rendered paste bodytypedef enum { SIGNATURE_UI_STATUS_LABEL_SET = 0,};static FunctionSignature as_signatures[] = { /* SIGNATURE_UI_STATUS_LABEL_SET */ { "wcesmgr.exe", "56" // push esi "FF 74 24 08" // push [esp+text] "8B F1" // mov esi, ecx "E8 ?? ?? ?? 00" // call ?SetWindowTextA@CWnd@@QAEXPBD@Z ; CWnd::SetWindowTextA(char const *) "68 C8 00 00 00" // push 200 ; iMaxLength "FF 74 24 0C" // push dword ptr [esp+4+text] ; lpString2 "8D 46 54" // lea eax, [esi+54h] "50" // push eax ; lpString1 "FF 15 ?? ?? ?? 00" // call ds:lstrcpynA "6A 01" // push 1 ; bErase "6A 00" // push 0 ; lpRect "FF 76 20" // push dword ptr [esi+20h] ; hWnd "FF 15 ?? ?? ?? 00" // call ds:InvalidateRect "FF 76 20" // push dword ptr [esi+20h] ; hWnd "FF 15 ?? ?? ?? 00" // call ds:UpdateWindow "5E" // pop esi "C2 04 00", // retn 4 },};static __declspec(naked) voidactivesync_status_label_set_text(char *text){ CWnd *self; char *p; RECT parent_rect, label_rect; int x, y; __asm { push ebp; mov ebp, esp; sub esp, __LOCAL_SIZE; pushad; mov [self], ecx; } self->GetParent()->GetWindowRect(&parent_rect); self->GetWindowRect(&label_rect); x = label_rect.left - parent_rect.left; y = label_rect.top - parent_rect.top; if (y >= 40) { /* substatus: y = 50 */ message_logger_log_message("StatusLabelUpdated", 0x0, MESSAGE_CTX_ACTIVESYNC_SUBSTATUS, text); } else if (y >= 20) { /* status: y = 33 */ message_logger_log_message("StatusLabelUpdated", 0x0, MESSAGE_CTX_ACTIVESYNC_STATUS, text); } else { /* device: y = 2 */ message_logger_log_message("StatusLabelUpdated", 0x0, MESSAGE_CTX_ACTIVESYNC_DEVICE, text); } self->SetWindowTextA(text); p = (char *) self + 0x54; lstrcpynA(p, text, 200); InvalidateRect(self->m_hWnd, NULL, TRUE); UpdateWindow(self->m_hWnd); __asm { popad; mov esp, ebp; pop ebp; retn 4; }}voidhook_activesync(){ if (cur_process_is("wcesmgr.exe")) { char *error; if (!override_function_by_signature(&as_signatures[SIGNATURE_UI_STATUS_LABEL_SET], activesync_status_label_set_text, &error)) { message_logger_log_message("hook_activesync", 0, MESSAGE_CTX_ERROR, "override_function_by_signature failed: %s", error); sspy_free(error); } }}