GUI represention in assembly level and another question

Question

In advance, I'd say I'm learning reverse engineering newly. Indeed, there are some questions to be asked.

First of all I would ask : In assembly level of the applications which use GUI ,how things like forms,buttons,etc are represented ? For example, when we can find out a button is clicked and things like that ? In all languages which support GUI they use same API for buttons or forms or ... ?

And there's an another question in the other side of reversing(from Export tables addresses): Consider the example of a program which has two export address (for example start and a debug checker) which they're declared as public in the disassembled approach, so how we can figure out which one would be executed at first ?

Thanks all.

Answer 1

welcome to the Reverse Engineering SE!

Unfortunately, your question isn't written very well. You shouldn't try to put two different questions into one, because that makes it more difficult to give a good answer.

Also, both parts of your question should probably go better to stackoverflow, as both of them are more about software development than about reverse engineering.

As a rule of thumb, you can't reverse anything that you can't build.

You should get acquainted with various GUI frameworks - plain Windows, MFC, .net, delphi. java swing, gtk, qt, wxwidgets) to find out how they work, which differences there are, and which things they have in common. Then, you'll probably be able to identify which framework a program you're trying to reverse uses, and you'll be able to identify the patterns how they are used. But unless you've written a few programs in at least some of them, you wouldn't even understand other programs if you had their source code, much less if you have the binaries. So get some experience there first.

Also, import and export addresses aren't about where the program starts; they're about putting .dll libraries and the program together before it's being executed. You should learn about dynamic linking and creating DLLs before trying to reverse them. The program entry point is defined in the headers of the program, and it doesn't have anything to do with exports and imports.