2

I would like to remove a nag screen from a popular program. To do this I need to make sure the screen never gets called. So, the first task is to find the actual location of the nag (where it is called from). None of the strings in the nag screen seemed to show up in Ollydbg's string search. The only thing I managed to find on my own was the window of the nag in OllyDBG's window references, but I'm not sure if it was very useful.

What methods are commonly used to find the call locations of nag screens? If you guys set me on the right path, I'm sure I can figure out the rest on my own. :)

Some extra info: the program seems to have been developed in .Net, the title of the nag showed up in the window reference list of OllyDBG but I couldn't find it in the string search.

Second edit: I don't think it's .net. I tried doing ´tasklist /m "mscor*"´, but it didn't show up (which it probably should have, if it's .net)

Improve this question
2
  • 1
    Finding the window in Olly's references is still helpful; get the windows' WindowProc address, then search for this address in the code. Of course, .NET adds a layer around all that; if you're really dealing with .NET code, one of the many .NET decompilers will probably help you more than Olly does.
    – Guntram Blohm
    May 27, 2015 at 22:03
  • Agreed, trying to debug a .NET application using Olly may be an overkill. Try Telerik JustDisassemble or DotPeek.
    – Carlos Garcia
    May 28, 2015 at 17:29

1 Answer 1

Reset to default
5

EDIT: The OP updated his question yesterday to say that he's dealing with a .NET application, so the advice below no longer applies. I'll leave this answer here though since it might help others for Win32 applications.

Try setting breakpoints on API functions that might be used to create the nag screen.

For example, (from http://www.woodmann.com/krobar/beginner/p03_8.html):

  • CreateWindow()
  • CreateWindowEx()
  • ShowWindow()
  • UpdateWindow()
  • etc.
Improve this answer
4
  • 1
    I tried doing a conditional breakpoint on CreateWindowEx() UNICODE[EPB+10] == "Title of the nag" It gave me some false positives (when [EPB+10] wasn't even close to the string I provided) and didn't give the right result. I don't think there were CreateWindow() functions. Did I do the right thing in the wrong place (in the CreateWindowEx() function) or did I do the wrong thing at the right place?
    – Nopslide__
    May 28, 2015 at 14:30
  • OllyDbg's conditional breakpoints are buggy when it comes to strings, and I wouldn't rely on the value in the lpWindowName field either. However, for each call to CreateWindowEx(), you can compare the values in dwExStyle, lpClassName to what you know the nag screen uses (based on a tool like woodmann.com/collaborative/tools/index.php/Window_Hack).
    – Jason Geffner
    May 28, 2015 at 14:40
  • The tool you provided me says the dwStyle is 16C80000. Doing a conditional breakpoint for [EAX] == 16C80000 gives a lot of results, and all of them don't even have the same style names, which confuses me (there are WS_CHILD, WS_OVERLAP, POPUP, etc). Is there anything else I can do to narrow the search down? Also, I managed to find the ShowWindow() that shows the popup. NOPing that didn't do anything (which confuses me, the window shouldn't have showed up. It didn't even crash), but maybe it's a help?
    – Nopslide__
    May 30, 2015 at 20:53
  • 16C80000 is WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU, so if you're seeing flags like WS_OVERLAP, it suggests that your conditional breakpoint is set incorrectly. Please pose that issue as a new question on this site, separate from this one.
    – Jason Geffner
    May 30, 2015 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.