The MASM Forum Archive 2004 to 2012

General Forums => The Campus => Topic started by: Darrel on May 04, 2006, 06:31:32 PM

Title: Self Modifying Program
Post by: Darrel on May 04, 2006, 06:31:32 PM
Need to make a program that modifies the application icon while it is running. What I have is a program that calculates the current phase of the moon. When I have the program run by scheduled tasks I would like it to update its icon to show the correct phase.

Thanks for your time and consideration,

Darrel
Title: Re: Self Modifying Program
Post by: Ossa on May 04, 2006, 06:43:40 PM
Hi,

Why not just include several icons as resources (or even external files) - one for each discernable phase - and load the appropriate one when it is needed?

Ossa
Title: Re: Self Modifying Program
Post by: KSS on May 04, 2006, 08:56:44 PM
Hi, Darrel.
And what trouble with your plan?
Create NEW icon when program need change it icon.
Look in MSDN for CreateIcon.
Title: Re: Self Modifying Program
Post by: Darrel on May 04, 2006, 09:27:59 PM
Yes I can place an icon on my desktop and have my program rewrite it at certain intervals. What I would like is to put thr program on the desktop and have it rewrite itself at certain intervals. As it stands right now I don't believe windows will let me rewrite my executable while it is running.
Title: Re: Self Modifying Program
Post by: Ossa on May 04, 2006, 09:37:39 PM
Ah, I see what you mean now... and the answer for a simple solution is no. With the application running, the executable cannot be open/altered/deleted. Even if you change the application icon in memory, it will not alter the EXE file icon.

There IS, however, another solution. Write 2 applications, call them A and B. A is the one that will sit on your desktop. B is the one that will alter the icon of A. Here's what happens when A is run (with a blank commandline).


Overly complex, but the only way that I can quickly think of to do what I think it is that you want to do.

Ossa
Title: Re: Self Modifying Program
Post by: KSS on May 04, 2006, 09:43:24 PM
Hi, Darrel.
Now understood.

1. You need include sub-program in your EXE (Program that modify your main EXE)
2. When you need — extract sub-program to Windows temp dir and run it with param (path to your main-exe file)
3. EXIT(!!!) with main-exe file.
4. When sub-program start it wait some time (10s) for main program can exit, than sub-program must modify main-EXE and RESET windows icon cache.
Title: Re: Self Modifying Program
Post by: Darrel on May 04, 2006, 09:53:11 PM
Hey,  :8)

I see the problem has been correctly explained and solutions appropriately applied. Not what I was looking for but was expected more or less. Sounds like a flaw in the operating system because it should load the file into memory and not care what I do to the file.

Have a good day,

Darrel
Title: Re: Self Modifying Program
Post by: MichaelW on May 05, 2006, 03:12:34 AM
I doubt that the behavior is a "flaw", it's probably by design.

Instead of modifying the exe could you use a  Shell Extension Handler (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/shellcc/platform/shell/programmersguide/shell_int/shell_int_extending/extensionhandlers/shell_ext.asp), specifically an  Icon Handler (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/shellcc/platform/shell/programmersguide/shell_int/shell_int_extending/extensionhandlers/iconhandlers.asp)?

Title: Re: Self Modifying Program
Post by: jckl on May 05, 2006, 03:20:58 AM
not sure if this would work or not but maybe store the icon that is used in a file. Maybe like an ini file and then when the app is loaded you can have the app set the icon from there. Not sure if it is possible to change the icon while the app is running or not but you could try that aswell so you car changing it plus saving it for when you open the app again.
Title: Re: Self Modifying Program
Post by: Synfire on May 05, 2006, 06:58:56 AM
What you are looking for is called polymorphic code (http://en.wikipedia.org/wiki/Polymorphic_code) and it's well documented if you search for that term (just ignore a lot of the C++/C# results which have a different meaning for polymorphism). One possible solution would be to create a remote thread upon exit, then remote thread shouldl modify the PE/EXE then exit. Unfortunately I don't feel comfort able discussing this because of it's common relation to malware, as well most Anti-Virus will flag your program as a virus if it attempts to modify itself during execution so many people won't run your application if you do this anyways.

Quote
Sounds like a flaw in the operating system because it should load the file into memory and not care what I do to the file.

Actually that is a protection mechinism that ensures other applications won't modify/delete the program while it's running.
Title: Re: Self Modifying Program
Post by: asmrixstar on May 05, 2006, 09:50:00 AM
Are you trying to modify the system tray icon or the program exe icon
If its the system tray just a thought here but, you could try this method:
1. make the resource section writeable
2. modify the the icons bits directly
3. then load the original icon again with LoadIcon

Im sure ive seen this method used i at least 2 programs its messy codewise but you only need 1 default icon
It would prolly fall over if you modify the original icon though..
Title: Re: Self Modifying Program
Post by: Darrel on May 05, 2006, 04:26:35 PM
"A flaw in the operating system" is a correct statement. Why? I am assuming that the operating system was designed. All programs or operating systems run according to design be the behavior intended or unintended. Anyhow the design of the operating system is implied.

My understanding which may be wrong is when a program is run, it gets loaded into RAM and runs according to what is loaded into RAM and is independent of the program on the hard drive being changed or deleted, hence a flaw in the operating system. Please correct me if my understanding on this analysis is flawed.
Title: Re: Self Modifying Program
Post by: dsouza123 on May 05, 2006, 04:26:59 PM
In the workshop the original Hard Disk monitor, which runs in the system tray,
switches between icons depending on disk activity.

http://www.masmforum.com/simple/index.php?PHPSESSID=9aab094f5c39baec8f29a2c3dc7ad70e&topic=4163.0

The newer versions do also.
Title: Re: Self Modifying Program
Post by: P1 on May 05, 2006, 05:11:59 PM
Combine several of your ideas with a Windows Trick.  Keep all icons in the .exe file, but ....

Put a .lnk on the desktop and re-write it when you want the icon to change.  Then refresh the system desktop.

'Search' will get you plenty of .lnk code to have fun with.

Regards,  P1  :8)

Title: Re: Self Modifying Program
Post by: MichaelW on May 05, 2006, 07:29:43 PM
Quote
My understanding which may be wrong is when a program is run, it gets loaded into RAM and runs according to what is loaded into RAM and is independent of the program on the hard drive being changed or deleted, hence a flaw in the operating system.

A program in memory does not necessarily run independently of the executable file. For 16-bit DOS programs there were overlays, and for Win32 programs there are resources that are stored in and loaded from the executable file.

I can't really see any good reason to change the application icon while the program is running, but if you must do so, instead of resorting to malware techniques, why not try to use the methods that Microsoft provided?
Title: Re: Self Modifying Program
Post by: Darrel on May 05, 2006, 10:19:34 PM
Michael,

Thanks for clarifying my understanding of how a program functions. I'm always learning.

Quote from: MichaelW on May 05, 2006, 07:29:43 PM
I can’t really see any good reason to change the application icon while the program is running, but if you must do so, instead of resorting to malware techniques, why not try to use the methods that Microsoft provided?

Let me reiterate: I have a program that calculates the phase of the moon for any given time past, present, or future accurate to within five minutes of the actual phase. Is it not logical to have as the application icon the present phase of the moon updated every couple hours and the most logical way would be to have the application update its' icon itself ? This may not be a good reason to someone who has no interest in astronomy.

I am unfamiliar with malware techniques and have no interest in them.

I will probably just write a seperate program to run at certain intervals and update the application icon of concern.
Title: Re: Self Modifying Program
Post by: Synfire on May 06, 2006, 12:17:17 AM
QuoteI can't really see any good reason to change the application icon while the program is running, but if you must do so, instead of resorting to malware techniques, why not try to use the methods that Microsoft provided?

It's not technically a malware technique. Polymorphic code has many legitimate uses (such as in copyright protection of executables) but the fact is almost any information regarding Polymorphic code is usually in relation to malware as that is where it's used more often than not.
Title: Re: Self Modifying Program
Post by: Mark Jones on May 06, 2006, 12:26:43 AM
Quote from: Darrel on May 05, 2006, 10:19:34 PM
I will probably just write a seperate program to run at certain intervals and update the application icon of concern.

That may be a possibility, if you do that be sure to make the "watcher" app as small as possible so it doesn't use much RAM. You could use the free tool MemProof to see if there are any memory leaks in the watcher thread. Or alernatively, make a "scheduled task" and stick it into the Control Panel\Scheduled Tasks. Might be different on all versions of windows (not sure if 9x even had "scheduled tasks") but all will act differently. Have fun. :)
Title: Re: Self Modifying Program
Post by: xbox7887 on May 06, 2006, 07:52:35 AM
Not sure if this will help or not but it's what I use when writing to read-only addresses.  The method is somewhat inefficient since you'll need to manually poke in the data or opcodes needed but it gets the job done :)
pushad
mov     eax, cr0
push    eax
and     eax, 0FFFEFFFFh
mov     cr0, eax

;/////PUT PATCH CODE HERE/////

pop     eax
mov     cr0, eax
popad

Title: Re: Self Modifying Program
Post by: Darrel on May 12, 2006, 10:30:01 PM
Ok, I've wrote a program which updates the application icon to the correct phase, but this change is not reflected on the desktop link.
Title: Re: Self Modifying Program
Post by: PBrennick on May 13, 2006, 05:21:18 PM
Really?
Title: Re: Self Modifying Program
Post by: Ar-ras on May 13, 2006, 05:56:04 PM
F5?
Title: Re: Self Modifying Program
Post by: Darrel on May 13, 2006, 07:02:39 PM
F5 doesn't work. I'm looking to update it in code. It displays the icon which is present at log on and does not refresh with the new icon.
Title: Re: Self Modifying Program
Post by: P1 on May 15, 2006, 02:08:35 PM
Quote from: Darrel on May 13, 2006, 07:02:39 PMF5 doesn't work. I'm looking to update it in code. It displays the icon which is present at log on and does not refresh with the new icon.
This is why you make a link file for the desktop and re-write it to the correct icon.

Regards,  P1  :8)
Title: Re: Self Modifying Program
Post by: Darrel on May 15, 2006, 04:46:08 PM
Thanks,

Everything is working now.

Darrel
Title: Re: Self Modifying Program
Post by: evlncrn8 on October 06, 2007, 09:10:24 AM
Quote from: xbox7887 on May 06, 2006, 07:52:35 AM
Not sure if this will help or not but it's what I use when writing to read-only addresses.  The method is somewhat inefficient since you'll need to manually poke in the data or opcodes needed but it gets the job done :)
pushad
mov     eax, cr0
push    eax
and     eax, 0FFFEFFFFh
mov     cr0, eax

;/////PUT PATCH CODE HERE/////

pop     eax
mov     cr0, eax
popad



erm correct me if im wrong, but thats ring 0 code, and its been known for a while...
and it wont work in ring 3, it causes an exception.....