2

I am trying to modify RadASM so that Ctrl+W will close the tab, instead of Ctrl+F4, and also make it so that if you middle mouse click the tab, it will close. The context menu for a tab is just a copy of the "Windows" menu bar item. The problem is, I can not figure out which library or even function is used to create menu bars and its items. I can not find any relevant strings in OllyDBG, and I've tried making breakpoints for just about every call I thought it might be, but I can't get anything.

Can anybody point me in the right direction? I couldn't locate the function in RadASM for determining which hotkeys/shortcuts do what either.

I know all about code caves and injecting DLLs, so adding a function like the middle mouse click shouldn't be impossible; I just need to know where to start since I'm quite new to reverse engineering.

Improve this question

2 Answers 2

Reset to default
3

To change Ctrl+F4 to Ctrl+W you can use a resource editor such as Resource Hacker.

Open RadASM.exe in the resource editor, modify the accelerators, and save your changes.

Assuming you're using Resource Hacker, you'd change

VK_F4, 47001, NOINVERT, CONTROL, VIRTKEY

to

VK_W, 47001, NOINVERT, CONTROL, VIRTKEY

Then press the Compile Script button, and save the changed file.

Resource Hacker

As for handling a middle-click on the tab, I used Spy++ to find the Window Procedure for the tab window. For RadASM 2.2.1.6 it's at virtual address 004061D4:

Spy++

The function at that address is the DialogProc callback function for the SysTabControl32 window. You can patch that function in RadASM.exe to monitor for and act on the uMsg value WM_MBUTTONDOWN.

Improve this answer
4
  • Thanks! I also edited the Menu in Resource Hacker so it shows the correct hotkey. Do you have any idea about adding the feature of middle mouse clicking to close the tab?
    – Sean Heiss
    Jul 13, 2013 at 23:47
  • I updated my answer above with how to handle the middle mouse click.
    – Jason Geffner
    Jul 14, 2013 at 0:15
  • I've begun writing my code cave, but I can't figure out what to do if uMsg == WM_MBUTTONDOWN. I cannot figure out what closes a tab. Do you have any idea what function does that, or any idea how I could find it?
    – Sean Heiss
    Jul 14, 2013 at 5:50
  • Internally, RadASM sends TCM_HITTEST to the SysTabControl32 window to determine the tab that was clicked, sends TCM_SETCURSEL, TCM_GETITEM, and WM_MDIACTIVATE to make that tab active in the MDI, and then sends WM_CLOSE to the now-active MDI window. You need to replicate that.
    – Jason Geffner
    Jul 14, 2013 at 19:01
3 
ollydbg radasm.exe
view windows (W Icon)
sort class
and look for Mdi class like mdiEditChild / dialog etc

example

Windows, item 96
 Handle=000704EE
 Title=C:\testrad\Html\Projects\testrad\testradinc3.html
 Parent=000203E4
 ID=0000FDEA (65002.)
 Style=56CF0001 WS_CHILD|WS_GROUP|WS_TABSTOP|WS_CLIPSIBLINGS|WS_CLIPCHILDREN|WS_VISIBLE|WS_SYSMENU|WS_THICKFRAME|WS_CAPTION|1
 ExtStyle=00000340 WS_EX_MDICHILD|WS_EX_WINDOWEDGE|WS_EX_CLIENTEDGE
 Thread=Main
 ClsProc=00xxxxxx RadASM.00xxxxxx
 Class=MdiEditChild

right click message breakpoint on class proc

in the dialog

choose window creation and destruction
never pause radio button
log winproc args always

you should be able to capture the WM_CLOSE sent by ctrl+f4

Log data
Address    Message
00XXXXXX   CALL to Assumed WinProc from USER32.7E418731
             hWnd = 000704EE ('C:\testrad\Html\Projects\test...',class='MdiEditChild',parent=000203E4)
             Message = WM_CLOSE
             wParam = 0
             lParam = 0

The patch below should pop up a Messagebox when you hit Middle Mouse Button on the SysTabControl

004071A7             |> \90            NOP                                      ;  Default case of switch 004070B6
004071A8             |.  90            NOP
004071A9             |.  90            NOP
004071AA             |.  E8 5D1F0400   CALL    RadASMWM.0044910C

00449100 <STRING>                 .  57 4D 5F 4D 42 5>ASCII   "WM_MB_CLICK",0
0044910C <WM_MB_CLICK_HANDLER>   /$  60               PUSHAD                                   ;  CALL FROM 4071AA
0044910D                         |.  9C               PUSHFD
0044910E                         |.  3D 07020000      CMP     EAX, 207                         ;  WM_MB
00449113                         |.  75 13            JNZ     SHORT <RadASMWM.RETTOORIGHANDLER>
00449115                         |.  6A 00            PUSH    0                                ; /Style = MB_OK|MB_APPLMODAL
00449117                         |.  68 00914400      PUSH    <RadASMWM.STRING>                ; |Title = "WM_MB_CLICK"
0044911C                         |.  68 00914400      PUSH    <RadASMWM.STRING>                ; |Text = "WM_MB_CLICK"
00449121                         |.  6A 00            PUSH    0                                ; |hOwner = NULL
00449123                         |.  E8 A2FBFFFF      CALL    <JMP.&user32.MessageBoxA>        ; \MessageBoxA
00449128 <RETTOORIGHANDLER>      |>  9D               POPFD
00449129                         |.  61               POPAD
0044912A                         |.  8B45 08          MOV     EAX, DWORD PTR SS:[EBP+8]        ;  RadASMWM.<ModuleEntryPoint>
0044912D                         |.  E8 F7B8FBFF      CALL    <RadASMWM.ORIGINAL HANDLER>
00449132                         \.  C3               RETN
Improve this answer
1
  • Thanks! I should be able to figure this out with the help from you and Jason Geffner.
    – Sean Heiss
    Jul 14, 2013 at 20:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.