0

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part :

it does break on exitprocess, but before that the actual executable gets removed from explorer's taskbar and from the bottom right side in the taskbar (which shows small program icons next to clock) but the actual process is still in the task manager

so how is it exiting that the actual process is not terminated but the taskbar icons (both the main icon and the small one next to clock) get terminated? i want to break on that one before the exit process, because trying to trace back from the exit process one leads me to entrypoint (_start)! (tried tracing back from it with the stack return addresses)

Improve this question
1
  • Found one : EndDialog, is there anything else?
    – Mery Ted
    Oct 16 '19 at 20:21
0

the process may run a long after the icons vanish from taskbar tearing down
try closing a browser like firefox its icon will vanish long before one of the many instances of firefox gets out of task manager.

you may need to look for WM_DESTROY WM_GETICON , WM_SHOWWINDOW messages

use some spy utility like spy++ and corelate it with procmon

below is a log of spy++ closing firefox (WM_MOUSE and WM_NONCLIENT WM_NCXX.. excluded) and clicked the x button on right corner 

<000001> 003401E6 S WM_WINDOWPOSCHANGING lpwp:0031F198
<000002> 003401E6 R WM_WINDOWPOSCHANGING
<000003> 003401E6 S WM_ERASEBKGND hdc:5E010B3E
<000004> 003401E6 R WM_ERASEBKGND fErased:True
<000005> 003401E6 S WM_WINDOWPOSCHANGED lpwp:0031F198
<000006> 003401E6 R WM_WINDOWPOSCHANGED
<000007> 003401E6 S WM_ACTIVATEAPP fActive:True dwThreadID:00000000
<000008> 003401E6 R WM_ACTIVATEAPP
<000009> 003401E6 S WM_ACTIVATE fActive:WA_CLICKACTIVE fMinimized:False hwndPrevious:(null)
<000010> 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F
<000011> 003401E6 S WM_IME_NOTIFY dwCommand:IMN_OPENSTATUSWINDOW dwCommand:00000002 dwData:00000000
<000012> 003401E6 R WM_IME_NOTIFY
<000013> 003401E6 R WM_IME_SETCONTEXT
<000014> 003401E6 S WM_SETFOCUS hwndLoseFocus:(null)
<000015> 003401E6 S WM_WINDOWPOSCHANGING lpwp:0031E8F4
<000016> 003401E6 R WM_WINDOWPOSCHANGING
<000017> 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F
<000018> 003401E6 R WM_IME_SETCONTEXT
<000019> 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F
<000020> 003401E6 R WM_IME_SETCONTEXT
<000021> 003401E6 R WM_SETFOCUS
<000022> 003401E6 R WM_ACTIVATE
<000023> 003401E6 S WM_PAINT hdc:00000000
<000024> 003401E6 R WM_PAINT
<000025> 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F
<000026> 003401E6 R WM_IME_SETCONTEXT
<000027> 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F
<000028> 003401E6 R WM_IME_SETCONTEXT
<000029> 003401E6 S WM_GETICON nType:ICON_SMALL2
<000030> 003401E6 R WM_GETICON hicon:00000000
<000031> 003401E6 S WM_GETICON nType:ICON_SMALL
<000032> 003401E6 R WM_GETICON hicon:00000000
<000033> 003401E6 S WM_GETICON nType:ICON_BIG
<000034> 003401E6 R WM_GETICON hicon:00000000
<000035> 003401E6 S WM_CAPTURECHANGED hwndNewCapture:00000000
<000036> 003401E6 R WM_CAPTURECHANGED
<000037> 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F
<000038> 003401E6 R WM_IME_SETCONTEXT
<000039> 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F
<000040> 003401E6 R WM_IME_SETCONTEXT
<000041> 003401E6 S WM_CAPTURECHANGED hwndNewCapture:00000000
<000042> 003401E6 R WM_CAPTURECHANGED
<000043> 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F
<000044> 003401E6 R WM_IME_SETCONTEXT
<000045> 003401E6 S WM_IME_SETCONTEXT fSet:1 iShow:C000000F
<000046> 003401E6 R WM_IME_SETCONTEXT
<000047> 003401E6 S WM_SHOWWINDOW fShow:False fuStatus:0 (ShowWindow was called)
<000048> 003401E6 R WM_SHOWWINDOW
<000049> 003401E6 S WM_WINDOWPOSCHANGING lpwp:0031F1B4
<000050> 003401E6 R WM_WINDOWPOSCHANGING
<000051> 003401E6 S WM_WINDOWPOSCHANGED lpwp:0031F1B4
<000052> 003401E6 R WM_WINDOWPOSCHANGED
<000053> 003401E6 S WM_SIZE fwSizeType:SIZE_MAXIMIZED nWidth:1280 nHeight:778
<000054> 003401E6 R WM_SIZE
<000055> 003401E6 S WM_MOVE xPos:0 yPos:65528
<000056> 003401E6 R WM_MOVE
<000057> 003401E6 S WM_ACTIVATE fActive:WA_INACTIVE fMinimized:False hwndPrevious:(null)
<000058> 003401E6 R WM_ACTIVATE
<000059> 003401E6 S WM_ACTIVATEAPP fActive:False dwThreadID:00000420
<000060> 003401E6 R WM_ACTIVATEAPP
<000061> 003401E6 S WM_KILLFOCUS hwndGetFocus:(null)
<000062> 003401E6 R WM_KILLFOCUS
<000063> 003401E6 S WM_IME_SETCONTEXT fSet:0 iShow:C000000F
<000064> 003401E6 S WM_IME_NOTIFY dwCommand:IMN_CLOSESTATUSWINDOW dwCommand:00000001 dwData:00000000
<000065> 003401E6 R WM_IME_NOTIFY
<000066> 003401E6 R WM_IME_SETCONTEXT
<000067> 003401E6 S message:0x0090 [Unknown] wParam:00000000 lParam:00000000
<000068> 003401E6 R message:0x0090 [Unknown] lResult:00000000
<000069> 003401E6 S WM_DESTROY
<000070> 003401E6 R WM_DESTROY
Improve this answer
2
  • I found the API that was closing the icons : EndDialog, just wondering if there is anything else that i should look after in future? also is it normal that EndDialog causes closing of icons?
    – Mery Ted
    Oct 17 '19 at 5:29
  • the rabbit hole is much deeper this api is just the entrance to the burrow
    – blabb
    Oct 17 '19 at 10:44
0

There is no single specific API for this. IIRC the taskbar button corresponds to the main window of the process so likely it’s removed once the window is destroyed (but the process may continue running until it exits).

The code you’re looking for will likely be either in the main window procedure (e.g. handling of WM_CLOSE or WM_QUIT), or after the end of the main message loop.

Improve this answer
1
  • But i found one : EndDialog, just wondering if there is something else as well ( the app icons close after the EndDialog call, not sure how they wrote the app to work like this)
    – Mery Ted
    Oct 17 '19 at 5:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.