Link to home
Start Free TrialLog in
Avatar of systan
systanFlag for Philippines

asked on

iS it possible to know the functions used by application(.exe)

eq:
//The code used when was not yet compiled
procedure openthenet;
var  hSession: HINTERNET;
begin
hSession := InternetOpen('Mozilla/4.0', INTERNET_OPEN_TYPE_DIRECT, nil, nil, 0);
end;

iS it possible to know if the application(.exe) is using the function <<<"  InternetOpen  ">>>
Knowing by reading the file TModule32 ?
iS it possible in programming with delphi ?

I'm just waiting for answer: YES or NO,

And since this is a simple question for good points,  
I'd like to ask another yes or no,
iS it possible to change or add the appliction.title of an .exe file either running or not?
eq:
windows title bar is <"hellos">, then change/add to  <"mark hellos"  or  "coppper">
Avatar of CodedK
CodedK
Flag of Greece image

For the first you need to disassemble the application or dump it from memory and do some heuristics search and pattern matching. Both techniques require the app to be running or to run it afterwards
and disassemble it.
So no for the first.

For you second question ...Yes for tittle change if running, if not running requires hex editing.
So if running here's the source code :
http://delphi.about.com/library/code/fdac_titlebarchanger_src.zip

If not running open the file with hex editor there are some sources if you want for Delphi and search your file and then patch it.
Avatar of systan

ASKER

OK, i'LL accept your first answer as iS not possible, so, No!
But, about the caption, iT's not about the caption, iT iS a application.Title
eq.,
Application.Title:='hellos';
//then this <"hellos"> will appear at the taskbar as <"hellos">, then change it <"hi"> or <"hellos hi">
So, iS iT possible to change the application.Title of a (running application) or (not running application) ?
by Loading first in the TmemoryStream? then Saving it when changes are done in the Application Title?
I'm pretty sure that this can be done but i don't have any idea how can this be done without hex search and edit of the loaded application.
You can retrieve version info but i never saw or tried to mess with the application name.
So i leave it open but i think its possible only through hexadecimal edit only.
Avatar of systan

ASKER

Ok CodedK
Thank you for the comments, I would like to wait 1 last comment from another expert, and I'll accept/close this post.
iS it possible to know if the application(.exe) is using the function <<<"  InternetOpen  ">>>
Knowing by reading the file TModule32 ?

As previously indicated, yes . . . if you can decompile the application or if you have a pretty good knowledge of the assembly language of the machine.
iS it possible in programming with delphi ?
If you are asking whether you can tell if you have the source code open in Delphi 7, then the answer is a resounding "YES!"

I'm just waiting for answer: YES or NO,

And since this is a simple question for good points,  
I'd like to ask another yes or no,
iS it possible to change or add the appliction.title of an .exe file either running or not?
eq:
windows title bar is <"hellos">, then change/add to  <"mark hellos"  or  "coppper">

Maybe . . . (this one can't be answered with Yes/No because there are instances where you can and instances where you can't. ;-)
Avatar of systan

ASKER

>If you are asking whether you can tell if you have the source code open in Delphi 7, then the answer is a resounding "YES!"

Huh!, you really know the functions used by the application(not dll) using delphi? Really? I'm Surprise!

What about this link? Is this can know the functions like "InternetOpen" or " InternetOpenURL " or  "any_Functions" inside the application(not dll)?
http://www.cjandia.com/me/works/delphi/newide/RttiHlp.pas.txt

Ok, I will have to open another post to see if "really" can get the functions, and show me another link about the code.

Thank you
ASKER CERTIFIED SOLUTION
Avatar of CodedK
CodedK
Flag of Greece image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of systan

ASKER

Thanks CodedK

>And this was created with a decompiler that can understand Delphi calls and output a readable code.

Ops!, you mean to say that it is specific only to delphi?
What about other compiled applications?  Like c/c++ or cbuilder?  InternetOpen can't be recognized?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of systan

ASKER

lol, Thank you, Delphi Rocks, even .NET will reach version 2020
Avatar of systan

ASKER

Ok, a followup question, one last answer please, just YES or NO, no following sentence

if its hard to get the function name inside the application(.exe), what if I assigned or PUT the entry_point or the address of the function that I am searching for:
like this:

Wininet.DLL exports TAble:
...
00015912h            264     InternetOpenA
00013491h            229     InternetConnectA
...

note:
00015912  (the address/entrypoint of InternetOpen in Wininet.DLL) I will put it in my code as string

code structure:
if "00015912" is found at "InternetEXE.exe" then
begin
showmessage('Internet open is found')
end;

iS this a possible technique?
systan,
Your last request closely resembles the following question (which I defy you to answer Yes or No):
Are you still molesting children?
Are you saying that you are writing the Wininit.dll and you are puttinng a string in the code at the point of the InternetOpenA function?
Or, are you saying that "there exists a WinInit.dll that exports the InternetOpenA function"?
Also, is the 00015912h a relative address or an absolute address?
Finally, are you analyzing this DLL as it resides in memory or as a binary data file that you read and analyze without loading in the usual fashion?
 On the other hand, if you know that 00015912h is the address of the InternetOpen entry point, why do you need to search for it ?
Finally, your "code structure" is psuode-Delphi code but could not be written that way.  You would need to find the position of '00015912' within the block of binary data that you have read from the WinInit.dll file but you would need to read blocks with an overlap of  least 8 characters (so that you don't read in 00015 in one block and 912 in the next one.
Given that you are reading WinInit.dll as a data file and that you have the 00015912 as a text string within the file and that you are handling the block reads in an appropriate manner, then yes, that would be one technique for finding the entry point.  Although, that technique cannot be generalized because you cannot guarantee that all DLL's will provide such convenient markers. ;-)
Avatar of systan

ASKER

I think I should open a new post for continuing this discussion.
But first, let me clarify this, that I'm not molestering any child. LOL,  I'm just asking for help
This program I'm developing is not for bad intensions.  It is for a good reason, and I will not reveal of what I am trying to achieve, because maybe if I fail this project(personally) noone's gonna fire me.

Ok, this is the continued link, for a 250 points at the beginning.