,,,

      

www.kutub.info
&  2#$ 
-. / 01 &'( *!+ #$%!

)( '&& % $ "       ,$

" 123. . ./ ,-+* ,,,
'& :&A ,. > *&6/ %=2 "   .%12 67)  89: & ,$/!
' ) C. ,,&DE )&6  , $I &DG ,&DE  ,, $ %$
'..
)$ .2> ,
% )
 
% 
% ./ ,-  !
.2> ,  () M+%   !
)(  )>  .G N , %    N+P.
 .G%9:  &:2 Scode R&/ -S  %=2 " Z
[.  2 
( &16 G+&/  &[& / , 
$ /
% ](
.+6 )( %_% :
,9A  ,`  %`% )( &) , .$/ a NI*&6+
-7/ c d     %9: " , .G
olly *&6/ ,9A %G> , Open d file g&c )( &DG - 
.$/ a)  olly (D2 ,9A oG *&6+ N23  nc& F9
r %1 .2.` 12P/ )(   () =_% 
>  ,' &, 1/
.$/ > )&6  *&6+DE .c nc ,` o" olly_ " 89 W
 Windows d View g&c
)&6 a Dy `.2. >=% " &  %) %`% )( D/ , *&6+ ,
Z
r -&) " ( &)  d , g_ " 89z & 2
 g&c a Dy - &{ Message breakpoint on Classproc
)&6 a Dy &-R " c%> P16& ,g&y D/ , ,
Z
&/%1 &67) . &-7/ & WM _COMMAND111 &Dc
> " c%> P16 ($  )(  , *&6+> oP > nc & )( &y
 .2.=> .$/ D& ,_ " 89 %$ , OK " g&c%)
 >% 9 % &) " " % % D/ , ,
Z

r ` o" )&6  *&6+ d , nc_ " 89  CMD 01

  %12 $/ &) y A&Zc%
 . c%>   89:  .%$ address 004010E0
 %$ % ,'2 ./ 2  G&$&)& ,g , g

6&1   case switch -  CMD 1  %

 2&D6 2./ &)
F8 &N23  8/ ,= , &D)$>  , G+& D)$2
 ,12 CMD 1 2 d & 12 *&6+ .G 89:  G/
,D 12P ,, . . 123 .=6 ( 1/  %& 6. .$/
%[ )( C_% % & ,  . CMD 1  % )( 6/ .G6 2.+)(
GetActiveWindow SendMessage : & .
-  ,- .  / %P -  a +2 olly *&6/ / >
8P D/ , SendMessage .& / a +2
{
$&/ n
> (+R 9 () , &/ o/& D sendmessage . y
: %[ )( C_% %

%
or = NULL 0= // o/& +
B :PUSH 00040112
x0F1400= // &'& +
D :PUSH 0F1400040112
..
or = WM_SYSCOMMAND 112=// (6&'
B :PUSH 1120040113
CALL GetActiveWindow: 00401140
// hWnd //
& +
PUSH EAX: 00401146
CALL SendMessageA: 00401147
% ( 9/  % .`% *&6+ .[ %
 )= %
%
SendMessage(GetActiveWindow(),WM_SYSCOMMAND,SC_SCREENSAVE,NUL
;(L
2   7) olly () C_% %& & c&/ C_% %
 +
: ( 9/ n
2 
 2 %
{ 6 '&, &c n
2 2&D ` )(
%
;(SendMessage(GetActiveWindow(),0x112,x0F140,0x0
z 9> y o , a/ %G* / () " %
{ 6 n
2 
 2
h112 a/ %G )( n
2 x1120 c ' , {
D& c
! .
 N23  z `&+> &+& G2 oP>
address 00401147 %$ " ,[> " F8 " 89: )(
%$  "  ,[2 .$/ sendmessageA . &.R  %
, )( &) " )( C_% 1 % , .
 c " o3 81)
.[ %
 )( + & +> &+ .G
2.[ Z 2 >=  n  %
 `& .c %
6 D/
( *+ %) $ ) 
$ G+ )( .g%  +$> 12P

----------------------7/ c %&  %  1+ &[ ,)  -S ,

A a. (
. &] )(  ,1> .. *&6+  >    %G.
&' - ,,,
 '& D/&Z CMD 02 (6  o- &+ '&
.2 $ g&c./ start
 '&: CMD 03
  )&6 ,9Z2 . $  % N23=
,,
%
> .c  . ./ ,[> &D6 ,, 2%3 ,-%1> *&6+ ./& &[>R&/ .$/
 % ,
Z'& (6 ,,
 ! 8/ 9Z
&/./ () &6 2%_% . " c%> P16 &6 , &=6 ) ,  -S
,9A *&6+ .$/ , F9 N23  nc 6 a CMD 03
 c% ./ . G&$ 2& ,, ,g% %
.$/ a )(  &G F8 &1 , ,g& 6 a1
" ./ 2%  . CMD 03%$ address 00401152
,'2 % () ]&- *&6+>. &/ .
%
;"PUSH ASCII "Desk.cpl: 00401152
CALL 004014F0: 00401157
  >' () ,Z [. 2&16R . . -&] )( *&6+
( LaunchControlPanelApplet
 "  D%$ 00401157 ,'2 %CALL $
d_ 89z & 2 - a1 Follow *&6+" % `.2.
%%$ " c%> P16 o_ , address 004014F0%$
.7/ 6 d , F2.7/ *&6+ c% , F9 )( ./ 2.
 / . >.+ ./ n>/ ]&-[% &D2 & ,( 
 , ,9Z )( > 
% " >[ ," . CreateProcess
   +. ,&+ )(  ,G
.

/ .1 &/ . _= , {/> n%`% )( 

% [.
&/ -S (1/ () 2. & pStartupInfo , pProcessInfo
 &+ &+  >=&    %G9
$ c9  () .. ,,
- + &=>R d ,_& 89 Enter
 - z 89: & 2 &- Follow in stack
------------D/ %
6 .c &D6'  ,,>(A &$  () D G+
$

 )
& +*
  % 9Z &D 2& M+6% > *&6/ ) .$/ ,,,
[ / () +- C++* , 123 ,, y6 (A .=2 & " a$ (c.] A&Z
[. ,, >  =&`  a oG!!