.386
.model flat, stdcall
option casemap :none
include windows.inc
include user32.inc
include kernel32.inc
include masm32.inc
include gdi32.inc
includelib gdi32.lib
includelib user32.lib
includelib kernel32.lib
includelib masm32.lib
.data
t db "{[Title:%s]",13,10,"[Hwnd:%d] [UniCode:%d] [WndProc:%08X]}",13,10,13,10,0
.data?
buffer db MAX_PATH dup(?)
.CODE
wndenumproc proc hwnd,lParam
local buff[512],outbuff[512],isA
local ProcessId,myProcessId,WndProc
assume fs:nothing
invoke GetWindowText,hwnd,addr buff,512
.if BYTE ptr buff[0]
invoke GetParent,hwnd
.if !eax
invoke IsWindowUnicode,hwnd
mov isA,eax
invoke GetWindowThreadProcessId,hwnd,addr ProcessId
mov eax, DWORD ptr fs:[18H]
mov ecx,[eax+20H]
mov myProcessId,ecx
mov ecx,ProcessId
mov [eax+20H],ecx
.if !isA
invoke GetWindowLongA,hwnd,GWL_WNDPROC
.else
invoke GetWindowLongW,hwnd,GWL_WNDPROC
.endif
mov WndProc,eax
push myProcessId
mov ecx, DWORD ptr fs:[18H]
pop [ecx+20H]
invoke wsprintf,addr outbuff,offset t,addr buff,hwnd,isA,WndProc
invoke StdOut,addr outbuff
.endif
.endif
xor eax,eax
inc eax ;To continue enumeration, the callback function must return TRUE; to stop enumeration, it must return FALSE.
ret
wndenumproc endp
START:
invoke EnumWindows ,offset wndenumproc,0
invoke StdIn,addr buffer,sizeof buffer
;暂停显示,回车键关闭
invoke ExitProcess,0
end START
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
