Log in

View Full Version : i need some quick help


init
March 14th, 2004, 02:03
hello, i have this one program thats closing itself in the middle of use and when i search for possible calls it makes to close itself such as exitprocess and terminateprocess and nop them out, the program is still managing to close itself, what are any other possible calls it can be making to close itself?

nikolatesla20
March 14th, 2004, 02:59
Hmm. Try looking for any DLL's that it might load. These could also call Exitprocess(). Also, TerminateThread could be used.

Maybe check for any windows messages as well, perhaps a WM_CLOSE. Of course, i would think that if you nop'ed all the exit codes out nothing would be able to close it, so first try the above suggestions....

-nt20

naides
March 14th, 2004, 07:53
Quote:
[Originally Posted by init]hello, i have this one program thats closing itself in the middle of use and when i search for possible calls it makes to close itself such as exitprocess and terminateprocess and nop them out, the program is still managing to close itself, what are any other possible calls it can be making to close itself?


You may also consider the possibility that the program does not call the API or message that closes herself, but produces an exception or other abnormal code path that results in the OS closing the program thread(s).

Do you have a clear idea of what triggers the closing?
try manually tracing around that code in SoftIce, logging your trace, and monitor the the tell tale signs of the program closing: a lot of "unload" type of messages in the SoftIce command area. This way you can narrow down the area of the code, the call, the provokes the closing, and trace into it.

init
March 14th, 2004, 14:13
well here is the problem, the program is a mailer and after march 1st is when it started to close itself so the maker must have added something in the code to make the program close after that date, now the program randomly closes itself when you start to mail and it waits quite a while to do it like an hour or so

naides
March 14th, 2004, 19:10
Quote:
[Originally Posted by init]well here is the problem, the program is a mailer and after march 1st is when it started to close itself so the maker must have added something in the code to make the program close after that date, now the program randomly closes itself when you start to mail and it waits quite a while to do it like an hour or so


You are describing a time bomb kind of protection. Disassemble the program and look for time keeping API: getsystemtime, gettickcount. etc. Time bomb probably checks it often. Also look for the API postquitmessage.
Also DateChecks may have activated the timebomb mechanism. Look around for those APIs.