Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  How to call "DeviceAdvancedProperties(...)" on W2K and XP?

Topic created on: December 27, 2009 13:39 CST by RaDiXTwin .

Hi,

on W2K->Win7 you have a "DeviceAdvancedProperties" implemented as Ansi&Wide (DeviceAdvancedPropertiesA and  DeviceAdvancedPropertiesW) exported from devmgr.dll. The signature looks like this:

INT_PTR
WINAPI
DeviceAdvancedPropertiesA(IN HWND hWndParent  OPTIONAL,
                          IN LPCSTR lpMachineName  OPTIONAL,
                          IN LPCSTR lpDeviceID);

INT_PTR
WINAPI
DeviceAdvancedPropertiesW(IN HWND hWndParent  OPTIONAL,
                          IN LPCWSTR lpMachineName  OPTIONAL,
                          IN LPCWSTR lpDeviceID);

according to this website: http://www.koders.com/c/fid781EF17660D580D35EF019B3D89A82EBBF92B7A6.aspx

Invoking it on Windows Vista and Windows 7 is pretty easy, providing the first parameter a parent window handle, the second either NULL or a computer name and the third a Device Instance Identifier looking e.g. like this "SCSI\CDROM&VEN_ITQB&PROD_MZWHY781&REV_1.03\5&36E5972&0&000000". This will bring up the devices advanced/extend properties dialog with the extended properties with the tabs. If the function fails, you get a return value !=0, on success you get a 0 (zero). Calling the function with the parameters above returns on W2K the value -1 and GetLastError() = 6, the call on XP returns -1 and GetLastError() = 1784, set the processes SetLastError(0). Maybe these GetLastError() results are left fro a very deep call chain, maybe not, but does anybody have a clue how i can successfully invoke these functions on W2K and XP? They are implemented, at least it looks like that, maybe the signatures above are not correct for W2K&XP. Any help would be nice!

Thanks in advance.

regards

radix

  RabidCicada     December 28, 2009 12:05.05 CST
You do realize you are on a reverse engineering forum right? :).

I'm at work so I can't answer your question, but, take a look at a program that calls it legitimately on win2k/XP and use a debugger to look at the call stack for both 7/vista and 2k/XP.  Compare it to the calls and you should see the problem if they are called differently(signatures are different).  

You should be able to match up parameters/arguments via them looking similar in form when viewing the stack as hex.

  RaDiXTwin   December 29, 2009 10:46.50 CST
> RabidCicada: You do realize you are on a reverse engineering forum right? :).
>
> I\'m at work so I can\'t answer your question, but, take a look at a program that calls it legitimately on win2k/XP and use a debugger to look at the call stack for both 7/vista and 2k/XP.  Compare it to the calls and you should see the problem if they are called differently(signatures are different).  
>
> You should be able to match up parameters/arguments via them looking similar in form when viewing the stack as hex.

Hi,

thanks for your answer. Yes i realized that ;-). I am not an expert in reversing, means i am not that experienced on reverse engineering data and code, thats why i ask here. I figured many things out with debuggers and mostly with symbols for the libraries as good as i could. The problem here is that i could not find any application that calls this function on W2K/XP so i could break into it and have a look at the call stack and parameters on it. The functions exist, seem to be callable, but i could not find anything calling them. I asume that the Device Indentifier String must be be composed some special way like some other device id string passed to some other W2K functions expect them, but even trying that did not succedd. So this is the place where i am stuck: What and how does it have to be called? If the function exists in the (retail) library, is exported as C function and has some code/branching/subcalls behind the prolog, then i expect it to be callable,...but how?

Regards

R.

Note: Registration is required to post to the forums.

There are 28,226 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit