使用资源黑客在 ida 中找到一个对话框

逆向工程 艾达 补丁反转 资源
2021-07-03 07:20:24

我很难在 IDA 中找到对话参考。例如,我可以在“resource Hacker”或“PE Explorer”中跟踪一个对话框,如下所示:

5035 DIALOG 0, 0, 295, 163
STYLE DS_SETFONT | DS_MODALFRAME | WS_POPUP
CAPTION ""
LANGUAGE LANG_DANISH, 0x1
FONT 8, "MS Sans Serif"
{
   CONTROL "", -1, STATIC, SS_BLACKFRAME | WS_CHILD, 0, 0, 295, 163 
   CONTROL "Static", 1526, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 129, 121, 68, 16 
   CONTROL "Static", 1527, STATIC, SS_LEFT | WS_CHILD | WS_GROUP, 199, 123, 93, 14 
   CONTROL 551, -1, STATIC, SS_BITMAP | WS_CHILD | WS_VISIBLE, 0, 0, 295, 163 
   CONTROL "Progress1", 1232, "msctls_progress32", WS_CHILD | WS_VISIBLE | WS_BORDER, 0, 138, 295, 14 
   CONTROL "Number of trials left:", -1, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 2, 154, 63, 8 
   CONTROL "15", 1519, STATIC, SS_LEFT | WS_CHILD | WS_VISIBLE | WS_GROUP, 65, 154, 9, 8 
}

如何,或者我应该在 IDA 中寻找什么才能找到它被引用的地方?

1个回答

使用 5035(0x13AB) 作为 lpName 参数搜索对 FindResource 的调用