MessageBox when closing procomm via an aspect script

[WilliamA]

Iirc, there were a couple posts about that darn message box that pops up to confirm closing procomm from an aspect script. This morning was the first time I've run across that problem for the first time. Yesterday I tried the procomm scheduler for the first time, to launch a file capture script every morning so that the files will be ready for my viewing each morning when I get in. But that darn message box came up and wasn't handled.

That sort of idiot proofing ("are you sure you want to close this program?????&quot is not needed, at least in my opinion. So I located the message box code in aspect32.dll and patched it out. The last thing that I want to do is post information that could be miscontrued as illegal, but if I get the go ahead I'll post the info for anyone else that may want to implement this as well.


cheers,
will

 

[knob]

set aspect exitaction HALT should take care of the popup if I recall correctly.


aspect@aspectscripting.com

http://www.aspectscripting.com

 

[WilliamA]

....as usual, I did things the hard way. Thanks for making me feel stupid. Oh well, I managed to have fun for a few minutes this morning doing this.


cheers,
will

 

[knob]

But there's no thrill in using a set command when a hex editor can do the job as well!


aspect@aspectscripting.com

http://www.aspectscripting.com

 

[WilliamA]

Well that, and it's coded in vc++ which is a bit strange. However it was done, the messagebox call was actually a call to a function address (maybe a lookup table of addresses). I didn't really spend a whole lot of time on it. I just followed a couple of calls and found a cmp eax,6 (6 is the value of IDYES, the yes button on a yes/no messagebox). Then I overwrote the call right before that compare with a jump to the je location specified right after the compare. (There was also a manipulation of the esp register as well that I patched in -- add esp,18 if I remember right.) I left the rest of the code in place as it wouldn't be executed anyways due to the added jump.
It was a bit fun, and that info should be enough for anyone wanting to do this themselves. ....even though you've provided a much quicker and easier method.


cheers,
will