I'm trying to remove a nag screen. Its window style is 16C80000, which should translate to WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU
. So, in the call to CreateWindowExW() I set a conditional breakpoint at PUSH EAX
, which determines the style.
The conditions I tried were [EAX] == 16C80000
and [EAX] == WS_VISIBLE | WS_CLIPCHILDREN | WS_CLIPSIBLINGS | WS_CAPTION | WS_SYSMENU
. Both give the same results.
What happens is that the conditional breakpoint pretty much acts as a normal breakpoint I think. I get breakpoints at Style = WS_POPUP
, and many other styles which I didn't specify. What I'd like is to find out what I'm doing wrong so that I can find the call to that goddamn nag :)
1 Answer
if you are setting a breakpoint on the specific address 0x412d18 you must make sure that the specific address will be hit ( setting a breakpoint on a specific address and expecting it to break on CreateWindowCalls is not going to work )
to set a common breakpoint to catch all CreateWindow Calls you should set a breakpoint on system dll (user32.dll)
you should use a stack expression for the conditional break [esp+XXX] == 0x16xxxxxx
here is a sample on winxpsp3 mspaint.exe
Breakpoints
Address Module Active Disassembly Comment
7E42D0A3 USER32 Log when [esp+10] == 44008200 MOV EDI, EDI
the bp is set on
7E42D0A3 USER32.CreateWindowExW [esp+10] == 44008200 /$ 8BFF MOV EDI, EDI
never pause
break on condition
log always
condition [esp+10] = xxxxxxxx
expression [esp+10]
result as follows
Log data
Message
COND: style = = 88000000
COND: style = = 02CFC000
COND: style = = 52000000
COND: style = = 54000000
COND: style = = 5400014E
COND: style = = 56002800
COND: style = = 56008200
COND: style = = 56001400
COND: style = = 56004100
COND: style = = 44001430
COND: style = = 44008200 <------- broken and function args logged for my specific condition
CALL to CreateWindowExW from MFC42u.5F811CB2
ExtStyle = 0
Class = "AfxWnd42u"
WindowName = "Colors"
Style = WS_CHILD|WS_CLIPSIBLINGS|8200 <------------
X = FFFFFEFD (-259.)
Y = FFFFFFCD (-51.)
Width = 103 (259.)
Height = 33 (51.)
hParent = 00080226 ('Paint',class='MSPaintApp')
hMenu = 0000E818
hInst = 01000000
lParam = NULL
-
Thanks. I'll try it out, I think this might work. I still don't quite understand why it's giving false positives though? In the screenshot you can see that I've set a conditional breakpoint at
PUSH EAX
. It made a breakpoint when EAX was 80000000, even though the condition was equal to[EAX] == 16C80000
. Why? Jun 2, 2015 at 14:50 -
your screenshot does not convey your breakpoint semantics if there is an error parsing or evaluating ollydbg will pause and an error maybe logged in log window though it may appear to be paused due to break or appear to be flase positive suppose eax == 0 then parsing [eax] will lead to unreadable memory error and ollydbg may pause [8000000] may be inaccessible kernel pointer i cant say for sure what is happening from the information and screenshot you provided– blabbJun 2, 2015 at 18:35
-
What additional data do I need to provide for you to answer my question? :) Jun 2, 2015 at 19:04