Clandestiny
February 25th, 2003, 21:07
Yeah, you're right... Its created dynamically so you won't find the ID in a resource editor. Really, you don't need the ID, per se, except in the sense that you want to verify that AfxFindMessageEntry is returning you a pointer to the handler for the control you're interested in. If you have Visual Studio, you can use the Spy++ tool to get this ID.
Quote:
| Your explaination is good, but I still can really understand, i looked with IDA, i found where was used AFxFind I looked around but it's quite hard to get the pointer ... |
No, its actually quite straight forward to get the pointer... Here is a procedure you can follow that may help you to understand...
1) Locate where AfxFindMessageEntry is called in IDA and write that address down.
2) Use a message spy utility to retrieve the handle for the parent dialog and the register button's ID.
3) Now set a bmsg 'parent dialog handle' wm_command in SoftICE.
4) Click the register button and SoftICE will break. You will be in the window procedure for the dialog box and you can examine the stack to determine if this wm_command message is directed at the register button
.
BOOL CALLBACK DialogProc(
HWND hwndDlg, // handle to dialog box
UINT uMsg, // message
WPARAM wParam, // first message parameter
LPARAM lParam // second message parameter
);
If you look at the stack you will see the uMsg parameter which will be 111 for the wm_command message. The wParam and lParam values are determined by the specific message so have a look at wm_command in your API reference:
WM_COMMAND
wNotifyCode = HIWORD(wParam); // notification code
wID = LOWORD(wParam); // item, control, or accelerator identifier
hwndCtl = (HWND) lParam; // handle of control
You can now examine the wParam argument on the stack to make sure that the low word matches the ID for the register button. I make this note because other controls may also send wm_command messages (SoftICE broke a couple of times for me on wm_command messages for the edit controls before it broke on the wm_command sent by the register button).
5) Now, you know that the AfxFindMessageEntry function will be called somewhere in this WndProc to look up the actual handler for our register button so you can go ahead and set a breakpoint on it.
6) SoftICE will break. Once again you can look at the fucntion prototype and verify the parameters passed on the stack match up with the wm_command message and the register button's ID.
const AFX_MSGMAP_ENTRY* AFXAPI AfxFindMessageEntry(const AFX_MSGMAP_ENTRY* lpEntry, UINT nMsg, UINT nCode, UINT nID);
7) Step over this function in SI. An address will be returned in eax. This address is an index into the AFX_MSGMAP table. It specifically points to a structure of type
struct AFX_MSGMAP_ENTRY
{
UINT nCode //windows message code (wm_command is 111)
UINT nID
UINT nLastID //control ID
UINT nMessage
UINT nSig
AFX_PMSG pfn //pointer to handler function
}
8) Extract the handler address (which is clearly offset 6 DWORDS from the pointer to the structure returned from the previous function call).
And there you have it... Now you can set a breakpoint on the handler address and trace for the serial routine.
Hope this helps,
Clandestiny
no luck it breaks many times) and i dont find the right place.
. Admittedly this makes the task slightly more difficult, but by no means impossible. I would suggest that you start by locating the wm_command message handler for when the 'register' button is pressed.
.
but it's strange, if i put a break point on the window handle of the dialog box SICE break everytime.