1

I'm trying to remove a nag screen. Its window style is 16C80000, which should translate to WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU. So, in the call to CreateWindowExW() I set a conditional breakpoint at PUSH EAX, which determines the style.
The conditions I tried were [EAX] == 16C80000 and [EAX] == WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU. Both give the same results.
What happens is that the conditional breakpoint pretty much acts as a normal breakpoint I think. I get breakpoints at Style = WS_POPUP, and many other styles which I didn't specify. What I'd like is to find out what I'm doing wrong so that I can find the call to that goddamn nag :)
Screenshot

Improve this question

1 Answer 1

Reset to default
2

if you are setting a breakpoint on the specific address 0x412d18 you must make sure that the specific address will be hit ( setting a breakpoint on a specific address and expecting it to break on CreateWindowCalls is not going to work )

to set a common breakpoint to catch all CreateWindow Calls you should set a breakpoint on system dll (user32.dll)

you should use a stack expression for the conditional break [esp+XXX] == 0x16xxxxxx

here is a sample on winxpsp3 mspaint.exe 

Breakpoints
Address    Module     Active                           Disassembly        Comment
7E42D0A3   USER32     Log when [esp+10] == 44008200    MOV     EDI, EDI

the bp is set on 

7E42D0A3 USER32.CreateWindowExW [esp+10] == 44008200 /$ 8BFF MOV EDI, EDI

never pause
break on condition
log always
condition [esp+10] = xxxxxxxx
expression [esp+10]

enter image description here

result as follows

Log data
Message

COND: style = = 88000000

COND: style = = 02CFC000
COND: style = = 52000000
COND: style = = 54000000
COND: style = = 5400014E
COND: style = = 56002800
COND: style = = 56008200
COND: style = = 56001400
COND: style = = 56004100
COND: style = = 44001430
COND: style = = 44008200  <------- broken and function args logged for my specific condition
CALL to CreateWindowExW from MFC42u.5F811CB2
  ExtStyle = 0
  Class = "AfxWnd42u"
  WindowName = "Colors"
  Style = WS_CHILD|WS_CLIPSIBLINGS|8200  <------------
  X = FFFFFEFD (-259.)
  Y = FFFFFFCD (-51.)
  Width = 103 (259.)
  Height = 33 (51.)
  hParent = 00080226 ('Paint',class='MSPaintApp')
  hMenu = 0000E818
  hInst = 01000000
  lParam = NULL
Improve this answer
3
  • Thanks. I'll try it out, I think this might work. I still don't quite understand why it's giving false positives though? In the screenshot you can see that I've set a conditional breakpoint at PUSH EAX. It made a breakpoint when EAX was 80000000, even though the condition was equal to [EAX] == 16C80000. Why?
    – Nopslide__
    Jun 2, 2015 at 14:50
  • your screenshot does not convey your breakpoint semantics if there is an error parsing or evaluating ollydbg will pause and an error maybe logged in log window though it may appear to be paused due to break or appear to be flase positive suppose eax == 0 then parsing [eax] will lead to unreadable memory error and ollydbg may pause [8000000] may be inaccessible kernel pointer i cant say for sure what is happening from the information and screenshot you provided
    – blabb
    Jun 2, 2015 at 18:35
  • What additional data do I need to provide for you to answer my question? :)
    – Nopslide__
    Jun 2, 2015 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.