.:: Bots United ::.  
filebase forums discord server github wiki web
cubebot epodbot fritzbot gravebot grogbot hpbbot ivpbot jkbotti joebot
meanmod podbotmm racc rcbot realbot sandbot shrikebot soulfathermaps yapb

Go Back   .:: Bots United ::. > Developer's Farm > General Programming
General Programming Help others and get yourself helped here!

Reply
 
Thread Tools
anyone knows IDA ?
Old
  (#1)
Pierre-Marie Baty
Roi de France
 
Pierre-Marie Baty's Avatar
 
Status: Offline
Posts: 5,049
Join Date: Nov 2003
Location: 46°43'60N 0°43'0W 0.187A
Default anyone knows IDA ? - 28-08-2004

yeah, it's all in the title... anyone knows the IDA disassembler a bit ?

I just got it and I'm still trying to find my way around it. It's the most complex disassembler I ever used ! Back in 1998 or so I used to toy with Win32DASM but this one looks like a beast in comparison.

Simple question for starters: I have a PE executable, and I need to find the place(s) where it calls the Windows API MessageBox() function. How do I do ?



(P.S. nah, it's not for cracking stuff it's for work... I need to build an interface between 2 proprietary programs and in this one I need to figure out how a particular data structure is arranged)



RACC home - Bots-United: beer, babies & bots (especially the latter)
"Learn to think by yourself, else others will do it for you."
  
Reply With Quote
Re: anyone knows IDA ?
Old
  (#2)
Lazy
Member
 
Lazy's Avatar
 
Status: Offline
Posts: 236
Join Date: Jan 2004
Location: Toronto, Ontario, Canada
Default Re: anyone knows IDA ? - 28-08-2004

Hmm, MessageBox calls should have a title like "Fatal error" or something like that.

1. Open up the EXE in something like textpad and search for the MessageBox title string and note its address.
2. Disassemble the code and look for where the address is being pushed onto the stack.
3. ^^ There is where the function is about to be called.

To test it you could make a copy, find the start of where the messagebox code is executed and replace it with:

0xCD
0x03

Or just change it all to 0x90, the first one is equivalent to __asm int 3 and the other one is the nop instruction.

Though that is all I know from disassembling and playing around with my own code, hope it helps.

Added: I'm tired but I actually think the title string would be the 2nd thing pushed onto the stack, same thing though.

Last edited by Lazy; 28-08-2004 at 03:28..
  
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump



Powered by vBulletin® Version 3.8.2
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
vBulletin Skin developed by: vBStyles.com