I'm writing an Autohotkey script to toggle Listen to this device
for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to find the key:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\{My-Microphone's-UUID}\Properties
The key is called {24dbb0fc-9311-4b3d-9cf0-18ff155639d4},1
(On all computers).
And the value when toggling the Listen to this device
changes like this: (The 0's change to f's)
xxxxxxxxxxxxxxxx0000xxxx
xxxxxxxxxxxxxxxxffffxxxx
But when I check the GUI, I see that the Listen to this device
tick-box has been ticked but I can't actually hear anything from my mic, when I un-tick it, click apply, re-tick it and apply again, I hear my mic. So I thought I might need DllCall or PostMessage here, like what message was sent or what dll was called when I click apply
but I couldn't find anything on it on the Internet. I don't know how to make Windows understand that this setting has changed.
Please teach me how to reverse engineer this with x64dbg.
24dbb0fc-9311-4b3d-9cf0-18ff155639d4
I am getting some interesting results pointing to theMMDevice API
. See for example here.Spy++
for that to get PID from the HWND you showed.) I'd guess that it'd be one of rundll32 procs. 2. Then use a debugger (x64Dbg
would work) and set a breakpoint onntdll.ZwSetValueKey
in that proc (before that UI is shown). You may want to make a conditional bp to catch when your registry value is written. It will be in a 2nd parameter asUNICODE_STRING*
. 3. Run the proc until bp triggers. 4. After then just walk thru the code with your debugger and see what they are doing there. No guesswork needed.RegSetValue
then doubleclick the entry and inspect the callstack which might be easier than using a debugger...GetSystemMetrics
/SystemParametersInfo
/WM_SETTINGSCHANGE
, but it turns out those are not used for what you want/need. What I am wondering is whether you are actually interested in achieving that functionality or whether it's important to you how to reverse engineer such stuff?! Given we're on RE.SE I'd assume it's the latter, but I'd like to know as I think that in this case it might be possible to substitute reverse engineering with knowledge about Win32 programming. It would be normal, at least, for that configuration change to be broadcast somehow.