Restored from previous forum. Originally posted by wavemaker.
Franco, I tested your changes with my library and the example pb file and it worked perfectly, tool window was created and it didn't conflict with nothing else (give it a 3 id and let the pop up windows show, there's no problem). Send me your asm and desc code so I can figure out the problem.
Before you get mad with the source check that the function name is the proper in Asm and Desc files, and that you don't get a "Can't open main obj" or something like that with LibraryMaker. When testing your changes all I did was add the equ, copy the OpenPopUpWindow function to other named OpenToolWindow (and 'GLOBAL' it at the begining of the code), change the flags in CreateWindowsExA, and copy the function with its name in the Desc file. Everything worked fine.
About the hidden matter, here's what I got from Internet, have no time to comment it (just translated it from Masm to Nasm syntax):
Code: Select all
; Hidden, coded by CybOrgAsm, Porto Alegre - Brasil. 05/1999
; Suggestions, comments ? -> Contact me at [url]mailto:hardlock@cyberspace.org[/url]
; Well.. I've seen many ppl asking about "how to hide a process from
; the control+alt+del box", so here is a simple example on how to do it.
;
; Thank you Iczelion for the Win32Asm homepage.
Extern _GetModuleHandleA@4
Extern _GetProcAddress@8
Extern _MessageBoxA@16
Extern _ExitProcess@4
MB_OK equ 0
[section .data]
%macro sc 1+
sc2 _%1
%endmacro
%macro sc2 1-*
%assign %%i (%0-1)*4
%rep %0 -1
%rotate -1
push dword %1
%endrep
%rotate -1
call %1@%%i
%endmacro
SEGMENT .text USE32 CLASS=CODE
..start:
sc GetModuleHandleA, kernel32 ; get module handle of kernel32.dll
or eax, eax ; you must LoadLibrary if your program
jz .sair ; doesn't call any function in kernel32.dll
sc GetProcAddress, eax, func ; we must get the address
; of undocumented function
or eax, eax
jz .sair
mov [RSP], eax ; save the address
push dword 1 ; hide
push dword 0 ; 0 = this process
call [RSP] ; call it
sc MessageBoxA, 0, mens1, mcaption, MB_OK
push dword 0 ; well.. we don't have a function called
; "UnRegisterServiceProcess" BUT...
; if you put a 0 , you will "unhide" it >:)
push dword 0 ; this process. (but what about unhide others?)
call [RSP] ; call it
sc MessageBoxA, 0, mens2, mcaption, MB_OK
.sair:
sc ExitProcess, 0 ; cya!
ret ; I guess you put a ret here, don't you? (Wavemaker dixit)
[section .data]
mens1 db "This process was hidden of control+alt+del box!", 0
mens2 db "Now, you can see it...", 0
mcaption db "Program: Hidden Process... by CybOrgAsm, POA - Brasil", 0
kernel32 db "kernel32.dll", 0
func db "RegisterServiceProcess", 0 ; undocumented.
[section .bss]
RSP resd 1
Regards,
Wavemaker
Edited by - wavemaker on 28 November 2001 03:20:08
