3

I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore GetWindowText() doesn't help. I need to read the data from memory somehow.

I've looked into it with CheatEngine and found the strings I was looking for in several places. However, it seems that their location changes from time to time, because the value at the addresses changed, for example when new text was entered in the chat.

Unfortunately I'm no expert on this subject. My naive assumption would be, that the strings are contained in some vector-like data structure (and the changing values at the addresses could be caused by reallocation?), but I'm not sure about that ofcourse. I have written a basic MemoryScanner thats able to find some integer values (and I'm sure I could extend it to find strings as well), but how do I proceed from here, if I neither know the address of the chat messages nor the exact layout of the underlying data structure?

I'm grateful for any suggestions!

EDIT: I have started to analyze the program with IDA Pro. I have found several strings (in the .rdata section), that are regularly used in the chat, even 'printf'-like with name replacements. I have set breakpoints on these strings, as well as the functions that call these strings. However, they don't get triggered when chat messages are entered.

Is there something I need to know about the .rdata segment? Does it get loaded on program startup for example? If so, how would I proceed from here?

Improve this question
4
  • Well the long way is to disassemble the application binary so you can look at the data structure yourself. Right now, you don't really have enough information to refine your memory scanner so that's the only way I can think of.
    – Patrick Roberts
    Commented Jun 22, 2016 at 12:30
  • Thanks, do you have any good links/tutorials on how to do that? I have only found this so far, but haven't started to work on it, yet.
    – Johannes Stricker
    Commented Jun 22, 2016 at 14:57
  • There are plenty of resources available on this site alone. If you want a tool, there is IDA, which has a tag ida here you can ask questions about.
    – Patrick Roberts
    Commented Jun 22, 2016 at 17:53
  • Thanks. I have started to get familiar with IDA PRO. I've edited the initial question with my current progress. I'd appreciate a hint in the right direction ;)
    – Johannes Stricker
    Commented Jun 24, 2016 at 11:21

1 Answer 1

Reset to default
1

There is also out of the box solution for this possible I developed to acquire IR image feed from special industry camera available only as a preview in the camera software. I needed the feed in my own application to regulate some heat process in Real-Time. I come up with this:

  1. Obtain target window Windows handler

    Each visual component in Windows App has its own Handler and some are handled as windows as well. So:

    1. list all the Apps running in your system
    2. detect which one is your chat
    3. list all of its child handles/subwindows
    4. detect the right chat subwindow/subcomponent

    for more info and C++ source how to do it see:

  2. obtain its Canvas image

  3. OCR it

    Chats has usually pixel perfect single font so it should be easy and not too slow if done right so RealTime should be possible. You can use direct pixel comparison or something more advanced but still simple like:

    Or use any OCR lib out there alike Tesseract ...

  4. do your stuff with the text ...

Improve this answer
4
  • Thanks for the idea. I've tried to do this with OCR using opencv and tesseract. My results were quite good, without too much optimization, however the OCR took around 3seconds every time, which is just way too slow. I would at least need something around ~500ms.
    – Johannes Stricker
    Commented Jun 29, 2016 at 10:49
  • @JohannesStricker that should be doable in few [ms] have you some screen shots? I do not use any of the libs I am more used to code it myself in C++. As this is pixel perfect the Tesseract and OpenCV is overkill. I like to try it. I need screen-shot of the full alphabet and or ASCII used and then one or more shots of some messages so I can test the speed... although it would take me a bit of time to code it but have it in my wish-list for some time so its good reason/time as any anyway Last time I did OCR for commercial purposes the OpenCV/Tesseract was too slow against that OCR I linked
    – Spektre
    Commented Jun 29, 2016 at 11:11
  • Okay, so what you would try to do is just grab the character pattern and do the OCR yourself? That might be possible and I would maybe use it as a last resort, if I am unable to retrieve the messages from memory. Thanks for the input!
    – Johannes Stricker
    Commented Jun 29, 2016 at 11:29
  • @JohannesStricker Yep that was exactly what I was thinking
    – Spektre
    Commented Jun 29, 2016 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.