Jump to content
Tuts 4 You

FInding control init with known control ID


Recommended Posts

I have a binary with 3 radio buttons, I want to change the default startup selection and resource hacker does not allow me to change the default value. So I must assume the GetDlgItem is where and how the control is initialized. When I break on GetDlgItem, the stack never shows the known control ID for the three buttons I want to switch in code.

Since I don't have the source code, I have to do it in asm, but I can't really find any methods that deal with this.

Any thoughts?


Link to comment

Try seeing if they use 'CheckDlgButton' or 'CheckRadioButton' which wouldn't require them to use GetDlgItem directly.

Why yes the do actually......:)

Pulled from main window:

004E7971        /$  55                  PUSH    EBP
004E7972 |. 8BEC MOV EBP, ESP
004E7974 |. 8379 4C 00 CMP DWORD PTR DS:[ECX+4C], 0
004E7978 |. 75 16 JNZ SHORT 004E7990 ; XXXXXXXXXXXXX.004E7990
004E797A |. FF75 10 PUSH [ARG.3] ; /IDcheck
004E797D |. FF75 0C PUSH [ARG.2] ; |IDlast
004E7980 |. FF75 08 PUSH [ARG.1] ; |IDfirst
004E7983 |. FF71 20 PUSH DWORD PTR DS:[ECX+20] ; |hWnd
004E7986 |. FF15 60645300 CALL NEAR DWORD PTR DS:[536460] ; \CheckRadioButton
004E798C |. 5D POP EBP
004E798D |. C2 0C00 RETN 0C
004E7990 |> 8B49 4C MOV ECX, DWORD PTR DS:[ECX+4C]
004E7993 |. 8B01 MOV EAX, DWORD PTR DS:[ECX]
004E7995 |. 5D POP EBP
004E7996 \. FF60 6C JMP NEAR DWORD PTR DS:[EAX+6C]

Pulled from Stack window:

0018F5A4   00040874  |hWnd = 00040874 ('XXXXXXXXXXXXXXXXXXXXXX...',class='#32770')
0018F5A8 000003F8 |IDfirst = 3F8 (1016.)
0018F5AC 000003FE |IDlast = 3FE (1022.)
0018F5B0 000003F8 \IDcheck = 3F8 (1016.)

I've verified that they do infact and the range is correct, there are 7 radio buttons (1016 - 1022), 3 are visible, 4 are invisible (by me). I've step into the function but I don't see where the control is set. Since this is my first time around this topic, I could have simply missed it.

Is there something I should be looking for?

Link to comment

As Olly shows, the prototype is:

BOOL CheckRadioButton(      
HWND hDlg,
int nIDFirstButton,
int nIDLastButton,
int nIDCheckButton

The last param is the id of the button in the group to check.

The call you broke at looks like:

CheckRadioButton( 0x00040874, 0x3F8, 0x3FE, 0x3F8 );

You could change the last param from 0x3F8 to the ID of the radio you want to have the check. Windows removes the other checks from the group and sets the given id to be checked.

Link to comment

Yup, your right, I can modify it in the stack dump and also by following the memory location push argument.

004E797A        |.  FF75 10             PUSH    [ARG.3]                                 ; /IDcheck

If I make the modification to that in memory or on the stack, the only thing I can't find is where the data is being store to I can modify the exe and save it to a new dump. I need to modify where arg.3 is being taken from.

I make the change in the memory window, but I don't get a "copy to executable" so not sure what I'm missing.

I'm a little rusty it seems......damn.

Link to comment

Never mind I found it. I did a search on all constants in this case 0x3F8 and I needed the ID 0x3F9 for the control that I want to be the default. With some trial and error after finding "push 0x3F8" to 0x3F9 (only a couple of constants which are loading up the data arrays its using) and bingo, I got the default check box to be 0x3F9 to be the default and all is right with the world after copying the changes to a new exe dump.......thanks for the help!




Edited by kittmaster
Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...