0

I am trying to dump a hasp dongle on a popular arcade machine. I can only get a portion with the game not running. If I ctrl alt del while game is already running I get a memory crash. What is the best way to proceed? Is there a way to get my dumper or even a cmd window forced to the front? Arcade game uses windows XP sp3.

  • can you boot from a cd/usb flash? – Igor Skochinsky Aug 28 '17 at 15:06
  • 1
    what about Ctrl-Shift-Esc? – Igor Skochinsky Aug 28 '17 at 15:07
  • I can boot from hirens boot cd and edit registry. I can even start programs from the registry, but they sit underneath. I need to enter my hasp key and change a drop down then click dump to get my dongles mem dump. (can terminate program while it counts down to start using task manager, but I need dump while its running. when it starts it fills screen) Is there a syntax perhaps to force dumper on top via registry? Ctrl-Shift-Esc is a no go as well. – roger Aug 28 '17 at 15:24
  • Anyone? If i can just get to my window I can do what I need to do. – roger Aug 28 '17 at 16:34
1

If you are able to run an application, this C# example will get you started. It will allow you to change the z-order of the application automatically, by calling SetWindowPos with HWND_BOTTOM as the parameter.

This will send the topmost window to the bottom of the z-order and you should be able to place new windows above it.

You need to identify the window handle of the topmost application (if you know the title of the application window, you can use FindWindow), or you can find the window handle by using EnumWindows and GetWindowModuleFileName

This will require you to be able to execute an application on startup. However since you said you are able to edit the registry you could put this executable on the system and set it to run at user logon, shortly after the launch of the application you are interested in.

  • I am not sure how I would run any of this to find the window name, is there a good program that can run in the background and catch the info, and send to a log file? – roger Aug 28 '17 at 18:00
  • Use EnumWindows and GetWindowModuleFileName to (1) retrieve every Window visible on screen, and then pass that window handle to GetWindowModuleFileName to get the path to its executable. Then compare it to the known path to the executable you are expecting. If you have a match, then you know you have the correct Window handle. Then you can pass it to SetWindowsPos with HWND_BOTTOM parameter. You'll have to modify the linked C# example (or write your own application) to accomplish this. – Mick Aug 28 '17 at 20:02
  • ok thx, I will download visual studio and give it a go – roger Aug 28 '17 at 23:11
  • I am thinking it will probably crash just like when I ctrl alt del and it looses the focus. Not sure what will prevent that. There is an entry in its registry ForegroundLock Timeout with a hex value of 30d40 might that be of any help? – roger Aug 28 '17 at 23:24
  • Yeah the window method did not work, it simply crashed the game again. I have no issue disabling the game. I was able to dump the dongle key by stoping the game. Problem is I am only getting a partial dump. The stuff thats in the memory that I need is comming up all zero's.. The particular dumper that is working for me is GUI only as far as I can tell. I looked for command line options but did not find any. That would be too easy lol. I will check out this Autoit. If its capable of selecting drop down menus, entering text fields (for keys) and hitting the dump button that would be nice – roger Aug 29 '17 at 1:38
1

This is more of a SuperUser question, but if you can boot from CD and edit the registry the following options come to mind:

  • boot into a WinPE environment, hopefully it will be enough to run the dumper

  • Find where the game is started and disable it; this should allow you to run the dumper unimpeded

  • figure out if the dumper has commandline options for automatic dumping and use them to dump without the UI

  • use something like AutoIt to manipulate Dumper's UI to perform its work.

  • Yeah the window method did not work, it simply crashed the game again with a memory address could not be written error. I have no issue disabling the game. I was able to dump the dongle key by stoping the game. Problem is I am only getting a partial dump. The stuff thats in the memory that I need is comming up all zero's... – roger Aug 29 '17 at 1:31
  • Also, I cannot install anything on the machine directly, It will simply delete it apon reboot, or will fail to install. I can put programs on via another computer, and run them through the registry. Any dumping I do has to be done via a flash drive, or it will not be there – roger Aug 29 '17 at 1:45
  • sounds like you need support from the dumper's author, I don't see how we can help here. It all seems to have very little to do with RE itself anyway. – Igor Skochinsky Aug 29 '17 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.