I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find the principle behind those calculations I need to know which function is responsible for reading the values which the user enters into the text box, then I think I can trace it further.

What's important seems like this executable uses something like textbox.text.change event because it changes the value in output text box every time we change the value in the input text box.

The .exe file

  • Hi and welcome to RE.SE. Going by the description I'll assume you are talking about Windows. On Windows - assuming it's a standard Win32 windowed application - window messages are usually what both causes notifications to be sent to windows/controls and what is used to manipulate the content or style of windows/controls. You may want to check out Spy++ (which comes with Visual Studio) or the alternative open source WinSpy tool (which lacks the capturing of window messages, however). These will allow you to gain insight into what you're dealing with.
    – 0xC0000022L
    Aug 14, 2019 at 20:56
  • 1
    A cursory look suggests it's a standard windowed Win32 application and uses SendMessage, GetWindowTextA and friends to do its job. Having only spent like three minutes or so on the file, I'd suggest looking at 00401710 as it looks suspiciously like what you're after (i.e. the "principle"). The function receives the text retrieved from (some!) window and mangles it to come up with some result. It looks like it's working in tandem with the function at 00401000.
    – 0xC0000022L
    Aug 14, 2019 at 21:09


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.