Can't get my process ID with GetWindowThreadProcessId,hwnd

Index > Windows > Can't get my process ID with GetWindowThreadProcessId,hwnd

Author

Thread

FlaFlaw

Joined: 24 Aug 2007
Posts: 12

FlaFlaw 24 Aug 2007, 18:54

Hi

I'm trying to get the ID of a process but I can't get it with my assembly code. When I use OllyDbg to find out what's in procid, it's totally NULL. The window handler is 3 bytes long. Here's the code getting the process ID:

Code:

section '.code' code readable executable

  start:
       invoke  FindWindow,0,procname
       cmp eax,0
   je processclosed
    mov [hwnd],eax
      invoke GetWindowThreadProcessId,hwnd, addr procid

The je isn't taken by the way, I'm sure the execution go through the button instructions.

Section .data

Code:

  hwnd          dd ?
  procid        dd ?

Thanks

_________________
FlaFlaw

24 Aug 2007, 18:54

sinsi

Joined: 10 Aug 2007
Posts: 794
Location: Adelaide

sinsi 24 Aug 2007, 23:39

Code:

        invoke GetWindowThreadProcessId,[hwnd], addr procid

Don't forget the brackets. Most of my crashes involve forgetting brackets...

24 Aug 2007, 23:39

FlaFlaw

Joined: 24 Aug 2007
Posts: 12

FlaFlaw 25 Aug 2007, 04:03

Now I can't assemble my program because of this part:

Code:

    invoke ReadProcessMemory,[phandle],[address],[buffer],20h,0

.idata:

Code:

  address      dd 0054E8C0h
  buffer rd 20h

_________________
FlaFlaw

Last edited by FlaFlaw on 25 Aug 2007, 04:43; edited 1 time in total

25 Aug 2007, 04:03

sinsi

Joined: 10 Aug 2007
Posts: 794
Location: Adelaide

sinsi 25 Aug 2007, 04:32

Code:

        invoke ReadProcessMemory,[phandle],[address],buffer,20h,0

No brackets this time.

25 Aug 2007, 04:32

FlaFlaw

Joined: 24 Aug 2007
Posts: 12

FlaFlaw 25 Aug 2007, 04:44

Code:

flat assembler  version 1.67.21  (284778 kilobytes memory)
main.asm [39]:
        invoke ReadProcessMemory,[phandle],[address],buffer,20,0
\fasm\include\win32ax.inc [41] invoke [0]:
  \{ \reverse pushd <arg>
\fasm\include\win32ax.inc [37] pushd [27]:
      pushd <value>
\fasm\include\win32ax.inc [113] pushd [41]:
    push value
error: illegal instruction.

25 Aug 2007, 04:44

sinsi

Joined: 10 Aug 2007
Posts: 794
Location: Adelaide

sinsi 25 Aug 2007, 12:33

I inserted your source code into a working prog of mine and all was OK, and I don't see any problem with that line, so ...? post more code maybe?

25 Aug 2007, 12:33

FlaFlaw

Joined: 24 Aug 2007
Posts: 12

FlaFlaw 25 Aug 2007, 16:16

Code:

; DialogBox example

format PE GUI 4.0
entry start

include '\fasm\include\win32ax.inc'

ID_OLDGUID                 = 101
ID_NEWGUID                     = 102
ID_VALIDATE                    = 103
ID_ICONERROR           = 201
ID_ICONINFORMATION     = 202
ID_ICONQUESTION                = 203
ID_ICONWARNING         = 204
ID_TOPMOST                     = 301

section '.data' data readable writeable

  address dq 0054E8C0h
  hwnd          dd ?
  procid        dd ?
  phandle       dd ?
  procname      db 'Windows Live Messenger',0
  appname    db 'by FlaFlaw',0
  noprocmsg      db 'Open your app, you dummy!',0
  buffer  rd 20h
  

section '.code' code readable executable

  start:
    invoke        FindWindow,0,addr procname
  cmp eax,0
   je processclosed
    mov [hwnd],eax
      invoke GetWindowThreadProcessId,[hwnd], addr procid
 invoke OpenProcess,PROCESS_ALL_ACCESS, 0, [procid]
  invoke ReadProcessMemory,[phandle],[address],buffer,20h,0
   mov [phandle],eax
   
    invoke  GetModuleHandle,0
   invoke  DialogBoxParam,eax,37,HWND_DESKTOP,DialogProc,0
     
  exit:
     invoke  ExitProcess,0
       
  processclosed:
    invoke  MessageBox,0,noprocmsg,appname,MB_OK
        jmp exit

proc DialogProc hwnddlg,msg,wparam,lparam
    cmp [msg],WM_INITDIALOG
     je wminitdialog
     cmp [msg],WM_COMMAND
     je wmcommand
     cmp [msg],WM_CLOSE
     je wmclose
  exit_dlg:
     xor eax,eax
     ret
 
  ; MAIN loop
  wminitdialog:
     jmp processed
  wmcommand:
     cmp [wparam],ID_VALIDATE
     je validate
      
     ; TODO
     jmp processed
  wmclose:
     invoke EndDialog,[hwnddlg],0
  processed:
     mov eax,1
  validate:
  finish:
     ret
endp

section '.idata' import data readable writeable

  library kernel,'KERNEL32.DLL',\
      ReadProcessMemory,'ReadProcessMemory',\
          user,'USER32.DLL'

  import kernel,\
      GetModuleHandle,'GetModuleHandleA',\
     OpenProcess,'OpenProcess',\
      ExitProcess,'ExitProcess'

  import user,\
         DialogBoxParam,'DialogBoxParamA',\
       FindWindow,'FindWindowA',\
       GetWindowThreadProcessId,'GetWindowThreadProcessId',\
    MessageBox,'MessageBoxA',\
       EndDialog,'EndDialog'

section '.rsrc' resource data readable

  directory RT_DIALOG,dialogs

  resource dialogs,\
     37,LANG_ENGLISH+SUBLANG_DEFAULT,demonstration

  dialog demonstration,'cGUID by FlaFlaw',10,10,200,76,WS_CAPTION+WS_POPUP+WS_SYSMENU+DS_MODALFRAME
    dialogitem 'STATIC',     '&Old GUID:',-1,10,15,40,10,WS_VISIBLE
    dialogitem 'EDIT',            '',ID_OLDGUID,53,13,138,12,WS_VISIBLE+WS_BORDER+WS_TABSTOP+WS_DISABLED
    dialogitem 'STATIC',  '&New GUID:',-1,10,33,40,10,WS_VISIBLE
    dialogitem 'EDIT',            '',ID_NEWGUID,53,33,138,12,WS_VISIBLE+WS_BORDER+WS_TABSTOP+ES_AUTOHSCROLL
 dialogitem 'BUTTON',  '&Validate',ID_VALIDATE,133,53,59,13,WS_VISIBLE+WS_TABSTOP+BS_DEFPUSHBUTTON
   dialogitem 'STATIC',  'Created by FlaFlaw',-1,57,56,71,9,WS_VISIBLE
  enddialog

25 Aug 2007, 16:16

Yardman

Joined: 12 Apr 2005
Posts: 244
Location: US

Yardman 25 Aug 2007, 18:49

[ Post removed by author. ]

Last edited by Yardman on 04 Apr 2012, 02:45; edited 1 time in total

25 Aug 2007, 18:49

FlaFlaw

Joined: 24 Aug 2007
Posts: 12

FlaFlaw 26 Aug 2007, 05:08

Thanks, it's working perfectly!!

26 Aug 2007, 05:08

FlaFlaw

Joined: 24 Aug 2007
Posts: 12

FlaFlaw 27 Aug 2007, 03:36

I'm trying to avoid the other to change the memory I'm trying to change. Is there a way to freeze it to my value other then by doing a loop? My actual loop don't seem to work when my other application is in full screen. Is there a way to make my program work even if the other program is full screen? Maybe a thread or something...

27 Aug 2007, 03:36

Kenneth

Joined: 16 Nov 2005
Posts: 38
Location: United States of America

Kenneth 27 Aug 2007, 06:01

Nop the instruction that keeps changing it.

27 Aug 2007, 06:01

FlaFlaw

Joined: 24 Aug 2007
Posts: 12

FlaFlaw 27 Aug 2007, 22:23

I don't want to patch the other program. There's many program in the wild (ArtMoney, Cheat Engine) allowing to modify the memory of other program and to freeze it so the other program can modify it. I want to do the same in my program....

27 Aug 2007, 22:23

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum