Jump to content
Tuts 4 You

Forums

  1. Community Links

    1. Terms, Privacy Policy & Frequently Asked Questions   (224,709 visits to this link)

      Very important! Please read before sign up and posting...

  2. Community Discussions

    1. Site Bug Reports and Feedback

      Bugs, feedback and ideas regarding this site...

      2.3k
      posts
  3. Developers Forums

    1. Programming and Coding

      Programming and coding tips, help and solutions...

      12.4k
      posts
    2. Programming Resources

      Share an interesting blog, news page or other resource...

      370
      posts
    3. Software Security

      Securing your software against reverse engineering...

      847
      posts
  4. Reverse Code Engineering

    1. Challenge of Reverse Engineering

      Try a challenge or contribute your own, any platform or operating system...

      14.1k
      posts
    2. Hardware Reverse Engineering

      Reverse engineering of circuitry hardware and firmware...

      221
      posts
    3. Network Security

      Discussions on network security, holes, exploits and other issues...

      461
      posts
    4. Malware Reverse Engineering

      Debugging, disassembling and documenting interesting malware...

      1.7k
      posts
    5. Reverse Engineering Articles

      Share an interesting blog, news page or other RE related site...

      2.2k
      posts
    6. Employment and Careers

      Discussions on employment and career paths in the industry...

      190
      posts
  5. Community Projects

    1. Scylla Imports Reconstruction

      Development and support forum for the Scylla project...

      505
      posts
    2. x64dbg

      An open-source x64/x32 debugger for windows...

      1.3k
      posts
    3. Future Community Projects

      Looking for support and interested partners for a future project?

      147
      posts
    4. Community Projects Archive

      Old and inactive projects moved to long term support...

      812
      posts
  • Member Statistics

    21,084
    Total Members
    7,713
    Most Online
    vxcute
    Newest Member
    vxcute
    Joined
  • Posts

    • Teddy Rogers
      Have you tried setting the edit control with EM_FMTLINES? I have some test code using IsTextUnicode that may be of help, see code block below. Raymond Chen suggests some alternate options... https://devblogs.microsoft.com/oldnewthing/20150223-00/?p=44613 EnableExplicit ; *********************************************************************************************************************** ;- Enumerations ; *********************************************************************************************************************** #IS_TEXT_UNICODE_ASCII16 = $0001 #IS_TEXT_UNICODE_REVERSE_ASCII16 = $0010 #IS_TEXT_UNICODE_STATISTICS = $0002 #IS_TEXT_UNICODE_REVERSE_STATISTICS = $0020 #IS_TEXT_UNICODE_CONTROLS = $0004 #IS_TEXT_UNICODE_REVERSE_CONTROLS = $0040 ;#IS_TEXT_UNICODE_BUFFER_TOO_SMALL = $0000 ; MSDN has this documented yet the value does not exist? #IS_TEXT_UNICODE_SIGNATURE = $0008 #IS_TEXT_UNICODE_REVERSE_SIGNATURE = $0080 #IS_TEXT_UNICODE_ILLEGAL_CHARS = $0100 #IS_TEXT_UNICODE_ODD_LENGTH = $0200 #IS_TEXT_UNICODE_DBCS_LEADBYTE = $0400 #IS_TEXT_UNICODE_NULL_BYTES = $1000 #IS_TEXT_UNICODE_UNICODE_MASK = $000F #IS_TEXT_UNICODE_REVERSE_MASK = $00F0 #IS_TEXT_UNICODE_NOT_UNICODE_MASK = $0F00 #IS_TEXT_UNICODE_NOT_ASCII_MASK = $F000 ; *********************************************************************************************************************** ;- Declarations ; *********************************************************************************************************************** Declare.i IsTextUnicodeV2(*String, *End) Declare.s ConcatenateFlags(FlagString.s, Flag.s, ValueToSearch, ValueToFind) Declare.s ConcatenateValues(lpiResult) ; *********************************************************************************************************************** ;- IsTextUnicode - File Tests ; *********************************************************************************************************************** Debug "ANSI" IsTextUnicodeV2(?ANSII_Start, ?ANSII_End) Debug "UTF8" IsTextUnicodeV2(?UTF8_Start, ?UTF8_End) Debug "UTF8_BOM" IsTextUnicodeV2(?UTF8_BOM_Start, ?UTF8_BOM_End) Debug "UTF16_BE" IsTextUnicodeV2(?UTF16_BE_Start, ?UTF16_BE_End) Debug "UTF16_LE" IsTextUnicodeV2(?UTF16_LE_Start, ?UTF16_LE_End) ; *********************************************************************************************************************** ;- IsTextUnicode - Datasection Tests ; *********************************************************************************************************************** Debug "DATA_ASCII" IsTextUnicodeV2(?DATA_ASCII_Start, ?DATA_ASCII_End) Debug "DATA_UNICODE" IsTextUnicodeV2(?DATA_UNICODE_Start, ?DATA_UNICODE_End) Debug "DATA_STRING" IsTextUnicodeV2(?DATA_STRING_Start, ?DATA_STRING_End) ; *********************************************************************************************************************** ;- IsTextUnicode - Memory Tests ; *********************************************************************************************************************** Define String1.s = "abcdefghijklmnopqrstuvwxyz" Define String2.s = "Bush hid the facts" ; https://en.wikipedia.org/wiki/Bush_hid_the_facts Define *Memory Define iSize Debug "MEMORY_ABC_ASCII" *Memory = Ascii(String1.s) iSize = StringByteLength(String1.s, #PB_Ascii) ;ShowMemoryViewer(*Memory, iSize) ;Debug PeekS(*Memory, Len(String1.s), #PB_Ascii) IsTextUnicodeV2(*Memory, *Memory+iSize) FreeMemory(*Memory) Debug "MEMORY_ABC_UTF8" *Memory = UTF8(String1.s) iSize = StringByteLength(String1.s, #PB_UTF8) ;Debug PeekS(*Memory, Len(String1.s), #PB_UTF8) ;ShowMemoryViewer(*Memory, iSize) IsTextUnicodeV2(*Memory, *Memory+iSize) FreeMemory(*Memory) ; https://en.wikipedia.org/wiki/Bush_hid_the_facts Debug "MEMORY_BUSH_ASCII" *Memory = Ascii(String2.s) iSize = StringByteLength(String2.s, #PB_Ascii) ;ShowMemoryViewer(*Memory, iSize) ;Debug PeekS(*Memory, Len(String2.s), #PB_Ascii) IsTextUnicodeV2(*Memory, *Memory+iSize) FreeMemory(*Memory) Debug "MEMORY_BUSH_UTF8" *Memory = UTF8(String2.s) iSize = StringByteLength(String2.s, #PB_UTF8) ;Debug PeekS(*Memory, Len(String2.s), #PB_UTF8) ;ShowMemoryViewer(*Memory, iSize) IsTextUnicodeV2(*Memory, *Memory+iSize) FreeMemory(*Memory) End Procedure.i IsTextUnicodeV2(*StringStart, *StringEnd) Protected lpiResult.l, Result, a Protected iSize = *StringEnd - *StringStart ; Create a temporary array structure. Structure istextunicode_value Align #PB_Structure_AlignC Flag.l EndStructure Protected Dim istextunicode_value.istextunicode_value(15) ; Add in the flag values. istextunicode_value(00)\Flag = #IS_TEXT_UNICODE_ASCII16 istextunicode_value(01)\Flag = #IS_TEXT_UNICODE_REVERSE_ASCII16 istextunicode_value(02)\Flag = #IS_TEXT_UNICODE_STATISTICS istextunicode_value(03)\Flag = #IS_TEXT_UNICODE_REVERSE_STATISTICS istextunicode_value(04)\Flag = #IS_TEXT_UNICODE_CONTROLS istextunicode_value(05)\Flag = #IS_TEXT_UNICODE_REVERSE_CONTROLS istextunicode_value(06)\Flag = #IS_TEXT_UNICODE_SIGNATURE istextunicode_value(07)\Flag = #IS_TEXT_UNICODE_REVERSE_SIGNATURE istextunicode_value(08)\Flag = #IS_TEXT_UNICODE_ILLEGAL_CHARS istextunicode_value(09)\Flag = #IS_TEXT_UNICODE_ODD_LENGTH istextunicode_value(10)\Flag = #IS_TEXT_UNICODE_DBCS_LEADBYTE istextunicode_value(11)\Flag = #IS_TEXT_UNICODE_NULL_BYTES istextunicode_value(12)\Flag = #IS_TEXT_UNICODE_UNICODE_MASK istextunicode_value(13)\Flag = #IS_TEXT_UNICODE_REVERSE_MASK istextunicode_value(14)\Flag = #IS_TEXT_UNICODE_NOT_UNICODE_MASK istextunicode_value(15)\Flag = #IS_TEXT_UNICODE_NOT_ASCII_MASK Debug "**********" Debug "iSize: " + iSize ; Cycle through all the flags stored in the array. For a = 0 To 15 lpiResult.l = istextunicode_value(a)\Flag Result = IsTextUnicode_(*StringStart, iSize, @lpiResult) If Result Debug "Flag being checked: $" + Hex(istextunicode_value(a)\Flag, #PB_Long) + " | lpiResult: $" + Hex(lpiResult, #PB_Long) Debug ConcatenateValues(lpiResult) EndIf Next a EndProcedure Procedure.s ConcatenateValues(lpiResult) Protected FlagString.s FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_ASCII16", lpiResult, #IS_TEXT_UNICODE_ASCII16) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_REVERSE_ASCII16", lpiResult, #IS_TEXT_UNICODE_REVERSE_ASCII16) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_STATISTICS", lpiResult, #IS_TEXT_UNICODE_STATISTICS) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_REVERSE_STATISTICS", lpiResult, #IS_TEXT_UNICODE_REVERSE_STATISTICS) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_CONTROLS", lpiResult, #IS_TEXT_UNICODE_CONTROLS) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_REVERSE_CONTROLS", lpiResult, #IS_TEXT_UNICODE_REVERSE_CONTROLS) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_SIGNATURE", lpiResult, #IS_TEXT_UNICODE_SIGNATURE) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_REVERSE_SIGNATURE", lpiResult, #IS_TEXT_UNICODE_REVERSE_SIGNATURE) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_ILLEGAL_CHARS", lpiResult, #IS_TEXT_UNICODE_ILLEGAL_CHARS) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_DBCS_LEADBYTE", lpiResult, #IS_TEXT_UNICODE_DBCS_LEADBYTE) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_NULL_BYTES", lpiResult, #IS_TEXT_UNICODE_NULL_BYTES) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_UNICODE_MASK", lpiResult, #IS_TEXT_UNICODE_UNICODE_MASK) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_REVERSE_MASK", lpiResult, #IS_TEXT_UNICODE_REVERSE_MASK) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_NOT_UNICODE_MASK", lpiResult, #IS_TEXT_UNICODE_NOT_UNICODE_MASK) FlagString.s = ConcatenateFlags(FlagString.s, "#IS_TEXT_UNICODE_NOT_ASCII_MASK", lpiResult, #IS_TEXT_UNICODE_NOT_ASCII_MASK) If FlagString.s = "" FlagString.s = "#NULL" EndIf ProcedureReturn FlagString.s EndProcedure Procedure.s ConcatenateFlags(FlagString.s, Flag.s, ValueToSearch, ValueToFind) Protected Space.s = " | " If ValueToSearch & ValueToFind = ValueToFind If Not FlagString.s = "" FlagString.s = FlagString.s + Space.s EndIf FlagString.s = FlagString.s + Flag.s EndIf ProcedureReturn FlagString.s EndProcedure ; *********************************************************************************************************************** ;- Datasection ; *********************************************************************************************************************** DataSection ANSII_Start: IncludeBinary "readme_ANSI.txt" ANSII_End: UTF8_Start: IncludeBinary "readme_UTF8.txt" UTF8_End: UTF8_BOM_Start: IncludeBinary "readme_UTF8_BOM.txt" UTF8_BOM_End: UTF16_BE_Start: IncludeBinary "readme_UTF16_BE.txt" UTF16_BE_End: UTF16_LE_Start: IncludeBinary "readme_UTF16_LE.txt" UTF16_LE_End: DATA_ASCII_Start: Data.a "abcdefghijklmnopqrstuvwxyz" DATA_ASCII_End: DATA_UNICODE_Start: Data.u "abcdefghijklmnopqrstuvwxyz" DATA_UNICODE_End: DATA_STRING_Start: Data.s "abcdefghijklmnopqrstuvwxyz" DATA_STRING_End: EndDataSection Ted.
    • LCF-AT
      OK thanks Ted, So it seems to work OK so far when using 0 as last parameter. Not sure whether it will also work in case of those Symbol stuff in the string 💋🖤🧛‍♀️ etc. I can not use those symbols in WinASM itself to text it quickly so I also got just ??????? to see there. By the way, I have another question. So i was trying to display some same text on a static control & edit control and I got an issue. The text is not displaying same when the text has only an LF (10 / 0Ah) byte instead of CRLF (13,10 / 0Dh 0Ah). Why? In static control it does display with new lines and in edit control all is displaying in one line. That's some strange or? Is there any extra flag I have to use for Edit control to thread the LF / 0Ah byte like an CRLF? At the moment I wrote a function to replace all 0Ah bytes in text with 0D 0A to make it work but for this I have to alloc a new buffer. Just wanna know whether I can skip that part to handle it manually like this and just telling the edit control to display LF also as CRLF etc you know. greetz
    • Sean Park - Lovejoy
      Am I okay to link the address of the cracked version of this application? Regards. sean.
    • Priboi
      1) Here it is. 2) Tried just right now. Didnt work without my trick. Crackme1.exe
    • fjqisba
      Maybe it helps you locate key branches. The plugin is not finished yet,I think you can understand the principles and attack methods of vmp by looking at the source code
  • Popular Contributors

    1. 1
      Teddy Rogers
      Teddy Rogers
      14
    2. 2
      jackyjask
      jackyjask
      11
    3. 3
      Luca91
      Luca91
      9
    4. 4
      Sean Park - Lovejoy
      Sean Park - Lovejoy
      8
    5. 5
      lengyue
      lengyue
      7
  • Files

  • File Comments

×
×
  • Create New...