Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Find dialog box

Topic created on: March 22, 2013 16:05 CDT by drew77 .

I have a small program that displays a dialog box that requires clicking on Next to continue.

I used Ollydbg, but I can't find the dialog box so I can jmp past it.

Can someone help me ?

thanks.

  drew77     March 22, 2013 20:53.41 CDT
This is what I have so far.

I am modifying some code I found, and there are things missing.

I will start a program and then send keystrokes to it so it goes unattended.

I need some help in where the code after WindowName goes.

I just noticed that some data is missing too.

.data
SuNam  db  "chklnks",0

.data?

.code

start:

; Start chklnks first

; get the full name and the handle

WindowName Proc  ; FNameAdr:DWord,FHandle:DWord
         Local A, X, Y, Z:DWord
         mov    FHandle,0
         mov    Z,0        ; GW_HWNDFIRST
         Op2ToOp1 X,hwnd
         .while X>0
           invoke GetWindow, X, Z
           mov  X,eax
           mov  Z,2 ; GW_HWNDNEXT
           .if  X>0
             invoke GetWindowLongA, X, -6 ; GWL_HINSTANCE
             mov Y,eax
             .if Y>0
               ; get (consecutive) the names of active applications
               invoke GetWindowText,X,addr FName, 100
               ; lookup in proc "InstrStr" for the String (in SuNam) if found in FName
               invoke InstrStr, addr SuNam,addr FName,1
               ; if the name starts in position 1 in addr FName: name has been found, termin. loop
               .if eax==1
                 mov eax,X
                 mov FHandle,eax
                 mov  X,0  ; beende Schleife
               .endif
             .endif
           .endif
         .endw

         ; full name of application is in addr FName, handle to the application is in FHandle
         .if   eax==0
           mov FName,0 ; clear if not found  Application has not been started yet
         .endif
         ret
WindowName Endp

; and hier the part for sending Alt+F4
         invoke GetForegroundWindow  ; save handle of own window
         mov    hwndTemp,eax

         invoke SetForegroundWindow, FHandle ; activate VirtualDub-window
         ; and now simulate keyboard entries
        
         invoke keybd_event, VK_RETURN, NULL, NULL, NULL ; Send ENTER key
         invoke Sleep, 7000 ; give enuf time to find bad links
        
         invoke keybd_event, VK_TAB, NULL, NULL, NULL ; Send tab key
         invoke Sleep, 1500
        
         invoke keybd_event, VK_TAB NULL, KEYEVENTF_KEYUP, NULL ; Send F4 key 'up'
         invoke Sleep, 1500
        
         invoke keybd_event, VK_RETURN, NULL, NULL, NULL ; Send ENTER key
         invoke Sleep, 1500

         invoke keybd_event, VK_RETURN, NULL, NULL, NULL ; Send ENTER key
         invoke Sleep, 1500
  
        
         invoke SetForegroundWindow, hwndTemp  ; activate own window again

end     start

  codeinject     March 25, 2013 02:23.26 CDT
Can you extend or rephrase the question?

As I understand it, you've got a little program (a crackme of sorts) where you want to remove a Nag-Screen.

For the removal of this nag-screen you've wrote this application in Assembler (the code) to auto-click it as you couldn't find the code to jump over or nop-out in the CracKMe?

Can you point me to the right direction? So you can help me help you :)

  drew77     March 26, 2013 11:53.07 CDT
The program is chklnks.exe.

I want to be able to inject Tabs and Enter so the program will run by itself.

I hope that made it more clear.

I can upload a copy of the program if that would help.

Note: Registration is required to post to the forums.

There are 31,320 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit