Reverse Engineering the Windows XP Window Manager, Part 2: IDA is my ally

October 21, 2006 on 5:13 am | In Development, Research | No Comments

First thing I did was fire up IDA and take a look at the disassembly of the PrintWindow. The function is exported in User32.dll.

And here is what I came accross:

  1. .text:77D5D2A0 ; Exported entry 517. PrintWindow
  2. .text:77D5D2A0
  3. .text:77D5D2A0 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
  4. .text:77D5D2A0
  5. .text:77D5D2A0
  6. .text:77D5D2A0 ; __stdcall NtUserPrintWindow(x, x, x)
  7. .text:77D5D2A0                 public _NtUserPrintWindow@12
  8. .text:77D5D2A0 _NtUserPrintWindow@12 proc near
  9. .text:77D5D2A0                 mov     eax, 11DDh
  10. .text:77D5D2A5                 mov     edx, 7FFE0300h
  11. .text:77D5D2AA                 call    dword ptr [edx]
  12. .text:77D5D2AC                 retn    0Ch
  13. .text:77D5D2AC _NtUserPrintWindow@12 endp

Pretty small heh! At least not enough for me to figure out how the function works! But I didn't stopped here of course :)
Continue reading Reverse Engineering the Windows XP Window Manager, Part 2: IDA is my ally...

Reverse Engineering the Windows XP Window Manager, Part 1

October 20, 2006 on 4:12 pm | In Development, Research | No Comments

Almost 3 years ago, I started a project, expire, which was supposed to be the windows clone of Exposé, the Mac OS 10.3 window tiling feature. It was also my personnal project for my second year in Epitech. We had a few beta out, everything was going good, but the request came: "We want Windows 2000 support !".

To replace you in the context, the program used one hell of a handy API to get its screenshots of the windows: PrintWindow. What this api was doing is actually make a screenshot of a window into a DC. The main advantage over the classic BitBlt method is that it can also shot windows partially or completely out of the screen, or deep in the Z-order. Pretty handy for an Exposé clone heh! The problem is, this API was introduced with Windows XP! No support for Windows 2000 then.

So I started to investigate whether or not it was possible to recode PrintWindow in Windows 2000. And boy, it was possible. In fact, I didn't know at that time how far I was going to get with this!

GData API for the .NET Compact Framework

October 20, 2006 on 3:53 pm | In Development, Projects | 3 Comments

This is the GData API ported to the .NET Compact Framework. With it full synchronization of a Google Calendar on any .NET CF compatible device is possible, and over the air if the device permits it (GPRS, EDGE, WiFi, 3G...).

Click here to download the sources, ready to build.
Continue reading GData API for the .NET Compact Framework...

Powered by WordPress with Pool theme design by Borja Fernandez.
Entries and comments feeds. Valid XHTML and CSS. ^Top^