When clicking a GUI, there's underlying code somewhere getting executed. Is it possible to capture this "puppet-stringing" so that it can be manually called on demand (without clicking the GUI)?

For example:

In Internet Explorer's dev-console, there's a button for "Clear domain cookies", however it's only accessible with the dev console pulled up and via button-click.

Would it be possible to "catch" this underlying function getting called, and then call it on my own via programmatic puppet-stringing?


Theoretically, yes, you could do something like that. In normal windows Dialogs, you could get the onClick function of the button, and even if your program uses some other way of creating GUI elements (Java/Swing, QT, GTK, wxWidgets, Delphi, ....), you could find out what happens when the button is pressed by attaching a debugger, single-stepping, running in emulation mode, whatever.

Some of these methods could be well automated (finding the onClick function of the button, which means more or less checking what the window procedure does when sent a WM_COMMAND with a BN_CLICKED param, or a WM_LBUTTONDOWN message, or getting the list of ActionHandlers from a Java JButton), some need more manual investigation.

Then you could inject a DLL into the program that calls the function you found whenever "something happens", where "something happens" is how you communicate with the DLL to tell it to "call the cookie-cleaner".

However, there's a very big chance that you'll just crash the program, because a part of what the button does is probably tied closely to the state of the program, especially the GUI state. Maybe the handler function disables the button after you click it, and re-enables it after it's finished. Or the handler function shows some message in a box next to the button. If you just call the handler, without the GUI elements being there, your program will most likely crash.

So to do this, you'd have to disassemble the better part of the program, understand much of what it is doing, and separate the backend procedures (clear the cache) from the frontend (that handles the GUI); depending on how well the code is separated into backend and frontend, this may not even be possible. After identifying the backend part that you can call safely, you'd have to figure out how to find this part from your DLL (ASLR might put it at different addresses; localized versions of the software may have different addresses; and after your next automated windows update, the whole software layout might change), then create a DLL that will work for just this version of the software until the next update.

You'll probably have much better results with a software like AutoHotKey, which will allow you to create a macro that finds a button within the window hierarchy, and allows you to send a click event to the button. This will require you to have the GUI in a state that shows the button and allows clicking it, but making AutoHotKey (or a similar program) find the button will be much easier and less error-prone than finding out what to call and call that somehow.

Not the answer you're looking for? Browse other questions tagged or ask your own question.