Quote:
|
Originally Posted by Knight
Here's tutorial about the same subject:
_http://www.reversing.be/article.php?story=20060313092818514
Regards,
Knight
|
It is practically the same as the way I did it except he says to put an unconditional JMP at the first PUSH but I just replace the JE. I didn't copy that tutorial honestly guys, because for me this was just about the knowledge and learning.
Quote:
|
Originally Posted by TmC
msn does not use mutex to check if already running. it checks in the process list if a msnmsgr.exe is running and if not it runs itself.
Try to create another msnmsgr.exe with another name (ex. msnmsgr2.exe) and it runs like a baby as many times as you want, provided that you rename it each time to another name.
|
I think this goes to show that sometimes we do things too complicated and the way we think is too complicated. If we look for simpler techniques we may find easier ways of doing things. But I didn't waste my time anyway because I learnt some stuff.
Quote:
|
Originally Posted by Harding
Sometimes it not always the process search you want to look for. Think further, if it finds the MSN is already running, what will it do?... call ExitProcess() maybe? Just stop on ExitProcess() and check where it was called from. That would give you something to work with.
|
Working your way backwards through the code is a good method. though I think it would not have been a high priority of mine, more than likely a last resort. But I guess for each problem comes a different method, and alsong as you solve the problem the method you use doesn't matter. Aslong as it works for you
I think from the perspective of a reverser I have seen some different ways that people will try and stop 2 instances of an application from running, the first 2 were Mutex's and FindWindow, but the 2 other methods were CreateEvent and by checking the name of running processes.
From a software developers perspective I think maybe adding something simple like an extra check of the same method. It wouldn't be too difficult to bypass I don't think, but it may cause a little confusion. Like having the FindWindow code which someone might try to NOP or JMP past. But then after that have another FindWindow code, so it checks first and if it doesn't find the window it checks again incase the first check was altered. So really they would have to NOP both FindWindow's. I don't think this would be very difficult like I said but it may cause a little confusion. It is always interesting to look at things from the view of the reverser and then look at it from the view of a software developer.
Anyway thank you for your reply guys.