Hot answers tagged

5

I think I got it. GetWindowLongPtr(hWnd, -1) returns a pointer to a nested struct that is a part of the WND struct (that contains main information about a window.) There's really no official name for it, but judging by this function name in comctrl32: I'd define it as such: struct WF{ WF_STATE state; WF_STATE2 state2; DWORD ExStyles; //With ...


3

Those functions are exported from ntdll.dll file. To link with those functions, add #pragma comment (lib, "ntdll.lib") in the source file. Or in Visual Studio, first check the active Configuration and Platform. Then add the library in Project > Properties > Linker > Input > Additional Dependencies. For example, like this %(AdditionalDependencies); ntdll.lib. ...


2

I had the same issue some time ago, updating to the latest x64dbg version solved that problem. You also have to set bps like that: [esp+0xC] == 0x202


2

I think this is the reason why there are some WinAPIs that also existing in kernelbase.dll. "As an example of functionality that we moved to low-level binaries, kernelbase.dll gets functionality from kernel32.dll and advapi32.dll. This means that the existing binary now forwards calls down to the new binary rather than handling them directly; the ...


1

Your Python code executes inside IDA’s process so you are getting results of the call on IDA, not the debuggee. If you want to execute code inside the process being debugged, you can use Appcall: http://www.hexblog.com/?p=113


Only top voted, non community-wiki answers of a minimum length are eligible