Problem with binary progging

[thomasantony]

Hi,
  I am wokring on making small program using a hex editor only to learn more about the PE format. So I made an ExitProcess proggy and a messagebox proggy that worked well. Now I am working on a window. AFAIK it is working Ok. but it keeps crashing. with Olly dbg I found it was crashing on CreateWindowEx  :snooty:

Thomas Antony ::)

[attachment deleted by admin]

[pbrennick]

Gee, I am sorry to hear that, hope you can work it out.  Are you asking a question or just chewing the fat?  Show us what is stumping you and we might be able to help.

Paul

[sluggy]

For a start, i would check 3 things:

- run your exe thru a disassembler, to make sure that what you think is there is actually there. You may have used an incorrect opcode, etc.

- are you using a window class name or an atom for lpClassName? Having either wring will cause a crash.

- make sure your data is aligned, easy to get out of alignment when you are hand coding the hex.


You could also add a call to GetLastError or add some SEH, of course you will have to do that the hardcore way as well :)

[thomasantony]

Uh, I was stupid to forget to post the attachment. Anyway I solved the problem. I was filling the wrong members of WNDCLASSEX and there was some problems with the jump table and API calls. I have also made my own 60h byte DOS stub. THe file is attached.

Thomas

[attachment deleted by admin]

[hutch--]

Thomas,

I downloaded the file and tried it but it does not run on my win2k sp4. What is it supposed to do ?

[hitchhikr]

It just displays a window.

Replace the bytes at 0x2b6 (0xff 0x75 0x04) with 0x6a 0x0a 0x90 and the window will be displayed.

[pbrennick]

It does not run on XP HE, either.  However, it does run on ME.

Paul

[hitchhikr]

Once patched it runs under xp sp1.

[thomasantony]

Hi,
  Thnx for testing. BTW I use Win98SE. So I made such that it works on that. What did you patch hitch? Isn't the PE format a standard?

Thomas

[hitchhikr]

The nCmdShow value passed to ShowWindow was wrong and newer windows are obviously not as forgiving as the older ones.

[thomasantony]

Oops,
    I didn't pass the value to Wndproc and tried to use the parameter but even that was wrong I used [ebp+4] instead of [ebp+14]. The new one is in the first post

Thomas