/******************************************************\ HCU NOTES: Below is a nice handly little guide that answers the question: 'What can I breakpoint on in softice

to find what I want?' It was originally a decent win32 guide, but I have modified it quite alot since I originally received it. Credit goes to the original author for the easy to follow format though it pains me to say i do not have a clue who it was who sent me the original listing. NEW USER NOTES: (Yes I get these questions alot, so here I answer them) To use these api, just flip into SoftICE and BPX MessageBoxA (or any other call you want to bpx on) THE ONES WITH 'A' AT THE END ARE 32-BIT CALLS, so you will need to make sure that your WINICE.DAT file has been modified to EXPORT the proper symbol files (in softice for '95 of course since NT-ice uses 32 bit rather than the 16 bit calls you will need for many apps) Being redundant in case this file has been separated from the website, your winice.dat file is in your softice'95 directory with the executable (look in your autoexec.bat file for the location of WINICE.EXE if you have forgotten it's install location) EDITING WINICE.DAT TO INCLUDE 32-BIT CALLS REMOVE THE SEMICOLONS to uncomment the particular ones you need, Use THESE for now: gdi32.dll kernel32.dll user32.dll WELL - without anymore boring taglines, here it is... +gthorne'97 \******************************************************/ The Cracker's Guide of Common Win32 API Calls --------------------------------------------Reading & Writing Files ----------------------These are generic calls to read/write to a file, usually binary in nature: ReadFile WriteFile (see ED!SON's tutorial for more info)

more on locating file accesses: SetFilePointer GetSystemDirectory GetSystemDirectoryA These are the most common calls to read/write from/to a *.ini file or a file of similar format. for 16-bit win apps: GetPrivateProfileString GetPrivateProfileInt WritePrivateProfileString WritePrivateProfileInt for 32-bit win apps: GetPrivateProfileStringA GetPrivateProfileIntA WritePrivateProfileStringA WritePrivateProfileIntA Interrupt info: _____________ file accesses (A couple by YOSHi) bpint 21 if (ah==3d) bpint 2f if (ah==01) The Registry -----------Create or delete a new key in the registry: RegCreateKey RegDeleteKey RegCreateKeyA RegDeleteKeyA Read a value from the currently open registry key: RegQueryValue RegQueryValueA Open or close a registry key: RegCloseKey RegOpenKey RegCloseKeyA RegOpenKeyA

Dialog Boxes -----------Get text or integer from a dialog box edit: GetWindowText GetDlgItemText GetWindowTextA GetDlgItemTextA GetDlgItemInt Open a message box, usually one that says "invalid registration": MessageBox MessageBoxA MessageBoxExA MessageBeep and other ways to display text... SENDMESSAGE WSPRINTF Time & Date ----------These get the time and date GetSystemTime GetLocalTime SystemTimeToFileTime

Generating a Window --------------------createwindow createwindowexa showwindow bitblt (a type of memory move, similar to hmemcpy) CD-ROM Calls (Donated by: +-=Riddler=-+) ---------------GetDriveType GetDriveTypeA (if eax=5 then it is a cdrom check)

GetDriveType Return Function codes: Value 0 1 2 Meaning Drive Cannot Be determined Root Dir Does not exist DriveRemoveable

3 4 5 6 GetLogicalDrives GetLogicalDrivesA GetLogicalDriveStrings GetLogicalDriveStringsA OTHER CDROM INFORMATION -----------------------

A Fixed Disk (HardDrive) Remote Drive(Network) Cd-Rom Drive RamDisk

interrupt 2f is the mscdex interrupt bpint 2f, al=0 ah=15 checks if mscdex installed

try breaking on file accesses as well Window Numerical Inputs ---------------------------GETWINDOWWORD GETWINDOWLONG Some other nice breakpoints from the ORC ----------------------------------------------BOZOSLIVEHERE HMEMCPY GLOBALGETATOMNAME message breaks, not quite the same but completely useful ----------------------------------------------------------BMSG xxxx WM_GETTEXT BMSG xxxx WM_COMMAND (good for passwords) (good fro OK buttons)

the xxxx is of course the hwnd value, but important info: assuming you are using wm_command to try to locate the button push, you hwnd the result and see the hwnd of the button is 0324 and the hwnd of the window is 0129 to find the button, use the window value, not the button value to bmsg on (the other just won't work) so for the example here, to find our button push we would BMSG 0129 WM_COMMAND Note *from the original author* -----------------------------These aren't the only win32 api calls you need to know in order to crack windows.There are many many more that programs will use, many are derivatives of these calls. Try substituting a W for the A at the end of some calls, or placingan

Ex right before the A. Also, in SoftIce, typing 'EXP GETPRIVATEPROFILE' will give you a list of all of the procs to read from .ini files, and thereare more than the ones i have listed. - - The above statement referring to many many calls is actually an uderstatement Windows being as overbloated a mess of code as it is, the lists of calls is rather insane. in one of my OrcPaks, i released a list of wm_* calls (shamelessly grep'ped from the windows header files) and if you have seen the DOS interrupt files as well, you have only seen the tip of the iceberg. At one point I found it useful to go through the intlist and make a file full of all references to CD-ROM and MSCDEX calls alone (why do I mention these DOS interrupts in this file? SIMPLE: 16-bit windows - which many programs still are written in and use today use mostly DOS calls to handle protection schemes - like file times, etc... but that is another file ;) +gthorne'97 ps - anything you think I should have added but left out? let me know - i am always open to suggestions

Sign up to vote on this title
UsefulNot useful