Changing a windows name by patching create window function call

Question

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup process of the application failing for some reason because it can't find the window.

Basically what I'm trying to do is change the window title of some application on startup. I'm trying to achieve this by setting a break point on the user32 function CreateWindowExA and then attempting to change the lpWindowName parameter.

Here is what execution looks like when the bp is hit:

Where you see the string "Title possibly" originally contained what was the windows title, so I assume that's the location I need to change. When changing at that address is when I get the error though.

Sorry for any ignorance, I'm new to this and practicing. Thanks.

Edit: I worked on this a little more and made a dummy program to help me figure out what was happening. So the CreateWindowExA function in this application used the same pointer for both lpClassName and lpWindowName args. So patching the program to push just a string instead of that pointer successfully achieved what I was aiming for.

Answer 1

Tip: Install xAnalyzer for x64dbg, that might help you in your reversing efforts.

Now, you are in the user32.dll function CreateWindowExA. I would not change that parameter there, but outside in user code (familiarize yourself with the stdcall convention, its what WinApi uses). The parameter you are shooting for is three pushes above the call CreateWindowExA in user code. Either change the pointer or the content under it and don't forget to null-terminate.

Answer 2

Hook it, then set the parameter lpWindowName to "your name here" (no promises this will work) OR breakpoint on mov edx, dword ptr ss:[EBP+C], then grab EBP from the FPU (registers box), go in to a program like ReClass and set the EBP+0xC (window name) to whatever name you want (90% sure this will work). References: https://stackoverflow.com/questions/873658/how-can-i-hook-windows-functions-in-c-c https://www.youtube.com/watch?v=K_jj6yF5ac0

Answer 3

Thanks for the responses guys. I managed to achieve my goal which is detailed in the OP edit:

The CreateWindowExA function in this application used the same pointer for both lpClassName and lpWindowName args. So patching the program to push just a string instead of that pointer for lpWindowName successfully achieved what I was aiming for. I believe changing the lpClassName was causing the crash I described in the OP.