MemMonitor95 Standard 4.0 and its ThunkConnect32 relations
(Half-crippled program / Unhiding an hidden window / Thunk vagaries)

by FootSteps

(24 November 1997, slightly edited by fravia+)

---

Courtesy of fravia's page of reverse engineering

---

Well, thunking (thunking up, thunking down, thunkconnect...) was about time to have a look at these thunks, don't you believe? Besides there is some 'intuition and luck' in this essay and, moreover, I like quite a lot little jewels like the following one:

bpx CreateWindowExA do "dd *((ss:esp)+8)
     With that, each CreateWindowExA hooked by Winnie will show us the second
     parameter we need : lpClassName in the data window.

MemMonitor95 Standard Edition 4.0  and its ThunkConnect32 relations 
Half-crippled program / Hidden window / Thunked.
================================================

You'll need :

MemMonitor 95 Standard Trial 4.0 from Prudens http://www.spywindows.com/
MemMonitor 95 Professional Trial from Prudens ibidem
Winnie 3.01 to 3.22 (everywhere on the web)
BRW 4.5 to 5.2      (everywhere on the web)
Winsight 5.x        (everywhere with BC++5)
WDasm32 8.x         (everywhere on the web, use 8.9)
IDA 3.7             (everywhere on the web, don't miss it)
Windoze95           (everywhere on your HD)

Once upon a time I was cracking some interesting tools of the trade, the 
Prudens's trial toolz, (see below for a quick easy reversing snippet about 
ExeSpy95 and ComSpy95), when I found in the third one, MemMonitor95, 
a different protection scheme from the two others.
I thought at first: "oh, no... back to trace", but I was happy: it was 
a good thing: I was beginning to bore myself without challenges.

Running the program, memmon95.exe, I was awaiting like with Exespy95 or
ComSpy95 a "sympathic" nag with something like 'Enter the drive where 
your registration key file is' (with these kind of nags sharewares you 
know immediately that the target is reversed! :-) but... here there was 
no sympathic nag.
Instead, a enormous bitmapped screen nag, with a irritating 'unregistered
user', and a very frustrating 'Not all hooks are available in this version'. 
Followed by a classic MessageBox with program presentation and bazaar.

In spite of my irritation, I played a little with memmon95.exe, you know 
we must always spy all the hints of the targets: where are placed on screen 
words like  'unregistered', when the NagMessageBoxes happen, what functions 
are disabled, etc...
This memmon95.exe is a nice tool, a little better than TechFacts to follow 
memory heap calls, because it show you these in real time (with TechFacts you 
must refresh).

I did not have to wait long in order to have my awaited nagscreen: I clicked 
on a Heap captured valor, and bingo! a nag with 
'This function is restricted to... etc, etc...'
I just thought: ha ha ha!, Gotcha! I will fire Winnie, put a classic
bpx MessageBoxA, press some F12 key, and land in a JZ opcode.

Yes, you can try. Fire Winnie. Bpx MessageBoxA. Click on the ListBox 
which makes the nag appear. 
You land obviously in User32!MessageboxA section.
But Press F12. Just once, go ahead.
You see where you land?
Yes, you land in the terrible Kernel32!ThunkConnect32!
Like quicksand! Aaargh!
You can continue to press the F12 key. But you will sink more and more!
Press it 12 times, and you'll land inside... nothing! The darkest codewoods!
Because we have lost hand of Winnie's trace and we sprang back to Windows' 
normal execution...

Well, I jumped on the Win32 SDK. 
What the hell is this ThunkConnect32 API anyway? 
You won't find it in the SDK. You'll find it in the help files:
Windows's developer guide (Borland C++) or in the Microsoft Programmer's
guide to Windows 95 (Borland C++ Builder, M$VC++, and others compilers...).
If you want more information, you've only got a ridiculous article on it 
in the M$ Knowledge Base, and a serious one inside the 'guru' Schulmann's 
book 'Unauthorized Windoze95'. My! You would never believe HOW MUCH 
undocumented is this whole windoze bazaar!

It was the first time I met this API following our paths. 
In fact 'Thunking' is the relation between 32bits and 16bits applications, 
either executables or DLL.
And WindoZ95 makes indeed an overbloated use of that, especially with the 
User32 to the old User interface... You know, W95 swap all time from 32 
to 16bits, from 16bits to 32... Seems sometimes that Windows95 is in fact 
the worse monstrous shareware ever programmed... :-)

So, why could we not get the hand back to Winnie, after this thunk? Who knows?
First, probably because of the MeMonitor95 hooks. You see, MemMonitor hooks
when running some 16/32bits API like GlobalAlloc and GlobalRealloc for example,
ensuring to catch some old WindoZ31 applications, then calls ThunkConnect to
switch from 32bits OS to 16bits.
Second, probably too, because after the nagscreen, and after the ThunkConnect32
Kernel section, the system goes back in the WndProc of the program, more
exactly inside the switch(message) loop. 
Then, we intercept one, which displayed the nag, and the program is now waiting 
some other ones (for example, when you click on some functions of the program). 
Like it is waiting, and not running.
Winnie sleeps. Try, after landing in Kernel!ThunkConnect32, to press F12 a
little times: you will not land inside User32... you'll dwell inside the 'old' 
16bits User!WaitMessage boring loops.

Since I couldn't trace anymore, I disassembled memmon95.exe with W32Dasm.
Well, I found quickly the right MessageBoxA references looking for
'this function is restricted...'. 
Yes, actually several references.
And looking closer to the dead-listing, it seems that that nag happens when
you click on some interesting function : A nag when you want to print, a nag 
when you want to heap process click, a nag when you want to save...
When you want to save? Hey, that isn't at all inside the buttons of 
the trial version!
It was time for a deeper examination of this thunked executable with BRW.

I fired therefore the heavy artillery: Borland Resource Workshop. 
More exactly, with version 5, run your compiler and open memmon95.exe using 
edit resources as a viewer.
And a lot of interesting things should appear in front of your child'eyes:
The enormous bitmap which serves as nag intro.
A registration window.
A registration window?? Well, then...
But wait... you better wait before crying victory. 
Something was terribly wrong.
Yes, I know something was wrong because I already spyed the OTHER 
executable (cracked below), ExeSpy95. 
And ExeSpy95 got TWO NagBitmapScreens.
And the file we study, memmon95.exe, has only ONE NagBitmapScreen. 
A big one with  the sad message 'No hooks are available' printed on it.
ExeSpy95 had the same, AND another one, without any inscriptions, the 
good one, the one we want: the registered one.
Perhaps memmon95 could then paint over these words with a FillRect() or 
some other graphic tricks in order to cover the bitmap when registered? 
No, Let's not be ridiculous... :-)

At this point, I had big doubts about cracking this target. 
Seems that it was a "really crippled" trial version... and that 
there were nothing to do.
But I continued a little. You know, for the fun, never give up!
And I fired Winsight, the window spy utility of the Borland C++.
And looked closer, once more, to my "MEMMON95" DialogBox.
Mmm, I verified all of my target, all the buttons, the ListBoxes, the
EditBoxes...
Suddenly, I jumped! 
In the Winsight detail, a second main window "MEMMON95" appeared!
Open it : you can remark all other child windows: a StatusBar one, a TBar one,
a Client one...
But all have the "hidden" attribute. This is why we just see the DialogBox.
I got an idea and looked at the readme.1st file that come with this appz 
(This is what I should have done from the beginning...)
There are two version of MemMonitor : the standard (we're studying)
and the Professional. I read :

STANDARD vs PROFESSIONAL (for Windows 95)
=========================================
The Professional Edition provides some advanced features:
  1. a view/log window is provided that displays captured calls
     - you can print the log
     - you can save the log to a file
  2. a setting window is provided that you can disable those APIs you are not
     interested

Well, the Pro version provides a view/log window? 
And what about the hidden window which lurk when we run the standard 
MemMonitor?
I then immediately wanted to un-hide this window. 
But it is not possible to change attributes when an application is 
running.
By the way, (

homepage links anonymity +ORC students' essays academy database
tools cocktails antismut CGI-scripts search_forms mail_fravia
Is reverse engineering legal?