@
2lz
s0m
02/01/2004 updated Informers and handlers |
Apirator 0.x API tester , window spy /handler , advanced kit4s0m See also s0mApirator. These projects will be aggregated. ![]() |
Freeware |
![]() |
![]() |
![]() |
USAGE 1. CALL FUNCTION FROM DLL Choose one of system's DLLs from dropdown list of Lib combobox, or type here full path to needful DLL (or just '\NAME.DLL', if DLL is system's), or drag-and-drop needful DLL to left part of Apirator's window. After that Fnc combobox shows all functions with names from this DLL. You can just choose one of them. But if needful function hasn't name - - type here its ordinal from export table of this DLL. If function has parameters type them in edit boxes 1, 2, 3, ... If parameter is decimal integer just type it. If parameter is minus decimal integer -X just type -X. If parameter is hex integer type it after prefix #. If parameter is text with 1-st symbol other than numeric, #, $ or @ - just type this text, else type this text after prefix $. If type only symbol $ then this edit box will show buffer (after CALL). If type only symbol @ then this parameter will be previous return value. Apirator 0.x is raw draft yet: - you can't type symbolic name of API constant, you must type its value (get from API dox): 0 instead of MB_OK, -20 instead of GWL_EXSTYLE, #10 instead of WM_CLOSE, etc; - also you can't work with data-parameters directly. It was parallel load parameters, but you can use serial load also: In Lib combobox choose library TuneUp, in Fnc combobox choose Start serial load. Click CALL button. Now you can see 1 before CALL button (instead of 0): it means you can load 1-st parameter. Type its value in Fnc combobox. Click CALL. Now you can see typed value in 1-st param.string and 2 instead of 1 before CALL. Etc. So you can load 25 parameters, more than you really need. Any moment you can choose Finish serial load in Fnc combobox and click CALL. After loading parameters choose DLL in Lib combobox and function in Fnc combobox. Serial is better if Apirator will work as kit4s0m. Now - CALL: just click CALL button. You'll get return value in I/O Edit+Combobox This I/O is also automatic converter hex<-->dec (unsigned). Also you can input here window handle for window operations. Near Fnc combobox you can see number of parameters of this function. Some examples: 1) Create MessageBox Lib: \user32.dll Fnc: MessageBoxA (4); number of parameters of this function pr1: 0 ; Parent hWnd pr2: $1-string ; Message 2-string ; (edit boxes for parameters are ES_MULTILINE) 3-string ; pr3: Messagebox ; Caption pr4: #40040 ; MB_OK+MB_ICONASTERISK+MB_TOPMOST (0h+40h+40000h) CALL 2) Create button Lib: \user32.dll Fnc: CreateWindowExA (12); or type here ordinal 91 (for user32.dll of Win98) pr1: #0000010C ; ExStyle WS_EX_WINDOWEDGE|WS_EX_NOPARENTNOTIFY|WS_EX_TOPMOST pr2: Button ; Class pr3: $007 ; Text pr4: #50050000 ; Style BS_PUSHBUTTON|WS_CHILD|WS_VISIBLE|WS_THICKFRAME|WS_TABSTOP pr5: 180 ; Left (x) pr6: 2 ; Top (y) pr7: 40 ; Width pr8: 26 ; Height pr9: ; type here hWnd of parent window (Apirator) pr10: 12345 ; ID of child control pr11: 0 ; hInstance pr12: 0 ; Param CALL => New button 007 3) Path to folder Lib: \kernel32.dll Fnc: GetCurrentDirectoryA (2); pr1: 1024 ; size of buffer pr2: $ CALL => full path to current directory instead of $ 4) String + String ; left screenshot Lib: \kernel32.dll Fnc: lstrcatA (2) pr1: Str1_ ; 1-st string pr2: Str2_ ; 2-nd string CALL => you can see 'Str1_Str2_' (from buffer with pointer = return value). 5) Convert dec/hex Lib: \user32.dll Fnc: wsprintfA (0); (0 - because wsprintf is c-function) pr1: $ pr2: %lX ; MSDN - wsprintf pr3: 2003 ; just decimal integer CALL => long unsigned hexadecimal integer in uppercase 7D3 instead of $ 6) Draw line Lib: Mix Fnc: 'Draw line' CALL button must be in focus, click it + move mouse without press + ENTER key. 7) Chain (draw line) Lib: \user32.dll Fnc: GetDC (1) pr1: 0 CALL , Lib: \gdi32.dll Fnc: LineTo (3) pr1: @ pr2: 1024 pr3: 768 CALL 8) API error codes Lib: Mix Fnc: ErrorCodeToText CALL => convert ErrorCode (from I/O) to text 9) chain (API error code) Lib: \kernel32.dll Fnc: SetLastError (1) pr1: 87 ; ErrorCode 87 (57h) - 'The parameter is incorrect.' CALL, Lib: \kernel32.dll Fnc: GetLastError (0) CALL, Lib: \kernel32.dll Fnc: FormatMessageA (7) pr1: #1000 ; Value of constant FORMAT_MESSAGE_FROM_SYSTEM pr2: 0 pr3: @ ; last error pr4: 0 ; default language pr5: $ pr6: 1024 ; size of buffer pr7: 0 CALL => ErrorText 'The parameter is incorrect.' instead of $ 10) chain (show system's icons and cursors) Lib: \user32.dll Fnc: CreateWindowExA (12) pr1: #00000000 ; ExStyle pr2: Static ; Class pr3: ; Text pr4: #50000203 ; Style SS_ICON|SS_CENTERIMAGE|WS_CHILD|WS_VISIBLE pr5: 180 ; Left (x) pr6: 2 ; Top (y) pr7: 32 ; Width pr8: 32 ; Height pr9: ; type here hWnd of parent window (Apirator) pr10: 12345 ; ID of child control pr11: 0 ; hInstance pr12: 0 ; Param CALL, Lib: \user32.dll Fnc: LoadIconA (2) pr1: 0 ; pr2: 32512 ; 32512-32517, 32868-32873 CALL, Lib: \user32.dll Fnc: SendDlgItemMessageA (5) pr1: ; type here hWnd of parent window (Apirator) pr2: 12345 ; ID of child control pr3: #0172 ; Value of message STM_SETIMAGE pr4: 1 ; wParam pr5: @ ; lParam CALL => show system's icon Fnc: LoadCursorA (2) pr1: 0 ; pr2: 32512 ; 32512-32516, 32631, 32642-32662 less 32647, 32868-32883 CALL, Lib: \user32.dll Fnc: SendDlgItemMessageA (5) pr1: ; type here hWnd of parent window (Apirator) pr2: 12345 ; ID of child control pr3: #0172 ; Value of message STM_SETIMAGE pr4: 1 ; wParam pr5: @ ; lParam CALL => show system's cursor 2. WINDOW OPERATIONS Window finder (right screenshot): 1) Lib -- WINDOW OPERATIONS -- Info_From_Point 2) CALL button must be in focus, click it. 3) Move mouse (without press). 4) Click Enter key and get some visual windows from this point (parent and children): I/O combobox is store for founded handles. Operation MoveWindow uses Left/Top/Width/Height parameters. Operations GetWindowText/SetWindowText/wm_GetText/wm_SetText use Text parameter. Btw, Apirator's window has styles WS_SIZEBOX, WS_EX_ACCEPTFILES, WS_EX_TOPMOST. 3. APIRATOR AND S0M-SCRIPTS S0m-script can transform Apirator's window to own dialog: change size, hide needless default Apirator's controls, with help of Apirator call function CreateWindowExA and create any new needful controls. Special Apirator's control 'ID clicked' allows new buttons, 'Droped file' allows dragdrop, 'CALL' and some other default Apirator's controls allow use any API. Besides s0m with external kit4s0m/api4s0m you can try s0mEx with kit/api4s0m inside. As example - s0mApirator. 4. INFORMERS AND HANDLERS MSDN, ApiViewer 2003, API-constants 50kb, Messages 7kb, Styles 31 kb, SystImages 4kb, Resource Hacker, MemSpy 43kb, Export view 4 lazy 20kb, APISpy32, MS Spy++, WinSight, WinSpy++, SpyWindow, WindowScanner, Sign0fMisery Find maximum number of parameters for API function : UltraEdit -> Search -> Find In Files -> Regular Expression, Search In - Files Listed, Directory - [path]\masm32\include, In Files/Types - *.inc , Find - :*:*:* ... ( type 22 :* ) , click Find button => no result. But after 21 :* we get report: " Find ':*:*:*:*:*:*:*:*:*:*:*:*:*:*:*:*:*:*:*:*:*' in '[path]\masm32\include\tssutil.inc' : [path]\masm32\include\tssutil.inc(6): _CT??_R0PAX PROTO :DWORD,:DWORD,:DWORD,... " (21 DWORD) . |