1

Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.

Right now there's one button remaining labeled "Encrypt", which is greyed out. Based on the context, it would seem as though this button is responsible not for encrypting communication, but rather for packing the output of the program, using another program. I would like to confirm this directly though.

My issue is that I don't know how to locate the code that this button would trigger on the backend, or how to find what makes it available or unavailable in the GUI. Where can I find the logic responsible for determining what is available in the GUI, and where can I find what buttons are connected to which functionality using static analysis?

Edit: I've since run through the loading of the GUI using process monitor and I wasn't able to find any meaningful file query missing, which might shoot down the idea that the "encrypt" button is responsible for packing the payloads.

Improve this question
1
  • If you don't want to write your own program just to issue EnableWindow you can use an obscure old tool called eda_preview270. Provided these are actual windows (a Chrome app usually has one window and does the drawing by itself) you should be able to point to the button and enable it by toggling the respective checkbox.
    – 0xC0000022L ♦
    Apr 22, 2020 at 9:21

2 Answers 2

Reset to default
1

The button is greyed out, or "disabled". This is most likely done by one of two ways:

  1. Creating the button as initially disabled, by passing the WS_DISABLED flag as dwStyle parameter to CreateWindow/CreateWindowEx API.

You can set a breakpoint on this function and reset the dwStyle param. Zero will do.

  1. Disabling the button by calling the EnableWindow API with bEnable = FALSE.

You can set a breakpoint on this function and set bEnable to TRUE (non-zero)

This will make the button enabled so you can click on it. It does not guarantee that it will be functional.

Improve this answer
0

A few things you could do is go through the strings and see what kind of program it could possibly be loading inside of the software you are reversing. This could give some leads as to if your hypothesis is true.

Another thing you can do is see if it's a module being loaded. Breakpoint on entry when you run the software in a live debugger and see what DLL's and other modules are being loaded into the program. This could also deliver some leads.

You mentioned that it's greyed out so I'm not certain if you are able to press the button or not, but if you can, try pressing it and then stepping through the program. Perhaps the code was setup in a way that it won't load the module unless the button gets pressed. Then see what changes occur inside of the program with the button being pressed, and without the button being pressed. This could also give some possible leads on if your idea is true or not.

Good luck.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.