Before I talk about what subclassing actually is, I have to explain a little bit about how Windows works. Windows has the ability to send messages to eachother using the SendMessage() API function. These messages give the program important information, such as if the mouse cursor is on your program, whether it has focus or not, and when the little X on the title bar is clicked. Subclassing is another way that hackers can steal the password behind password boxes (the text boxes with **********). While I can't go into how to do that on Trap17 without getting warned for exploiting stuff, subclassing is an important thing to learn for security purposes.

Each program has a procedure that handles messages, for the majority of languages, like VB you don't have to write this code out. For Win32 assembly you do. Subclassing is the act of replacing the address of that procedure with the address of your procedure.

Subclassing procedures follow this pattern:

1. Get the message by using the GetMessage() API function.
2. Check what the message is.
3. If you want to do something for it, write the code, and then exit the function
4. If your message doesn't relate to your procedure, return the message to the original message handler. If not your program can crash.

One more important note about subclassing, make sure you return control to the original procedure before your program exits!!!! If not you can cause your system to crash and you will need to reboot.

I'll be writing a tutorial on how to do this soon, using VB.

 

 

 

Reply