Determining Active Menu ID on Mouse Click

In this article, I want to demonstrate the method to determine menu id when user perform mouse click on certain menu in typical windows menu UI.

In sourceless environment, this ID is an important piece of information to locate the code execution that is related to the menu.

As usual, I will use Omega Tradestation Application as a sample for this demonstration.

Suppose I want to determine the menu ID of “Save EasyLanguage Document” :

One of the difficulty when tries to access menu id in this application is that each time the menu is active, the windows handle ID is of different value, and I can’t “freeze” the submenu objects, because each time when I want to activate other application to probe the property of sub menu windows, it is disappear.

The above issue can be solved by working through static horizontal menu bar down to its submenu when it is activated by mouse clicks.

Using Accessibility Framework to determine the windows procedure for this static menu bar, which is OLE32.DLL’s FrameWndFilterProc, I can then perform break-point to this routine when it handles incoming windows message.

I’ve found that, one of the proper condition to break into this code (using debugger such as WinDBG) when certain menu item is being clicked by user is by trapping to WM_COMMAND (0x111) windows message at the entry of this routine.

The menu id that is active during the mouse click can now be obtained by examining the stack trace after break-point condition described above is reached :

As you can see from the above picture, the third argument to the callee (FrameWndFilterProc) in the stack chain is 0x4562. This is the menu ID for “Save EasyLanguage Document” menu item.

Later on, I’ve also found this menu ID, as well as other ID’s for other menu item is actually part of the resource section of ORPlat.exe file, as shown in the part of decompiled resources using DISASM.EXE for ORPlat.exe file :

Advertisements

One Response to “Determining Active Menu ID on Mouse Click”

  1. buy clonazepam Says:

    Great article! That is the type of information that should be shared across
    the web. Disgrace on the seek engines for now not positioning this put up higher!

    Come on over and visit my website . Thank you =)

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s


%d bloggers like this: