[THIN] Re: Finding an entry point in a dll

Hi Jeremy,
 
Using something like the dependency walker normally makes it dead easy to see 
the entry points, provided you can monitor the DLL being run. Otherwise it 
sounds more like a job for a dis-assembler.
 
Have a look at the eval version of PE Explorer, 
http://www.pe-explorer.com/peexplorer-tour-function-view.htm 
<http://www.pe-explorer.com/peexplorer-tour-function-view.htm>  . Should get 
you the info you want.
 
An alternative is a couple of freeware/shareware applications that save restore 
icons, eg iconsaver (http://www.iconsaver.com/index.html 
<http://www.iconsaver.com/index.html> ), Desktop Save and Restore 
(http://www.midiox.com/html/desktop.htm 
<http://www.midiox.com/html/desktop.htm> ), and ActiveIcons 
(http://cursorarts.swmirror.com/acticn.zip 
<http://cursorarts.swmirror.com/acticn.zip> ).
 
regards,
 
Rick
 
Ulrich Mack 
Volante Systems 


________________________________

From: thin-bounce@xxxxxxxxxxxxx on behalf of Jeremy Saunders
Sent: Thu 29/06/2006 15:35
To: thin@xxxxxxxxxxxxx
Subject: [THIN] Finding an entry point in a dll



Hi List,

I wonder if anyone on this list can help with this problem.

I want to use Microsoft's layout.dll to automate the saving of desktop icon
positions on logoff, and then restoring them on logon.

When you install the layout.dll, you also add the following entries to the
registry which adds context menu items "Save Desktop Icon Layout" and
"Restore Desktop Icon Layout".

WshShell.RegWrite "HKCR\CLSID\{19F500E0-9964-11cf-B63D-08002B317C03}\",
"Desktop Icon Layout", "REG_SZ"
WshShell.RegWrite
"HKCR\CLSID\{19F500E0-9964-11cf-B63D-08002B317C03}\InProcServer32\",
"Layout.dll", "REG_SZ"
WshShell.RegWrite
"HKCR\CLSID\{19F500E0-9964-11cf-B63D-08002B317C03}\InProcServer32\ThreadingModel",
 "Apartment", "REG_SZ"
WshShell.RegWrite
"HKCR\Directory\Background\shellex\ContextMenuHandlers\IconLayout\","{19F500E0-9964-11cf-B63D-08002B317C03}",
 "REG_SZ"
WshShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell
Extensions\Approved\{19F500E0-9964-11cf-B63D-08002B317C03}", "Desktop Icon
Layout", "REG_SZ"

So to script this, I'm trying to find the correct entry point I need to
address.

The entry points I believe I've found are:
SSZ1C0015C8__Restore_Desktop_Icon_Layout
SSZ1C0015E8__Save_Desktop_Icon_Layout
SSZ1C001604__Restore_Web_View_Icon_Layout
SSZ1C001624__Save_Web_View_Icon_Layout
SSZ1C001640_Restore_Desktop_Icon_Layout
SSZ1C00165C_Restore_Web_View_Icon_Layout
SSZ1C00167C_Save_Desktop_Icon_Layout
SSZ1C001698_Save_Web_View_Icon_Layout
SSZ1C0016B4_Desktop_icon_layout_saved
SSZ1C0016D0_Web_View_icon_layout_saved
SSZ1C0016EC_Icon_Layout
SSZ1C0016F8_IconView
SSZ1C001704_WebView
SSZ1C00170C_Software_Microsoft_Windows_Curre
SSZ1C00174C_REG_BINARY
SSZ1C001758_Desktop_icon_layout_restored
SSZ1C001778_Web_View_icon_layout_restored
SSZ1C001798_There_is_no_icon_layout_stored_
SSZ1C0017B8_SHELLDLL_DefView
SSZ1C0017CC_SysListView32
SSZ1C0017DC_Progman
SSZ1C0017E4_HTML_Internet_Explorer

But when I run...
rundll32 layout.dll,SSZ1C0015E8__Save_Desktop_Icon_Layout
or
rundll32 layout.dll,SSZ1C0015C8__Restore_Desktop_Icon_Layout
I get a message to say that it's missing the entry.

I was wondering if there was anyone with experience at doing this sort of
stuff who can point me in the right direction.

If you are interested, you can get it from here.
http://www.kellys-korner-xp.com/regs_edits/iconlayout.zip

Cheers.
                                                               
 Kind regards,                                                 
                                                               
 Jeremy Saunders                                               
 Senior Technical Specialist                                   
                                                               
 Infrastructure Technology Services                            
 (ITS) & Cerulean                                              
 Global Technology Services (GTS)                              
 IBM Australia                                                 
 Level 2, 1060 Hay Street                                      
 West Perth  WA  6005                                          
                                                               
 Visit us at                                                   
 http://www.ibm.com/services/au/its                            
                                                               
 P:  +61 8 9261 8412                F:  +61 8 9261 8486        
 M:  TBA                            E-mail:                    
                                    jeremy.saunders@xxxxxxxxxxx
                                                               
                                                               







************************************************
For Archives, RSS, to Unsubscribe, Subscribe or
set Digest or Vacation mode use the below link:
http://www.freelists.org/list/thin
************************************************



#####################################################################################
This e-mail, including all attachments, may be confidential or privileged.  
Confidentiality or privilege is not waived or lost because this e-mail has been 
sent to you in error.  If you are not the intended recipient any use, 
disclosure or copying of this e-mail is prohibited.  If you have received it in 
error please notify the sender immediately by reply e-mail and destroy all 
copies of this e-mail and any attachments.  All liability for direct and 
indirect loss arising from this e-mail and any attachments is hereby disclaimed 
to the extent permitted by law.
#####################################################################################

Other related posts: