1

I am trying to disable a button of a game client.

I have checked the answer of this question about how to set a breakpoint for a button message.

But, after clicking the button, it breaks on a specific line but when I set a break point on this line client stop and keep returning to the line if I try to start client again.

So, my questions are:

  1. How can I find the calls or lines which uses the line that broke with me recently?
  2. am I going on the right way to find the button lines and disable it ?

1 Answer 1

1

You probably found the correct line - the start of the dialog function that gets called whenever something happens with the dialog.

The problem is, this function gets called a lot of times; especially, when Windows wants the dialog shown, it sends a WM_PAINT message to the dialog. This calls the dialog function as well, so whenever you tell Ollydbg to continue, and alt-tab to your game client, windows redraws the dialog, which calls your function, which triggers your breakpoint.

What you want to do is disassemble and understand the complete function. The function should check the message for WM_COMMAND (0x111), then check the wParam parameter for the ID of your button. Find the assembly lines that are executed in this specific case. Then, you can start changing stuff - for example, if these lines call some function, replace the function calls with NOP to prevent the button from doing what it's supposed to do.

6
  • sorry but i'm newbie with assembly, so how i can dissemble the function ,, also is wParam exists on ollydbg ? note: the button doesn't send any packets or op codes to the server it just pop up new window on the client. it will be great if u give me some tips about this questions!
    – Muhab
    Jun 10, 2014 at 14:02
  • if you are not sure what disassembling means what wparam means etc and say buttons send opcodes to server then you are not ripe for reverse engineering get a spy utility like winspy or spy++ hover the utility over the button and change the buttons style to WS_DISABLED
    – blabb
    Jun 10, 2014 at 17:39
  • I agree with blabb. If you want to do any reverse engineering, you need to a) be able to read assembler easily, b) know about the specifics of your processor, and c) know about stack usage and procedure calling conventions of the mostly-used compilers. Right now, it's like a student pilot asking how to fly loopings on his first day. Jun 10, 2014 at 18:55
  • i agree with that too but i'm trying to manage 3~5 coding language to be able to lunch a game server , so my goal is not to become a pro assembler i'm just trying to find out how to trace and find lines on ollydbg so i can edit it. i have found wParam pic with spy++ and got the lines already which called when any command sent WM_COMMAND or WM_PAINT whatever, but still can't achieve how to disassemble the function and is this lines are the function or i have to trace it?,it will be grateful if u guys give me some tips about disassembling. and thanks for your help.
    – Muhab
    Jun 10, 2014 at 20:33
  • @blabb also there is no way to change styles i have checked it ,it's not able to be changed or maybe i'm going wrong !
    – Muhab
    Jun 10, 2014 at 20:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.