Thursday Night

Paul Betts’s personal website / blog / what-have-you

Do you know how Raymond Chen shows hidden Windows?

He fires up Notepad in the debugger, and manually pushes stuff onto the stack to call ShowWindow.

ntsd -Ggx notepad
<f12>

Break instruction exception – code 80000003 (first chance)
eax=7ffdf000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c901230 esp=00a1ffcc ebp=00a1fff4 iopl=0         nv up ei pl zr na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
7c901230 cc               int     3
0:001> r esp=esp-4
0:001> ed esp 1
0:001> r esp=esp-4
0:001> ed esp 0×00010164
0:001> r esp=esp-4
0:001> ed esp eip
0:001> r eip=user32!showwindow
0:001> g
</f12>

From Image File Execution Options just inserts the debugger in front of the command line

I’m fairly sure that this makes him the Chuck Norris of programming.

Written by Paul Betts

July 2nd, 2007 at 11:52 am

Posted in Microsoft