.Hi everybody,
first I would like to apologize for any grammatical errors. English is not my native language.
Also, if you will find this message too long, I will keep it shorter next time.
To describe a problem.. I have an application on which I�m practicing reverse engineering. It�s written in Delphi. The problem is in locating a WNDPROC. OllyDbg is a visual debugger and it can easy set a breakpoint on WNDPROC, but it fails due to strange address. Next step was trying with an IDA Pro. By manually browsing through the code I came up with the same address as Olly did. The address is 0xFFF010E8. I named the strange function �ModifyProccAddr�. You will see in there locating a 4k buffer and filling it with some values in a loop. Also, I don�t really understand the sub_4047DC function. It does some float computing, but IMHO, it has nothing to do with WNDPROC. It�s here anyway.
Any idea or suggestion on this WNDPROC issue is welcome.
Thnx, Natko
.text:00452F2C call RegisterClassW
.text:00452F31
.text:00452F31 loc_452F31: ; CODE XREF: sub_452ED8+38j
.text:00452F31 push 80000000h
.text:00452F36 push 0
.text:00452F38 push 0
.text:00452F3A push 0
.text:00452F3C push 0
.text:00452F3E push 0
.text:00452F40 push 0
.text:00452F42 mov eax, ds:hModule
.text:00452F47 push eax
.text:00452F48 push 0
.text:00452F4A mov ecx, offset dword_452F88
.text:00452F4F mov edx, WndClass.lpszClassName
.text:00452F55 mov eax, 80h
.text:00452F5A call sub_40F310
.text:00452F5F mov ebx, eax
.text:00452F61 cmp [ebp+arg_2], 0
.text:00452F66 jz short loc_452F7C
.text:00452F68 push [ebp+arg_4]
.text:00452F6B push dword ptr [ebp+8]
.text:00452F6E call ModifyProcAddr
.text:00452F73 push eax ; at the address in EAX is value 0xFFF010E8 (same as in Olly)
.text:00452F74 push GWLP_WNDPROC ; nIndex
.text:00452F76 push ebx ; hWnd
.text:00452F77 call SetWindowLongW
.text:00452F7C
.text:00452F7C loc_452F7C: ; CODE XREF: sub_452ED8+8Ej
.text:00452D40 ; =============== S U B R O U T I N E =======================================
.text:00452D40
.text:00452D40 ; Attributes: bp-based frame
.text:00452D40
.text:00452D40 ModifyProcAddr proc near ; CODE XREF: sub_452ED8+96p
.text:00452D40 ; sub_4A140C+97p ...
.text:00452D40
.text:00452D40 arg_0= dword ptr 8
.text:00452D40 arg_4= dword ptr 0Ch
.text:00452D40
.text:00452D40 push ebp
.text:00452D41 mov ebp, esp
.text:00452D43 push ebx
.text:00452D44 push esi
.text:00452D45 push edi
.text:00452D46 mov edi, offset dword_B43F90
.text:00452D4B cmp dword ptr [edi], 0
.text:00452D4E jnz short loc_452DBC
.text:00452D50 push 40h ; flProtect
.text:00452D52 push 1000h ; flAllocationType
.text:00452D57 push 1000h ; dwSize
.text:00452D5C push 0 ; lpAddress
.text:00452D5E call VirtualAlloc_0
.text:00452D63 mov esi, eax
.text:00452D65 mov eax, ds:dword_B43F8C
.text:00452D6A mov [esi], eax
.text:00452D6C lea edx, [esi+4]
.text:00452D6F mov eax, offset unk_AB3238
.text:00452D74 mov ecx, 2
.text:00452D79 call sub_4047DC
.text:00452D7E mov edx, offset sub_452D18
.text:00452D83 lea eax, [esi+5]
.text:00452D86 call sub_452D38 ; return edx - (eax + 5)
.text:00452D8B mov [esi+6], eax
.text:00452D8E lea ebx, [esi+0Ah]
.text:00452D91
.text:00452D91 loc_452D91: ; CODE XREF: ModifyProcAddr+74j
.text:00452D91 mov byte ptr [ebx], 0E8h
.text:00452D94 lea edx, [esi+4]
.text:00452D97 mov eax, ebx
.text:00452D99 call sub_452D38
.text:00452D9E mov [ebx+1], eax
.text:00452DA1 mov eax, [edi]
.text:00452DA3 mov [ebx+5], eax
.text:00452DA6 mov [edi], ebx
.text:00452DA8 add ebx, 0Dh
.text:00452DAB mov eax, ebx
.text:00452DAD sub eax, esi
.text:00452DAF cmp eax, 0FFCh
.text:00452DB4 jl short loc_452D91
.text:00452DB6 mov ds:dword_B43F8C, esi
.text:00452DBC
.text:00452DBC loc_452DBC: ; CODE XREF: ModifyProcAddr+Ej
.text:00452DBC mov eax, [edi]
.text:00452DBE mov ebx, [edi]
.text:00452DC0 mov edx, [ebx+5]
.text:00452DC3 mov [edi], edx
.text:00452DC5 mov edx, [ebp+arg_0]
.text:00452DC8 mov [ebx+5], edx
.text:00452DCB mov edx, [ebp+arg_4]
.text:00452DCE mov [ebx+9], edx
.text:00452DD1 pop edi
.text:00452DD2 pop esi
.text:00452DD3 pop ebx
.text:00452DD4 pop ebp
.text:00452DD5 retn 8
.text:00452DD5 ModifyProcAddr endp
.text:00452DD5
.text:00452DD8
.text:00452DD8 ; =============== S U B R O U T I N E =======================================
.text:004047DC ; =============== S U B R O U T I N E =======================================
.text:004047DC
.text:004047DC
.text:004047DC sub_4047DC proc near ; CODE XREF: sub_403B68+Ap
.text:004047DC ; sub_404EAC+4Fp ...
.text:004047DC cmp eax, edx
.text:004047DE jz short locret_404811
.text:004047E0 cmp ecx, 20h
.text:004047E3 ja short loc_404861
.text:004047E5 sub ecx, 8
.text:004047E8 jg short loc_4047F1
.text:004047EA jmp ds:off_404834[ecx*4]
.text:004047F1 ; ---------------------------------------------------------------------------
.text:004047F1
.text:004047F1 loc_4047F1: ; CODE XREF: sub_4047DC+Cj
.text:004047F1 fild qword ptr [ecx+eax]
.text:004047F4 fild qword ptr [eax]
.text:004047F6 cmp ecx, 8
.text:004047F9 jle short loc_40480C
.text:004047FB fild qword ptr [eax+8]
.text:004047FE cmp ecx, 10h
.text:00404801 jle short loc_404809
.text:00404803 fild qword ptr [eax+10h]
.text:00404806 fistp qword ptr [edx+10h]
.text:00404809
.text:00404809 loc_404809: ; CODE XREF: sub_4047DC+25j
.text:00404809 fistp qword ptr [edx+8]
.text:0040480C
.text:0040480C loc_40480C: ; CODE XREF: sub_4047DC+1Dj
.text:0040480C fistp qword ptr [edx]
.text:0040480E fistp qword ptr [ecx+edx]
.text:00404811
.text:00404811 locret_404811: ; CODE XREF: sub_4047DC+2j
.text:00404811 ; DATA XREF: sub_4047DC+38o
.text:00404811 retn
.text:00404811 ; ---------------------------------------------------------------------------
![[+] expand](/imagery/files/soysauce_blueprint.gif){kind=link}