Shoutbox

quote:

---

Originally posted by CookieRevised

quote:

---

Originally posted by deAd

quote:

---

Originally posted by CookieRevised
Now, he also gave a hint as in how it would be possible, but that involves asm (which _is_ possible in scripting, but extremely advanced).

---

It's very messy, but you can inject the ASM bytes of a new wndproc into memory and use a pointer to those. It's really better to just use a dll if you need to subclass.

---

I know, hence why I said it is possible. I use ASM in one of my own private scripts... (which is not messy imo though, actually strait forward)

---

I think it involves calling WriteProcessMemory, but Cookie, how do you know which part of the text segment is free to use?

quote:

---

Originally posted by Mnjul
I think it involves calling WriteProcessMemory, but Cookie, how do you know which part of the text segment is free to use?

---

I've done this too to call my own function. Here is how I did it (it can probably be adapted to your use):

1. Obtain a DataBloc filled with the bytes you want to inject.
2. Call VirtualAlloc, passing 0 for lpAddress, the size of the DataBloc for dwSize, MEM_COMMIT (0x1000) for flAllocationType, and PAGE_EXECUTE_READWRITE (0x40) for flProtect.
3. Call WriteProcessMemory to write the contents of the DataBloc at the pointer to the allocated memory.
4. To actually call the newly allocated function, I used CreateThread with the pointer to the function I got.
5. Call WaitForSingleObject to wait for the function to end.
6. Call CloseHandle for the thread handle.
7. Call VirtualFree to remove the function you allocated.

This was done (with some help ) to call a function not otherwise possible to call from JScript and without a dll. You can pass another databloc parameter to CreateThread to give the function extra data. If you were looking to subclass, just inject a message handler written in ASM into memory. Then, instead of calling CreateThread to call it yourself, just pass the pointer to SetWindowLong. You'll also have to change when you call VirtualFree to make sure it gets freed when you're done using it.

Well, I got it! Much appreciation, deAd :applause:

OK, I have got a problem:

There has to be some place where I can store the address of the original WNDPROC. Where should I store it so that my own injected WndProc would be able to call the original one?

---

Ok, I see, why not dynamically, on-the-fly, modify the injected binaries so that the called address is the VirtualAlloc-ed address?