flat assembler
Message board for the users of flat assembler.

Index > Windows > Can't get my process ID with GetWindowThreadProcessId,hwnd

Author
Thread Post new topic Reply to topic
FlaFlaw



Joined: 24 Aug 2007
Posts: 12
FlaFlaw
Hi

I'm trying to get the ID of a process but I can't get it with my assembly code. When I use OllyDbg to find out what's in procid, it's totally NULL. The window handler is 3 bytes long. Here's the code getting the process ID:

Code:
section '.code' code readable executable

  start:
       invoke  FindWindow,0,procname
       cmp eax,0
   je processclosed
    mov [hwnd],eax
      invoke GetWindowThreadProcessId,hwnd, addr procid    


The je isn't taken by the way, I'm sure the execution go through the button instructions.

Section .data

Code:
  hwnd          dd ?
  procid        dd ?    


Thanks

_________________
FlaFlaw
Post 24 Aug 2007, 18:54
View user's profile Send private message Reply with quote
sinsi



Joined: 10 Aug 2007
Posts: 693
Location: Adelaide
sinsi
Code:
        invoke GetWindowThreadProcessId,[hwnd], addr procid
     

Don't forget the brackets. Most of my crashes involve forgetting brackets...
Post 24 Aug 2007, 23:39
View user's profile Send private message Reply with quote
FlaFlaw



Joined: 24 Aug 2007
Posts: 12
FlaFlaw
Now I can't assemble my program because of this part:

Code:
    invoke ReadProcessMemory,[phandle],[address],[buffer],20h,0    


.idata:

Code:
  address      dd 0054E8C0h
  buffer rd 20h    

_________________
FlaFlaw


Last edited by FlaFlaw on 25 Aug 2007, 04:43; edited 1 time in total
Post 25 Aug 2007, 04:03
View user's profile Send private message Reply with quote
sinsi



Joined: 10 Aug 2007
Posts: 693
Location: Adelaide
sinsi
Code:
        invoke ReadProcessMemory,[phandle],[address],buffer,20h,0
    

No brackets this time.
Post 25 Aug 2007, 04:32
View user's profile Send private message Reply with quote
FlaFlaw



Joined: 24 Aug 2007
Posts: 12
FlaFlaw
Code:
flat assembler  version 1.67.21  (284778 kilobytes memory)
main.asm [39]:
        invoke ReadProcessMemory,[phandle],[address],buffer,20,0
\fasm\include\win32ax.inc [41] invoke [0]:
  \{ \reverse pushd <arg>
\fasm\include\win32ax.inc [37] pushd [27]:
      pushd <value>
\fasm\include\win32ax.inc [113] pushd [41]:
    push value
error: illegal instruction.    
Post 25 Aug 2007, 04:44
View user's profile Send private message Reply with quote
sinsi



Joined: 10 Aug 2007
Posts: 693
Location: Adelaide
sinsi
I inserted your source code into a working prog of mine and all was OK, and I don't see any problem with that line, so ...? post more code maybe?
Post 25 Aug 2007, 12:33
View user's profile Send private message Reply with quote
FlaFlaw



Joined: 24 Aug 2007
Posts: 12
FlaFlaw
Code:
; DialogBox example

format PE GUI 4.0
entry start

include '\fasm\include\win32ax.inc'

ID_OLDGUID                 = 101
ID_NEWGUID                     = 102
ID_VALIDATE                    = 103
ID_ICONERROR           = 201
ID_ICONINFORMATION     = 202
ID_ICONQUESTION                = 203
ID_ICONWARNING         = 204
ID_TOPMOST                     = 301

section '.data' data readable writeable

  address dq 0054E8C0h
  hwnd          dd ?
  procid        dd ?
  phandle       dd ?
  procname      db 'Windows Live Messenger',0
  appname    db 'by FlaFlaw',0
  noprocmsg      db 'Open your app, you dummy!',0
  buffer  rd 20h
  

section '.code' code readable executable

  start:
    invoke        FindWindow,0,addr procname
  cmp eax,0
   je processclosed
    mov [hwnd],eax
      invoke GetWindowThreadProcessId,[hwnd], addr procid
 invoke OpenProcess,PROCESS_ALL_ACCESS, 0, [procid]
  invoke ReadProcessMemory,[phandle],[address],buffer,20h,0
   mov [phandle],eax
   
    invoke  GetModuleHandle,0
   invoke  DialogBoxParam,eax,37,HWND_DESKTOP,DialogProc,0
     
  exit:
     invoke  ExitProcess,0
       
  processclosed:
    invoke  MessageBox,0,noprocmsg,appname,MB_OK
        jmp exit

proc DialogProc hwnddlg,msg,wparam,lparam
    cmp [msg],WM_INITDIALOG
     je wminitdialog
     cmp [msg],WM_COMMAND
     je wmcommand
     cmp [msg],WM_CLOSE
     je wmclose
  exit_dlg:
     xor eax,eax
     ret
 
  ; MAIN loop
  wminitdialog:
     jmp processed
  wmcommand:
     cmp [wparam],ID_VALIDATE
     je validate
      
     ; TODO
     jmp processed
  wmclose:
     invoke EndDialog,[hwnddlg],0
  processed:
     mov eax,1
  validate:
  finish:
     ret
endp

section '.idata' import data readable writeable

  library kernel,'KERNEL32.DLL',\
      ReadProcessMemory,'ReadProcessMemory',\
          user,'USER32.DLL'

  import kernel,\
      GetModuleHandle,'GetModuleHandleA',\
     OpenProcess,'OpenProcess',\
      ExitProcess,'ExitProcess'

  import user,\
         DialogBoxParam,'DialogBoxParamA',\
       FindWindow,'FindWindowA',\
       GetWindowThreadProcessId,'GetWindowThreadProcessId',\
    MessageBox,'MessageBoxA',\
       EndDialog,'EndDialog'

section '.rsrc' resource data readable

  directory RT_DIALOG,dialogs

  resource dialogs,\
     37,LANG_ENGLISH+SUBLANG_DEFAULT,demonstration

  dialog demonstration,'cGUID by FlaFlaw',10,10,200,76,WS_CAPTION+WS_POPUP+WS_SYSMENU+DS_MODALFRAME
    dialogitem 'STATIC',     '&Old GUID:',-1,10,15,40,10,WS_VISIBLE
    dialogitem 'EDIT',            '',ID_OLDGUID,53,13,138,12,WS_VISIBLE+WS_BORDER+WS_TABSTOP+WS_DISABLED
    dialogitem 'STATIC',  '&New GUID:',-1,10,33,40,10,WS_VISIBLE
    dialogitem 'EDIT',            '',ID_NEWGUID,53,33,138,12,WS_VISIBLE+WS_BORDER+WS_TABSTOP+ES_AUTOHSCROLL
 dialogitem 'BUTTON',  '&Validate',ID_VALIDATE,133,53,59,13,WS_VISIBLE+WS_TABSTOP+BS_DEFPUSHBUTTON
   dialogitem 'STATIC',  'Created by FlaFlaw',-1,57,56,71,9,WS_VISIBLE
  enddialog
    
Post 25 Aug 2007, 16:16
View user's profile Send private message Reply with quote
Yardman



Joined: 12 Apr 2005
Posts: 245
Location: US
Yardman
[ Post removed by author. ]


Last edited by Yardman on 04 Apr 2012, 02:45; edited 1 time in total
Post 25 Aug 2007, 18:49
View user's profile Send private message Reply with quote
FlaFlaw



Joined: 24 Aug 2007
Posts: 12
FlaFlaw
Thanks, it's working perfectly!!
Post 26 Aug 2007, 05:08
View user's profile Send private message Reply with quote
FlaFlaw



Joined: 24 Aug 2007
Posts: 12
FlaFlaw
I'm trying to avoid the other to change the memory I'm trying to change. Is there a way to freeze it to my value other then by doing a loop? My actual loop don't seem to work when my other application is in full screen. Is there a way to make my program work even if the other program is full screen? Maybe a thread or something...
Post 27 Aug 2007, 03:36
View user's profile Send private message Reply with quote
Kenneth



Joined: 16 Nov 2005
Posts: 38
Location: United States of America
Kenneth
Nop the instruction that keeps changing it.
Post 27 Aug 2007, 06:01
View user's profile Send private message AIM Address Yahoo Messenger MSN Messenger ICQ Number Reply with quote
FlaFlaw



Joined: 24 Aug 2007
Posts: 12
FlaFlaw
I don't want to patch the other program. There's many program in the wild (ArtMoney, Cheat Engine) allowing to modify the memory of other program and to freeze it so the other program can modify it. I want to do the same in my program....
Post 27 Aug 2007, 22:23
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.