[THIN] Re: Finding an entry point in a dll

Hi Rick,

Thanks for all that information.

It seems to only give me DllCanUnloadNow and DllGetClassObject as the entry
points. But that can't be right. The disassembler gives me the list of 22
items as per my e-mail below. But I don't think they are entry points.

This one is very similar, and gives me the same results.
http://www.midiox.com/html/desktop.htm

How can I work out exactly what "command" is run from the context menu when
you right click and select the required item?

Anyway, the link above also has a command line version DesktopCmd.exe that
can be downloaded (DTCMD.ZIP) and does exactly the same thing. So this is
the way I will script it for now to keep the customer happy. I'll install
both versions, which will give them the best of both worlds.

Cheers.

 Kind regards,

 Jeremy Saunders
 Senior Technical Specialist

 Infrastructure Technology Services
 (ITS) & Cerulean
 Global Technology Services (GTS)
 IBM Australia
 Level 2, 1060 Hay Street
 West Perth  WA  6005

 Visit us at
 http://www.ibm.com/services/au/its

 P:  +61 8 9261 8412                F:  +61 8 9261 8486
 M:  TBA                            E-mail:
                                    jeremy.saunders@xxxxxxxxxxx










                                                                       
             "Rick Mack"                                               
             <Rick.Mack@volant                                         
             e.com.au>                                                  To
             Sent by:                  <thin@xxxxxxxxxxxxx>            
             thin-bounce@freel                                          cc
             ists.org                                                  
                                                                   Subject
                                       [THIN] Re: Finding an entry point
             29/06/2006 02:33          in a dll                        
             PM                                                        
                                                                       
                                                                       
             Please respond to                                         
                   thin                                                
                                                                       
                                                                       




Hi Jeremy,

Using something like the dependency walker normally makes it dead easy to
see the entry points, provided you can monitor the DLL being run. Otherwise
it sounds more like a job for a dis-assembler.

Have a look at the eval version of PE Explorer,
http://www.pe-explorer.com/peexplorer-tour-function-view.htm <
http://www.pe-explorer.com/peexplorer-tour-function-view.htm>  . Should get
you the info you want.

An alternative is a couple of freeware/shareware applications that save
restore icons, eg iconsaver (http://www.iconsaver.com/index.html <
http://www.iconsaver.com/index.html> ), Desktop Save and Restore (
http://www.midiox.com/html/desktop.htm <
http://www.midiox.com/html/desktop.htm> ), and ActiveIcons (
http://cursorarts.swmirror.com/acticn.zip <
http://cursorarts.swmirror.com/acticn.zip> ).

regards,

Rick

Ulrich Mack
Volante Systems


________________________________

From: thin-bounce@xxxxxxxxxxxxx on behalf of Jeremy Saunders
Sent: Thu 29/06/2006 15:35
To: thin@xxxxxxxxxxxxx
Subject: [THIN] Finding an entry point in a dll



Hi List,

I wonder if anyone on this list can help with this problem.

I want to use Microsoft's layout.dll to automate the saving of desktop icon
positions on logoff, and then restoring them on logon.

When you install the layout.dll, you also add the following entries to the
registry which adds context menu items "Save Desktop Icon Layout" and
"Restore Desktop Icon Layout".

WshShell.RegWrite "HKCR\CLSID\{19F500E0-9964-11cf-B63D-08002B317C03}\",
"Desktop Icon Layout", "REG_SZ"
WshShell.RegWrite
"HKCR\CLSID\{19F500E0-9964-11cf-B63D-08002B317C03}\InProcServer32\",
"Layout.dll", "REG_SZ"
WshShell.RegWrite
"HKCR\CLSID\{19F500E0-9964-11cf-B63D-08002B317C03}\InProcServer32\ThreadingModel",

 "Apartment", "REG_SZ"
WshShell.RegWrite
"HKCR\Directory\Background\shellex\ContextMenuHandlers\IconLayout\","{19F500E0-9964-11cf-B63D-08002B317C03}",

 "REG_SZ"
WshShell.RegWrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell
Extensions\Approved\{19F500E0-9964-11cf-B63D-08002B317C03}", "Desktop Icon
Layout", "REG_SZ"

So to script this, I'm trying to find the correct entry point I need to
address.

The entry points I believe I've found are:
SSZ1C0015C8__Restore_Desktop_Icon_Layout
SSZ1C0015E8__Save_Desktop_Icon_Layout
SSZ1C001604__Restore_Web_View_Icon_Layout
SSZ1C001624__Save_Web_View_Icon_Layout
SSZ1C001640_Restore_Desktop_Icon_Layout
SSZ1C00165C_Restore_Web_View_Icon_Layout
SSZ1C00167C_Save_Desktop_Icon_Layout
SSZ1C001698_Save_Web_View_Icon_Layout
SSZ1C0016B4_Desktop_icon_layout_saved
SSZ1C0016D0_Web_View_icon_layout_saved
SSZ1C0016EC_Icon_Layout
SSZ1C0016F8_IconView
SSZ1C001704_WebView
SSZ1C00170C_Software_Microsoft_Windows_Curre
SSZ1C00174C_REG_BINARY
SSZ1C001758_Desktop_icon_layout_restored
SSZ1C001778_Web_View_icon_layout_restored
SSZ1C001798_There_is_no_icon_layout_stored_
SSZ1C0017B8_SHELLDLL_DefView
SSZ1C0017CC_SysListView32
SSZ1C0017DC_Progman
SSZ1C0017E4_HTML_Internet_Explorer

But when I run...
rundll32 layout.dll,SSZ1C0015E8__Save_Desktop_Icon_Layout
or
rundll32 layout.dll,SSZ1C0015C8__Restore_Desktop_Icon_Layout
I get a message to say that it's missing the entry.

I was wondering if there was anyone with experience at doing this sort of
stuff who can point me in the right direction.

If you are interested, you can get it from here.
http://www.kellys-korner-xp.com/regs_edits/iconlayout.zip

Cheers.

 Kind regards,

 Jeremy Saunders
 Senior Technical Specialist

 Infrastructure Technology Services
 (ITS) & Cerulean
 Global Technology Services (GTS)
 IBM Australia
 Level 2, 1060 Hay Street
 West Perth  WA  6005

 Visit us at
 http://www.ibm.com/services/au/its

 P:  +61 8 9261 8412                F:  +61 8 9261 8486
 M:  TBA                            E-mail:
                                    jeremy.saunders@xxxxxxxxxxx









************************************************
For Archives, RSS, to Unsubscribe, Subscribe or
set Digest or Vacation mode use the below link:
http://www.freelists.org/list/thin
************************************************



#####################################################################################

This e-mail, including all attachments, may be confidential or privileged.
Confidentiality or privilege is not waived or lost because this e-mail has
been sent to you in error.  If you are not the intended recipient any use,
disclosure or copying of this e-mail is prohibited.  If you have received
it in error please notify the sender immediately by reply e-mail and
destroy all copies of this e-mail and any attachments.  All liability for
direct and indirect loss arising from this e-mail and any attachments is
hereby disclaimed to the extent permitted by law.
#####################################################################################

(See attached file: winmail.dat)

Other related posts: