A summary of the positioning of Button processing code in several typical programs

Author: jingulong
Time: 2006-01-04,15: 33
Chain: http://bbs.pediy.com/showthread.php? T = 20078
First
1. Run the program in od, and F12 is paused;
2. Select Windows from the View menu. In the displayed window, you can View the target button in the Title column to find its Handle (xxxxxxxx );
Process the programs generated on different platforms separately:
1. VB, Delphi, and CBuilder programs:
3. Under the CallWindowProcA entry, the condition breakpoint is: [esp + 8] ==xxxxxxxx & [esp + 0c] = 202;
4 F9: continue the program. Click the target button to interrupt the program;
5 Alt + F4, access the breakpoint in the code segment (. text;
6 F9 execution program, program interruption,
1). the vbprogram is interrupted in the following code:
Push dword ptr ds: [EAX + EBX]; yyyyyyy
The value of [EAX + EBX] (yyyyyy) above is the location we are looking.
2). Delphi, CBuilder Program
The program is directly disconnected from the location we are looking.
By taking the moon sentence, this nickname is the CallWindowProcA condition breakpoint plus the code block memory breakpoint method.
Ii. VC program
There are two cases: MFC and Win32. The two are the same:
3. breakpoint at the IsDialogMessageW entry: [[esp + 8] ==xxxxxxxx & [[esp + 8] + 4] = 202
4 F9: continue the program. Click the target button to interrupt the program;
5 Alt + F4, access the breakpoint in the code segment;
6 F9 executes the program and the program is interrupted. Although the program is interrupted in the code segment, it is not the code that handles the Button click event.
At this time:
For Win32 programs, you only need to press F7 for a few times. After returning to User32.dll's airspace, repeat steps 5th and 6 again;
For the MFC program, we have to repeat this operation multiple times: one step back to the MFC airspace, and another step 5th or six. Fortunately, we have already seen the Chinese mainland!
This is called the IsDialogMessageW condition breakpoint plus the code block memory breakpoint method.
Please correct me.
Reply:
Bp IsDialogMessageW [[esp + 8] ==0020. AE & [[esp + 8] + 4] = 202
Bp IsDialogMessageW [[esp + 8] ==0020. AE & MSG = 202