

As I'm about to post...

Huh, didn't know about that Squidge, I'll have to reinstall Delphi and check it out.

As far as I knew there was no easy listing of these parameters, it's sort of a trial thing, you make a few test apps with different control properties and compare their hex differences. As you found out 08 = Disabled, and if I remember correctly 09 = Enabled (00 works as well I guess). Actually you don't normally get the default Visible=True property in the compiled program, only if Visible=False I believe.

There are some similarities with VB I believe and if you check in the MiniProject forum there was a thread or two which discussed some of this, it might help clarify some of the unusual Delphi structure as well.

There are a few good tuts on the main site dealing with Delphi structure you may want to read

Delphi Reverse Engineering
Adding functionality to a Delphi program
Written by +DaFixer

http://www.woodmann.net/fravia/dafix_t1.htm

And the two papers linked from that one:

LaZaRuS paper Finding standard functions in Delphi/C++ Builder and also some facts about DFM RCDATA in the +Aitor work DFM Files, Windows RCDATA and Object Conversion Routines

Hope this helps,
Kayaker

Thnks guys for your help.

I understand that i will have a very long journey in the way to clarify this parameters on Delphi structure.

I have time...

thnks again guys


Melvill