2

I am trying to modify RadASM so that Ctrl+W will close the tab, instead of Ctrl+F4, and also make it so that if you middle mouse click the tab, it will close. The context menu for a tab is just a copy of the "Windows" menu bar item. The problem is, I can not figure out which library or even function is used to create menu bars and its items. I can not find any relevant strings in OllyDBG, and I've tried making breakpoints for just about every call I thought it might be, but I can't get anything.

Can anybody point me in the right direction? I couldn't locate the function in RadASM for determining which hotkeys/shortcuts do what either.

I know all about code caves and injecting DLLs, so adding a function like the middle mouse click shouldn't be impossible; I just need to know where to start since I'm quite new to reverse engineering.

Improve this question

2 Answers 2

Reset to default
3

To change Ctrl+F4 to Ctrl+W you can use a resource editor such as Resource Hacker.

Open RadASM.exe in the resource editor, modify the accelerators, and save your changes.

Assuming you're using Resource Hacker, you'd change

VK_F4, 47001, NOINVERT, CONTROL, VIRTKEY

to

VK_W, 47001, NOINVERT, CONTROL, VIRTKEY

Then press the Compile Script button, and save the changed file.

Resource Hacker

As for handling a middle-click on the tab, I used Spy++ to find the Window Procedure for the tab window. For RadASM 2.2.1.6 it's at virtual address 004061D4:

Spy++

The function at that address is the DialogProc callback function for the SysTabControl32 window. You can patch that function in RadASM.exe to monitor for and act on the uMsg value WM_MBUTTONDOWN.

Improve this answer
4
  • Thanks! I also edited the Menu in Resource Hacker so it shows the correct hotkey. Do you have any idea about adding the feature of middle mouse clicking to close the tab? Commented Jul 13, 2013 at 23:47
  • I updated my answer above with how to handle the middle mouse click. Commented Jul 14, 2013 at 0:15
  • I've begun writing my code cave, but I can't figure out what to do if uMsg == WM_MBUTTONDOWN. I cannot figure out what closes a tab. Do you have any idea what function does that, or any idea how I could find it? Commented Jul 14, 2013 at 5:50
  • Internally, RadASM sends TCM_HITTEST to the SysTabControl32 window to determine the tab that was clicked, sends TCM_SETCURSEL, TCM_GETITEM, and WM_MDIACTIVATE to make that tab active in the MDI, and then sends WM_CLOSE to the now-active MDI window. You need to replicate that. Commented Jul 14, 2013 at 19:01
3 
ollydbg radasm.exe view windows (W Icon) sort class and look for Mdi class like mdiEditChild / dialog etc

example

Windows, item 96 Handle=000704EE Title=C:\testrad\Html\Projects\testrad\testradinc3.html Parent=000203E4 ID=0000FDEA (65002.) Style=56CF0001 WS_CHILD|WS_GROUP|WS_TABSTOP|WS_CLIPSIBLINGS|WS_CLIPCHILDREN|WS_VISIBLE|WS_SYSMENU|WS_THICKFRAME|WS_CAPTION|1 ExtStyle=00000340 WS_EX_MDICHILD|WS_EX_WINDOWEDGE|WS_EX_CLIENTEDGE Thread=Main ClsProc=00xxxxxx RadASM.00xxxxxx Class=MdiEditChild

right click message breakpoint on class proc

in the dialog

choose window creation and destruction never pause radio button log winproc args always

you should be able to capture the WM_CLOSE sent by ctrl+f4

Log data Address Message 00XXXXXX CALL to Assumed WinProc from USER32.7E418731 hWnd = 000704EE ('C:\testrad\Html\Projects\test...',class='MdiEditChild',parent=000203E4) Message = WM_CLOSE wParam = 0 lParam = 0

The patch below should pop up a Messagebox when you hit Middle Mouse Button on the SysTabControl

004071A7 |> \90 NOP ; Default case of switch 004070B6 004071A8 |. 90 NOP 004071A9 |. 90 NOP 004071AA |. E8 5D1F0400 CALL RadASMWM.0044910C 00449100 <STRING> . 57 4D 5F 4D 42 5>ASCII "WM_MB_CLICK",0 0044910C <WM_MB_CLICK_HANDLER> /$ 60 PUSHAD ; CALL FROM 4071AA 0044910D |. 9C PUSHFD 0044910E |. 3D 07020000 CMP EAX, 207 ; WM_MB 00449113 |. 75 13 JNZ SHORT <RadASMWM.RETTOORIGHANDLER> 00449115 |. 6A 00 PUSH 0 ; /Style = MB_OK|MB_APPLMODAL 00449117 |. 68 00914400 PUSH <RadASMWM.STRING> ; |Title = "WM_MB_CLICK" 0044911C |. 68 00914400 PUSH <RadASMWM.STRING> ; |Text = "WM_MB_CLICK" 00449121 |. 6A 00 PUSH 0 ; |hOwner = NULL 00449123 |. E8 A2FBFFFF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA 00449128 <RETTOORIGHANDLER> |> 9D POPFD 00449129 |. 61 POPAD 0044912A |. 8B45 08 MOV EAX, DWORD PTR SS:[EBP+8] ; RadASMWM.<ModuleEntryPoint> 0044912D |. E8 F7B8FBFF CALL <RadASMWM.ORIGINAL HANDLER> 00449132 \. C3 RETN
Improve this answer
1
  • Thanks! I should be able to figure this out with the help from you and Jason Geffner. Commented Jul 14, 2013 at 20:39

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.