False positives with conditional breakpoint in OllyDBG

Question

I'm trying to remove a nag screen. Its window style is 16C80000, which should translate to WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU. So, in the call to CreateWindowExW() I set a conditional breakpoint at PUSH EAX, which determines the style.
The conditions I tried were [EAX] == 16C80000 and [EAX] == WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU. Both give the same results.
What happens is that the conditional breakpoint pretty much acts as a normal breakpoint I think. I get breakpoints at Style = WS_POPUP, and many other styles which I didn't specify. What I'd like is to find out what I'm doing wrong so that I can find the call to that goddamn nag :)

Answer 1

if you are setting a breakpoint on the specific address 0x412d18 you must make sure that the specific address will be hit ( setting a breakpoint on a specific address and expecting it to break on CreateWindowCalls is not going to work )

to set a common breakpoint to catch all CreateWindow Calls you should set a breakpoint on system dll (user32.dll)

you should use a stack expression for the conditional break [esp+XXX] == 0x16xxxxxx

here is a sample on winxpsp3 mspaint.exe

Breakpoints
Address    Module     Active                           Disassembly        Comment
7E42D0A3   USER32     Log when [esp+10] == 44008200    MOV     EDI, EDI

the bp is set on

7E42D0A3 USER32.CreateWindowExW [esp+10] == 44008200 /$ 8BFF MOV EDI, EDI

never pause
break on condition
log always
condition [esp+10] = xxxxxxxx
expression [esp+10]

result as follows

Log data
Message

COND: style = = 88000000

COND: style = = 02CFC000
COND: style = = 52000000
COND: style = = 54000000
COND: style = = 5400014E
COND: style = = 56002800
COND: style = = 56008200
COND: style = = 56001400
COND: style = = 56004100
COND: style = = 44001430
COND: style = = 44008200  <------- broken and function args logged for my specific condition
CALL to CreateWindowExW from MFC42u.5F811CB2
  ExtStyle = 0
  Class = "AfxWnd42u"
  WindowName = "Colors"
  Style = WS_CHILD|WS_CLIPSIBLINGS|8200  <------------
  X = FFFFFEFD (-259.)
  Y = FFFFFFCD (-51.)
  Width = 103 (259.)
  Height = 33 (51.)
  hParent = 00080226 ('Paint',class='MSPaintApp')
  hMenu = 0000E818
  hInst = 01000000
  lParam = NULL