 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
whtwht
Master Cheater
![]() Reputation: 0
Joined: 21 May 2006
Posts: 390
|
 Posted: Sat Jan 31, 2009 12:38 pm Post subject: PeekMessage and DispatchMessage |
 |
|
| Code: | sub_55D520(int a1){
int v1;
BOOL v2;
HCURSOR v4;
HINSTANCE v5;
HACCEL v6;
struct tagMSG Msg;
WNDCLASSEXA v8;
v1 = a1;
v6 = LoadAcceleratorsA(0, (LPCSTR)0x71);
Msg.message = 0;
PeekMessageA(&Msg, 0, 0, 0, 0);
v8.cbSize = 48;
v8.cbClsExtra = 0;
v8.cbWndExtra = 0;
v8.hbrBackground = GetStockObject(0);
v4 = LoadCursorsA(0, (LPCSTR)0x7F00);
v5 = *(HINSTANCE *)(v1 + 4);
v8.hCursor = v4;
v8.hIcon = 0;
v8.hIconSm = 0;
v8.hInstance = v5;
v8.lpfnWndProc = (WNDPROC)sub_55AC70;
v8.lpszClassName = "WebWindow";
v8.lpszMenuName = 0;
v8.style = 0;
RegisterClassExA(&v8);
sub_401FD2(184, 1024);
sub_401FD2(124, 1024);
sub_40128F();
while(Msg.message != 18){
v2 = PeekMessageA(&Msg, 0, 0, 0, 1u);
if ( Msg.message == 260)
{
if (!sub_4021FD(Msg.wParam, 0))
v2 = 0;
}
if ( (Msg.message != 161 || Msg.wParam != 2 || sub_4026D0()) && v2)
{
if( !TranslateAccelerator(*(_DWORD *)(V1 + 44))(v1);
{
TranslateMessage(&Msg);
DispatchMessageA(&Msg);
}
}
else
{
if( *(_DWORD *)(v1 + 178804)
{
Sleep(0x64u);
(*(int (_thiscall **)(_DWORD))(*(_DWORD *)v1 + 44))(v1);
}
if( !*(_DWORD *)(v1 +178080) )
Sleep(0x64u);
if( *(_DWORD *)(v1 + 178084))
{
if( sub_55D6D0 () < 0)
SendMessageA(*(HWND *)(v1 + 178212), 0x10u, 0, 0);
}
}
}
sub_4015E6;
sub_55DFA0();
return Msg.wParam;
} |
Heres the code,
I'm trying to understand how this flow works, not speficially the things after the else statment, but the TranslateMessage and DispatchMessage, if someone could explain it more clearly, I only have a general idea of how it works right now, and the sub_xxxxxx are other routines, if you need them, I can post them, but is MSG being affected by anything outside of this function? I don't think so.... so I'm a little confused
_________________
zzzzzzz |
|
| Back to top |
|
 |
sloppy
Expert Cheater
![]() Reputation: 0
Joined: 17 Aug 2008
Posts: 123
|
| Posted: Sat Jan 31, 2009 10:00 pm Post subject: |
|
|
That is some ugly code.
GetMessage will return after the message has been processed. PeekMessage returns immediately and will continue checking the message queue, useful if you are performing some lengthy operations in the window procedure and wish to interrupt it rather than waiting for completion (using threads would be a better choice). DispatchMessage passes the message onto your window procedure (sub_55AC70).
TranslateMessage()
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sat Jan 31, 2009 10:19 pm Post subject: |
|
|
The code is outputed by IDA's Hex-Ray pseudo C decompiler. It isn't meant to be perfect but to give a outline on how the disassembled file's function is made in C code.
_________________
|
|
| Back to top |
|
|
zoren123
Cheater
 Reputation: 0
Joined: 28 Nov 2008
Posts: 39
Location: hdhdfgh
|
| Posted: Sun Feb 01, 2009 2:18 am Post subject: |
|
|
what does it do?
_________________
gwqrwqerwqtwer |
|
| Back to top |
|
|
whtwht
Master Cheater
![]() Reputation: 0
Joined: 21 May 2006
Posts: 390
|
| Posted: Sun Feb 01, 2009 10:34 am Post subject: |
|
|
yeap, lurc is right, its generated by the Hex-Rays decompiler,
This is the chunk of code thats shutting my game down once HShield isn't loaded, if I knew what it did, I wouldn't be asking.
The main thing is, does the peekmessage and getmessage get message queses from the Hshield module, so that its loaded? or something else is inputting the message queue?, Because I stepped through it and I saw the exitcode being inputed, however, I'm stumped as to what is inputting that? The server? or its a trick if the Hshield isn't loaded to always load exitcode.
_________________
zzzzzzz |
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sun Feb 01, 2009 11:03 am Post subject: |
|
|
| Code: | //...
while (Msg != WM_QUIT)
{
bRET = PeekMessage(&Msg, 0, 0, 0, 1);
if (Msg == WM_SYSKEYDOWN)
if (!sub_4021FD(Msg.wParam, 0)) // wParam contains the keycode.
bRET = FALSE;
if (Msg != WM_NCLBUTTONDOWN || Msg != WM_DESTROY || subFunc()) && bRET)
{
// Not a WM_DESTROY/NCLBUTTONDOWN.
// TranslateAccelerator - http://msdn.microsoft.com/en-us/library/ms646373(VS.85).aspx
// What the fuck? TranslateAccelerator has 3 parameters...
// if( !TranslateAccelerator(*(_DWORD *)(V1 + 44))(v1); This line is fucked... provide assembly please.
// It tells us that there is something located at the Argument1 (Possibly a class or struct, need ASM for that) at the offset 44 (2Ch)
}
else
{
// Remember that v1 is the first parameter.
if (*(DWORD*)(v1 + 0x2BA74)) // At this point I'm thinking v1 is a base to a module or its the HSheild Class.
{
Sleep(100);
(*(int (_thiscall **)(_DWORD))(*(_DWORD *)v1 + 44))(v1);
// Function located at Arg1 offset 2Ch, with the parameter of the argument itself..
}
if (!*(DWORD*)(v1 + 0x2B7A0))
Sleep(100);
if (*(DWORD*)(v1 + 0x2B7A4))
{
if (sub_55D6D0 () < 0)
SendMessageA( *(HWND*)(v1 + 0x2B824), WM_CLOSE, 0, 0);
// If this what's closing you Arg1+0x2B824=ProtectedWindow
// If above is true, patch this so that SendMessage isn't called.
// Or that the compare for the ret of sub_55D6D0 (EAX) returns false so that
// SendMessage is not even executed.
}
}
// ...
} |
_________________
|
|
| Back to top |
|
|
whtwht
Master Cheater
![]() Reputation: 0
Joined: 21 May 2006
Posts: 390
|
| Posted: Sun Feb 01, 2009 2:47 pm Post subject: |
|
|
| Code: | 0055D520 /$ 83EC 50 SUB ESP,50
0055D523 |. 53 PUSH EBX
0055D524 |. 56 PUSH ESI
0055D525 |. 33DB XOR EBX,EBX
0055D527 |. 6A 71 PUSH 71 ; /TableName = 71
0055D529 |. 8BF1 MOV ESI,ECX ; |
0055D52B |. 53 PUSH EBX ; |hInst = 7FFD7000
0055D52C |. FF15 A09D8F00 CALL DWORD PTR DS:[<&USER32.LoadAcceleratorsA>; \LoadAcceleratorsA
0055D532 |. 53 PUSH EBX ; /RemoveMsg = PM_NOREMOVE|7FFD7000
0055D533 |. 894424 0C MOV DWORD PTR SS:[ESP+C],EAX ; |ACEonlin.00400000
0055D537 |. 53 PUSH EBX ; |MsgFilterMax = MSG(7FFD7000)
0055D538 |. 53 PUSH EBX ; |MsgFilterMin = MSG(7FFD7000)
0055D539 |. 8D4424 18 LEA EAX,DWORD PTR SS:[ESP+18] ; |
0055D53D |. 53 PUSH EBX ; |hWnd = 7FFD7000
0055D53E |. 50 PUSH EAX ; |pMsg = ACEonlin.00400000
0055D53F |. 895C24 24 MOV DWORD PTR SS:[ESP+24],EBX ; |
0055D543 |. FF15 9C9D8F00 CALL DWORD PTR DS:[<&USER32.PeekMessageA>] ; \PeekMessageA
0055D549 |. 53 PUSH EBX ; /ObjType = 2147315712.
0055D54A |. C74424 2C 30000000 MOV DWORD PTR SS:[ESP+2C],30 ; |
0055D552 |. 895C24 38 MOV DWORD PTR SS:[ESP+38],EBX ; |
0055D556 |. 895C24 3C MOV DWORD PTR SS:[ESP+3C],EBX ; |
0055D55A |. FF15 94998F00 CALL DWORD PTR DS:[<&GDI32.GetStockObject>] ; \GetStockObject
0055D560 |. 68 007F0000 PUSH 7F00 ; /RsrcName = IDC_ARROW
0055D565 |. 53 PUSH EBX ; |hInst = 7FFD7000
0055D566 |. 894424 50 MOV DWORD PTR SS:[ESP+50],EAX ; |ACEonlin.00400000
0055D56A |. FF15 449E8F00 CALL DWORD PTR DS:[<&USER32.LoadCursorA>] ; \LoadCursorA
0055D570 |. 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
0055D573 |. 8D5424 28 LEA EDX,DWORD PTR SS:[ESP+28]
0055D577 |. 52 PUSH EDX ; /pWndClassEx = ntdll.7C97E4C0
0055D578 |. 894424 48 MOV DWORD PTR SS:[ESP+48],EAX ; |ACEonlin.00400000
0055D57C |. 895C24 44 MOV DWORD PTR SS:[ESP+44],EBX ; |
0055D580 |. 895C24 58 MOV DWORD PTR SS:[ESP+58],EBX ; |
0055D584 |. 894C24 40 MOV DWORD PTR SS:[ESP+40],ECX ; |
0055D588 |. C74424 34 70AC5500 MOV DWORD PTR SS:[ESP+34],ACEonlin.0055AC70 ; |
0055D590 |. C74424 54 ACB08B00 MOV DWORD PTR SS:[ESP+54],ACEonlin.008BB0AC ; |ASCII "WebWindow"
0055D598 |. 895C24 50 MOV DWORD PTR SS:[ESP+50],EBX ; |
0055D59C |. 895C24 30 MOV DWORD PTR SS:[ESP+30],EBX ; |
0055D5A0 |. FF15 989D8F00 CALL DWORD PTR DS:[<&USER32.RegisterClassExA>>; \RegisterClassExA
0055D5A6 |. 68 00040000 PUSH 400
0055D5AB |. 68 B8000000 PUSH 0B8
0055D5B0 |. E8 1D4AEAFF CALL ACEonlin.00401FD2
0055D5B5 |. 68 00040000 PUSH 400
0055D5BA |. 6A 7C PUSH 7C
0055D5BC |. E8 114AEAFF CALL ACEonlin.00401FD2
0055D5C1 |. 83C4 10 ADD ESP,10
0055D5C4 |. E8 C63CEAFF CALL ACEonlin.0040128F
0055D5C9 |. 837C24 10 12 CMP DWORD PTR SS:[ESP+10],12
0055D5CE |. 0F84 E3000000 JE ACEonlin.0055D6B7
0055D5D4 |. 55 PUSH EBP
0055D5D5 |. 8B2D 949B8F00 MOV EBP,DWORD PTR DS:[<&kernel32.Sleep>] ; kernel32.Sleep
0055D5DB |. 57 PUSH EDI ; ntdll.7C910738
0055D5DC |> 6A 01 /PUSH 1 ; /RemoveMsg = PM_REMOVE
0055D5DE |. 53 |PUSH EBX ; |MsgFilterMax = MSG(7FFD7000)
0055D5DF |. 53 |PUSH EBX ; |MsgFilterMin = MSG(7FFD7000)
0055D5E0 |. 8D4424 20 |LEA EAX,DWORD PTR SS:[ESP+20] ; |
0055D5E4 |. 53 |PUSH EBX ; |hWnd = 7FFD7000
0055D5E5 |. 50 |PUSH EAX ; |pMsg = ACEonlin.00400000
0055D5E6 |. FF15 9C9D8F00 |CALL DWORD PTR DS:[<&USER32.PeekMessageA>] ; \PeekMessageA
0055D5EC |. 8BF8 |MOV EDI,EAX ; ACEonlin.00400000
0055D5EE |. 8B4424 18 |MOV EAX,DWORD PTR SS:[ESP+18]
0055D5F2 |. 3D 04010000 |CMP EAX,104
0055D5F7 |. 75 17 |JNZ SHORT ACEonlin.0055D610
0055D5F9 |. 8B4C24 1C |MOV ECX,DWORD PTR SS:[ESP+1C]
0055D5FD |. 53 |PUSH EBX
0055D5FE |. 51 |PUSH ECX
0055D5FF |. 8B0D 6CBD8E00 |MOV ECX,DWORD PTR DS:[8EBD6C]
0055D605 |. E8 F34BEAFF |CALL ACEonlin.004021FD
0055D60A |. 85C0 |TEST EAX,EAX ; ACEonlin.00400000
0055D60C |. 75 02 |JNZ SHORT ACEonlin.0055D610
0055D60E |. 33FF |XOR EDI,EDI ; ntdll.7C910738
0055D610 |> 817C24 18 A1000000 |CMP DWORD PTR SS:[ESP+18],0A1
0055D618 |. 75 16 |JNZ SHORT ACEonlin.0055D630
0055D61A |. 837C24 1C 02 |CMP DWORD PTR SS:[ESP+1C],2
0055D61F |. 75 0F |JNZ SHORT ACEonlin.0055D630
0055D621 |. 8B0D 6CBD8E00 |MOV ECX,DWORD PTR DS:[8EBD6C]
0055D627 |. E8 A450EAFF |CALL ACEonlin.004026D0
0055D62C |. 85C0 |TEST EAX,EAX ; ACEonlin.00400000
0055D62E |. 74 37 |JE SHORT ACEonlin.0055D667
0055D630 |> 3BFB |CMP EDI,EBX
0055D632 |. 74 33 |JE SHORT ACEonlin.0055D667
0055D634 |. 8B4424 10 |MOV EAX,DWORD PTR SS:[ESP+10]
0055D638 |. 8B8E 24B80200 |MOV ECX,DWORD PTR DS:[ESI+2B824]
0055D63E |. 8D5424 14 |LEA EDX,DWORD PTR SS:[ESP+14]
0055D642 |. 52 |PUSH EDX ; /pMsg = MSG(FFFFFFFF) hw = 7C97C460 wParam = 0 lParam = 0
0055D643 |. 50 |PUSH EAX ; |hAccel = 00400000
0055D644 |. 51 |PUSH ECX ; |hWnd = 0000006D
0055D645 |. FF15 949D8F00 |CALL DWORD PTR DS:[<&USER32.TranslateAcceler>; \TranslateAcceleratorA
0055D64B |. 85C0 |TEST EAX,EAX ; ACEonlin.00400000
0055D64D |. 75 5B |JNZ SHORT ACEonlin.0055D6AA
0055D64F |. 8D5424 14 |LEA EDX,DWORD PTR SS:[ESP+14]
0055D653 |. 52 |PUSH EDX ; /pMsg = MSG(FFFFFFFF) hw = 7C97C460 wParam = 0 lParam = 0
0055D654 |. FF15 909D8F00 |CALL DWORD PTR DS:[<&USER32.TranslateMessage>; \TranslateMessage
0055D65A |. 8D4424 14 |LEA EAX,DWORD PTR SS:[ESP+14]
0055D65E |. 50 |PUSH EAX ; /pMsg = WM_MOVE hw = 905A4D X = -1. Y = 0.
0055D65F |. FF15 8C9D8F00 |CALL DWORD PTR DS:[<&USER32.DispatchMessageA>; \DispatchMessageA
0055D665 |. EB 43 |JMP SHORT ACEonlin.0055D6AA
0055D667 |> 399E 74BA0200 |CMP DWORD PTR DS:[ESI+2BA74],EBX
0055D66D |. 74 0B |JE SHORT ACEonlin.0055D67A
0055D66F |. 6A 64 |PUSH 64
0055D671 |. FFD5 |CALL EBP
0055D673 |. 8B16 |MOV EDX,DWORD PTR DS:[ESI]
0055D675 |. 8BCE |MOV ECX,ESI
0055D677 |. FF52 2C |CALL DWORD PTR DS:[EDX+2C]
0055D67A |> 399E A0B70200 |CMP DWORD PTR DS:[ESI+2B7A0],EBX
0055D680 |. 75 04 |JNZ SHORT ACEonlin.0055D686
0055D682 |. 6A 64 |PUSH 64
0055D684 |. FFD5 |CALL EBP
0055D686 |> 399E A4B70200 |CMP DWORD PTR DS:[ESI+2B7A4],EBX
0055D68C |. 74 1C |JE SHORT ACEonlin.0055D6AA
0055D68E |. 8BCE |MOV ECX,ESI
0055D690 |. E8 3B000000 |CALL ACEonlin.0055D6D0
0055D695 |. 85C0 |TEST EAX,EAX ; ACEonlin.00400000
0055D697 |. 7D 11 |JGE SHORT ACEonlin.0055D6AA
0055D699 |. 8B86 24B80200 |MOV EAX,DWORD PTR DS:[ESI+2B824]
0055D69F |. 53 |PUSH EBX ; /lParam = 7FFD7000
0055D6A0 |. 53 |PUSH EBX ; |wParam = 7FFD7000
0055D6A1 |. 6A 10 |PUSH 10 ; |Message = WM_CLOSE
0055D6A3 |. 50 |PUSH EAX ; |hWnd = 400000
0055D6A4 |. FF15 089E8F00 |CALL DWORD PTR DS:[<&USER32.SendMessageA>] ; \SendMessageA
0055D6AA |> 837C24 18 12 |CMP DWORD PTR SS:[ESP+18],12
0055D6AF |.^ 0F85 27FFFFFF \JNZ ACEonlin.0055D5DC
0055D6B5 |. 5F POP EDI ; ACEonlin.007188DD
0055D6B6 |. 5D POP EBP ; ACEonlin.007188DD
0055D6B7 |> E8 2A3FEAFF CALL ACEonlin.004015E6
0055D6BC |. 8BCE MOV ECX,ESI
0055D6BE |. E8 DD080000 CALL ACEonlin.0055DFA0
0055D6C3 |. 8B4424 14 MOV EAX,DWORD PTR SS:[ESP+14] ; ntdll.7C910738
0055D6C7 |. 5E POP ESI ; ACEonlin.007188DD
0055D6C8 |. 5B POP EBX ; ACEonlin.007188DD
0055D6C9 |. 83C4 50 ADD ESP,50
0055D6CC \. C3 RETN
|
_________________
zzzzzzz |
|
| Back to top |
|
|
sponge
I'm a spammer
 Reputation: 1
Joined: 07 Nov 2006
Posts: 6009
|
| Posted: Sun Feb 01, 2009 2:49 pm Post subject: |
|
|
| Code: | | 0055D697 |. 7D 11 |JGE SHORT ACEonlin.0055D6AA |
This should interest you.
_________________
|
|
| Back to top |
|
|
whtwht
Master Cheater
![]() Reputation: 0
Joined: 21 May 2006
Posts: 390
|
| Posted: Sun Feb 01, 2009 8:41 pm Post subject: |
|
|
I've traced through this manually, and I'm pretty sure, in the message queue, translate message pops up with exit code and dispatch sends it
_________________
zzzzzzz |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
