Pokazanie buttonkow:

Przechodzimy do sekcju zasobow, szukamy buttona z tekstem unicode 'Exit'..
Ok, jest pod 1DEAh teraz odliczmy od tego 19 bajtow i zmienmy wartosc pod tym offsetem na 50h

Teraz robimy podobnie tylko ze z przyciskiem 'Set'..

Ok, mamy ladne przyciski.. z ktorych dziala 'Set' ale po jego nacisnieciu program jest zamykany..

Teraz zobaczmy w kod.. odpalamy IDE..

CODE:00401026                 enter   0, 0
CODE:0040102A                 mov     eax, [ebp+arg_4]
CODE:0040102D                 cmp     ax, 2
CODE:00401031                 jnz     short loc_0_401037
CODE:00401033                 jmp     short loc_0_401059
CODE:00401035 ; 
CODE:00401035                 jmp     short loc_0_401053
CODE:00401037 ; 
CODE:00401037 
CODE:00401037 loc_0_401037:                           ; CODE XREF: sub_0_401026+Bj
CODE:00401037                 cmp     ax, 10h
CODE:0040103B                 jnz     short loc_0_401041
CODE:0040103D                 jmp     short loc_0_401059
CODE:0040103F ; 
CODE:0040103F                 jmp     short loc_0_401053
CODE:00401041 ; 
CODE:00401041 
CODE:00401041 loc_0_401041:                           ; CODE XREF: sub_0_401026+15j
CODE:00401041                 cmp     ax, 111h
CODE:00401045                 jnz     short loc_0_40104B
CODE:00401047                 jmp     short loc_0_401067
CODE:00401049 ; 
CODE:00401049                 jmp     short loc_0_401053
CODE:0040104B ; 
CODE:0040104B 
CODE:0040104B loc_0_40104B:                           ; CODE XREF: sub_0_401026+1Fj
CODE:0040104B                 cmp     ax, 110h
CODE:0040104F                 jnz     short loc_0_401053
CODE:00401051                 jmp     short loc_0_4010C3
CODE:00401053 ; 
CODE:00401053 
CODE:00401053 loc_0_401053:                           ; CODE XREF: sub_0_401026+Fj
CODE:00401053                                         ; sub_0_401026+19j ...
CODE:00401053                 xor     eax, eax
CODE:00401055                 leave
CODE:00401056                 retn    10h
CODE:00401059 ; 
CODE:00401059 
CODE:00401059 loc_0_401059:                           ; CODE XREF: sub_0_401026+Dj
CODE:00401059                                         ; sub_0_401026+17j ...
CODE:00401059                 push    0               ; nResult
CODE:0040105B                 push    [ebp+hWnd]      ; hDlg
CODE:0040105E                 call    EndDialog
CODE:00401063                 leave
CODE:00401064                 retn    10h
CODE:00401067 ; 
CODE:00401067 
CODE:00401067 loc_0_401067:                           ; CODE XREF: sub_0_401026+21j
CODE:00401067                 cmp     [ebp+arg_8], 3EAh
CODE:0040106E                 jnz     short loc_0_401081
CODE:00401070                 shr     [ebp+arg_8], 10h
CODE:00401074                 cmp     [ebp+arg_8], 0
CODE:00401078                 jnz     short loc_0_40107F
CODE:0040107A                 nop
CODE:0040107B                 nop
CODE:0040107C                 nop
CODE:0040107D                 jmp     short loc_0_401059
CODE:0040107F ; 
CODE:0040107F 
CODE:0040107F loc_0_40107F:                           ; CODE XREF: sub_0_401026+52j
CODE:0040107F                 jmp     short locret_0_4010BF
CODE:00401081 ; 
CODE:00401081 
CODE:00401081 loc_0_401081:                           ; CODE XREF: sub_0_401026+48j
CODE:00401081                 cmp     [ebp+arg_8], 3EBh
CODE:00401088                 jnz     short loc_0_4010AA
CODE:0040108A                 shr     [ebp+arg_8], 10h
CODE:0040108E                 cmp     [ebp+arg_8], 0
CODE:00401092                 jnz     short loc_0_4010A8
CODE:00401094                 push    0               ; uType
CODE:00401096                 push    offset aShowmeByTomkol ; lpCaption
CODE:0040109B                 push    offset aZebyZlamacShowmeMusisz1_PobracTekstZEditAIUstawicG ; lpText
CODE:004010A0                 push    [ebp+hWnd]      ; hWnd
CODE:004010A3                 call    MessageBoxA
CODE:004010A8 
CODE:004010A8 loc_0_4010A8:                           ; CODE XREF: sub_0_401026+6Cj
CODE:004010A8                 jmp     short locret_0_4010BF
CODE:004010AA ; 
CODE:004010AA 
CODE:004010AA loc_0_4010AA:                           ; CODE XREF: sub_0_401026+62j
CODE:004010AA                 cmp     [ebp+arg_8], 3ECh
CODE:004010B1                 jnz     short locret_0_4010BF
CODE:004010B3                 shr     [ebp+arg_8], 10h
CODE:004010B7                 cmp     [ebp+arg_8], 0
CODE:004010BB                 jnz     short locret_0_4010BF
CODE:004010BD                 nop
CODE:004010BE                 nop
CODE:004010BF 
CODE:004010BF locret_0_4010BF:                        ; CODE XREF: sub_0_401026+59j
CODE:004010BF                                         ; sub_0_401026+82j ...
CODE:004010BF                 leave
CODE:004010C0                 retn    10h




Dodamy sobie API GetDlgItem z User32.dll, zeby moc obsluzyc edita.. 
(Nie opisuje dodawania api do tabeli importow poniewaz jest duzo tutoriali na ten temat)
Powiem tylko tyle ze dodamy nowa sekcje poniewaz musielibysmy pozmieniac VA niektorych importow a to wiazaloby sie ze zmiana w kodzie itp..

Ok, api dodane.. teraz api jest pod 00407018h..
Teraz pod offsetem 785h (VA 00401185h) damy 'jmp ds:00407018h'

Pod 0040118Bh zostaje nam duzo miejsca na umieszczenie wlasnego kodu...

Pod adresem 00401067h zaczyna sie sprawdzanie ktory button zostal nacisniety..
Zmienimy to na przekierowanie do naszego nowego kodu do 0040118Bh
opkod to:  E9 1F 01 00 00

Teraz pod 0040118Bh:
      cmp [ebp+arg_8], 3EBh ; ID_ABOUT
      jz 00401094h          ; show info

      cmp [ebp+arg_8], 3EAh ; ID_SET
      jnz @F         

      push 3E9h             ; ID_EDIT
      push [ebp+arg_0]      ; hDlg
      call j_GetDlgItem

; pod 00402138h bedziemy umieszczac kod z edita
      push eax
      push FFh  ; MaxChars 255
      push 00402138h
      push 0Dh  ; WM_GETTEXT
      push eax
      call j_SendMessageA
      pop eax
      push FFh  ; MaxChars 255
      push 00402138h
      push 0Ch  ; WM_SETTEXT
      push eax
      call j_SendMessageA
      leave
      ret 10h
      @@:
      cmp [ebp+arg_8], 3ECh ; ID_EXIT
      jz 00401059h  ; end dialog   
      leave
      ret 10h

Ok, teraz przy zamykaniu programu trzeba wyswietlic messageboxa z info..
Kod konczacy jest pod: 00401059h
Ale niestety juz zabraknie kodu gdyz pod 800h jest nowa sekcja..

Wykorzystamy do tego nowa sekcje, ta co zrobilismy przy dodawaniu importow..
Kod bedzie pod VA=00407070h

Wiec zmienmy kod:
CODE:00401059                 push    0
CODE:0040105B                 push    [ebp+arg_0]
CODE:0040105E                 call    j_EndDialog
CODE:00401063                 leave
CODE:00401064                 retn    10h

na:

jmp 00407070h

           push    0
           push    offset szInfo
           push    offset szCapt
           push    [ebp+arg_0]
           call    j_MessageBoxA
           push    0
           push    [ebp+arg_0]
           call    j_EndDialog
           leave
           retn    10h

Teraz nopujemy 2 bajty z 00401033h zeby sie 2x nie pokazywal messagebox przy wychodzeniu..           
Heh.. znow reverseme ToMKoL'a zostalo polamene w pare chwill.. ale zachecam autora do dalczych prac nad reversmesami ;)

Greetings goes to:
  ManSun, Sorthalan, smola, PiT^R
  And all hard working ppls from UnderPl ;)


_TeStON_

