North Pole: https://bbs.csdn.net/topics/392434614
Write their own name called XCDZIP35. OCX component, the XCDZIP35. OCX to replace any registration information, I want to ask
1. The old XCDZIP35. OCX have to change name can (name)
2. Old XCDZIP35. OCX UUID have to change
3. New XCDZIP35. OCX UUID should with unchanged in front of the old XCDZIP35. OCX as

CodePudding user response:

I have read your original post, first have to confirm the call ocx program you write?
If you write, you just to record calls ocx parameters, these parameters must be through your program a method, you can directly record
But not if the program you wrote, you cannot direct recording, you'll do a ocx transit doesn't do it, I suggest you go to the study of zhao four methods
Old ocx isn't what you write, you can't recompile, that means you can't change it's uuid
Ocx call is registered under the name of the class to ocx table query information, if you have replaced old ocx information into your new ocx, the program can call your ocx
But the problem is your new ocx is according to the old old ocx ocx information to load, while the registration information of the old ocx information has been replaced with the new ocx, you guess what will happen

CodePudding user response:

Old ocx does not need to change name, but information registries need to move to a new clsids, so your new ocx can create this old ocx, because the original old ocx clsids captured by your new ocx,
File name doesn't matter, don't change is change, the registry information in the file name also change together,
New ocx clsids must be the same as the original clsids old ocx for this ID is a host program used to create the ocx,

Of course you also can
Old OCX clsids doesn't change
New OCX clsids with self-built
The host program inside the old OCX clsids into new OCX clsids
But this need to crack a host program find clsids storage format, and found the location of each clsids...
Or directly to hijack the clsids once and for all,

CodePudding user response:

CodePudding user response:

reference 1st floor Sandrer response:

I read your original post, first have to confirm the call ocx program you write?
If you write, you just to record calls ocx parameters, these parameters must be through your program a method, you can directly record
But not if the program you wrote, you cannot direct recording, you'll do a ocx transit doesn't do it, I suggest you go to the study of zhao four methods
Old ocx isn't what you write, you can't recompile, that means you can't change it's uuid
Ocx call is registered under the name of the class to ocx table query information, if you have replaced old ocx information into your new ocx, the program can call your ocx
But the problem is your new ocx is according to the old old ocx ocx information to load, while the registration information of the old ocx information has been replaced with the new ocx, you guess what will happen

reference 1st floor Sandrer response:

I read your original post, first have to confirm the call ocx program you write?
If you write, you just to record calls ocx parameters, these parameters must be through your program a method, you can directly record
But not if the program you wrote, you cannot direct recording, you'll do a ocx transit doesn't do it, I suggest you go to the study of zhao four methods
Old ocx isn't what you write, you can't recompile, that means you can't change it's uuid
Ocx call is registered under the name of the class to ocx table query information, if you have replaced old ocx information into your new ocx, the program can call your ocx
But the problem is your new ocx is according to the old old ocx ocx information to load, while the registration information of the old ocx information has been replaced with the new ocx, you guess what will happen

Hello!
Do not I write, is feeling a bit complicated, I also checked the, old OCX cannot change its UUID, so new OCX call old OCX could lead to new OCX is less than the middle part

CodePudding user response:

Suggest a secretly replacement method, see whether it is feasible to, steps are as follows:
1. The old XXXX. Ocx to revise the file name, and then registered, don't tell others you are using this control, they don't know
2. Write your own a new ocx controls, and then within the control window OnCreate build the control object in the message, display in the window of the new control area
3. To set up some new ocx control method and the message, the actual is forwarding the old ocx control method and the message, of course, you can modify a little bit about the function parameters, etc

CodePudding user response:

if you want to know, is,

CodePudding user response:

reference 5 floor WWWFFFHHH reply:

suggest a secretly replacement method, see whether it is feasible, steps are as follows:
1. The old XXXX. Ocx to revise the file name, and then registered, don't tell others you are using this control, they don't know
2. Write your own a new ocx controls, and then within the control window OnCreate build the control object in the message, display in the window of the new control area
3. To set up some new ocx control method and the message, the actual is forwarding the old ocx control method and the message, of course, you can modify a little bit about the function parameters, such as

Today want to try to modify the OCX PutPassword code, want to go in the OCX see this method which is the code segment, and to go to, with less than, with VS2010 tstcon, OCX loading address is in 10100000, when the result of debugging time has been tstcon in turn, can't get, originally wants to cut instruction code in the disassembly OCX files or using the OD load to look inside, can't find!!!!! Under the head, I don't know where the code is, do not know how to break

CodePudding user response:

WinAPIOverride32
WinAPIOverride64

CodePudding user response:

Did miss zhao WinAPIOverride64 instructions

CodePudding user response:

Has not found the hook OCX, see only MFC40, MFC100, where is set up, miss zhao

CodePudding user response:

Above, see only the address of the call, but I guess not, in the OCX is loaded into the 10001000's because

CodePudding user response:

C: \ WinApiOverride \ WinApiOverride CHM

CodePudding user response:

I look at the instructions, or a little don't understand, HOOKE show success after loading, but just can't show called OCX's entrance

CodePudding user response:

Close the UAC, firewall, anti-virus software,...
As an administrator to run
.

CodePudding user response:

Thank you, I set about, excuse me even, when debugging, I checked the memory, my OCX is indeed a load on the 10001000 address, I use IDA loading TSTCON32, debug OCX, always to no this place (code), if I thought there was a problem, can't debugging OCX

CodePudding user response:

, can't get old, and from the information window cannot be observed

CodePudding user response:

There is no diamond, don't embrace China live,

CodePudding user response:

I don't know zhao four teachers have the introduction

If an interface is A derived only from IUnknown we have

PInterfaceA QueryInterface
AddRef
Release
InterfaceA_Method_1
InterfaceA_Method_2
.
InterfaceA_Method_N


In this case we have pInterfaceA==pIUnknown


If an interface B is derived from IDispatch we have

PInterfaceB QueryInterface
AddRef
Release
GetTypeInfoCount
GetTypeInfo
GetIDsOfNames
Invoke
InterfaceB_Method_1
InterfaceB_Method_2
.
InterfaceB_Method_N


In this case we have pInterfaceB==pIUnknown==pIDispatch

WinAPIOverride OCX file structure analysis, but how to calculate the size of the each part
nullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnullnull