What we need to build a patch, we will draw we will live

A tale of harsh Russian engineers.

1. How it all began ...

Angels and demons circled above me

Cut the thorns and the Milky Way

Origa - Inner Universe

In one, not very domestic CAD, it is possible to convert drawings directly to PDF. But either programmers do not really understand how their CAD is used, or they simply forgot to add the ability to save settings. As a result, CAD, when exporting to PDF, always converts only the "current sheet", unless you go into the parameters and forcibly select "All sheets". In our engineering business, single-sheet documents are extremely rare, people suffer and continue to upload, send, generate and just waste processor power on single-sheet PDFs from time to time. On a languid Friday nightsipping blended whiskey and smoking a cigar, I wondered - is there anything you can do about it?

Figure 1. PDF settings window.

2. ... and how it could have ended

— . , . , , PDF .

, — . HKEY_LOCAL_MACHINE\SOFTWARE\ ( HKEY_CURRENT_USER) , . . , , - , .

— . , config.ini, settings.xml . .

3. Just Do It!

-

-

— -

, IT-. , . , " ", . , "Options", "1,1,2,3,1,0,1" , , . : " ?" " ?"

, — Sysinternals — Process Monitor(procmon).

2. Process Monitor

, , .. Procmon , windows - , 10-20 . , — . , , , "", … — "" 700+ . . , 19:46:29,4265774, — ( ) 1391,790…1,0,0.

"! !" — , , 1 0 , .

"!" — , , - , , .

. . — .

, , , , - , … , — " …". , , , . .

, , 20 000? , ( , ), , . , , (10^9)…

. " ". , . . … … "DPI". , , "400 DPI" ( ). . () - , …

TotalCommader > > *.* c "400 DPI". … . , , , , HEX- (, ). — :

imgUI.dll ( )

! ? . DLL — , , -:

3. DLL

--… , imgUI.dll img.dll imgUtils.dll. -- . , , , Rusians (, s) — imgRes.dll imgUIRes.dll. :

• imgUI.dll — UI, — "User Interface", "400 DPI". — .
• imgUIRes.dll — ,
• imgUtils.dll — , pdf, (?)
• img.dll — , , .
• imgRes.dll — ??? img.dll ???

4.We need to go deeper ( )

All in all it was just a brick in the wall.

All in all it was just the bricks in the wall.

Pink Floyd — Another Brick In the Wall (Part 2)

.

, : , res-… . ArtMoney Restorator. — res- , , ( ) .

— res- ( ++- ).

imgRes.dll , imgUIRes.dll .

! — , — … … - … … , , ?

. Res- , , , , , — ! — " " , !

, , .

>>>OK>. . "-" , .

4. .

. -, -, , . ( , ). -, ID , . ( — ID):

5. ID Res-.

, - , , " ", .

— , ? , , , , - .

5.!

Run rabbit run

Dig that hole, forget the sun,

And when at last the work is done

Don't sit down it's time to dig another one

Pink Floyd — Breathe

10 , , - , - , . , , - DES, AES , — , . , . - HEX, ASM, IDA.

, (freeware, ). Ollydbg , .. 64 . Microsoft Debugger — , IDA .

, :

• ID ( 1001 1014)
• "400 DPI"

… , , imgUI.dll. ? -, "400 DPI" , -, .

DLL IDA , , 302A79452F5C:

6. IDA.

? , 1. 2. -, - -. "TextView" , — , 800+ sub_18…, , , — ?, , !?

, , - (PowerShell VBA), , , , .

, — " , ". — radiobutton ID 1004\1005. …-- . , IDA . , , " " 1004 3ECh HEX (h ). — , 3 2 . , ID 1005 (3EDh) . :

7. ID 1005

, … , , . , " " " ", " ", " ". — IDA . - . , — "" , — . , -. , , ( ), "" - . mov edx, 3EC - :

BA EC 03 00 0  

mov edx, 3ED :

BA ED 03 00 00

, , EC ED ! DLL , "", , … > … !!! PDF-, … ! ! , !

, , , , . , , , .

6. Hardcore hardcore

, ,

.

— , , , — .

, , — "", , PDF 1 . .. — PDF', , .

8.

? , !

"just for fun" imgUtils.dll. , imgUI.dll, — : OptionsPDFExport::SetResol, OptionsPDFExport::SetBW, OptionsPDFExport::GetStartSheet . ! ! , .. - :

mov     [rcx+15h], dl  
Retn

.. , DL rcx ( ?) … dl? rcx? , - GetBW rcx+15h 1 ( 0, )?

— . . . — ( ) , 99 , , 100 , .. … . (, , ).

mov rcx+15h, dl. - :

88 51 14

mov rcx+15h, 1, :

C7 81 14 00 00 00 01 00 00 00

.. 14 . ( — -- -, 86-64, ).

. - .

, … . .

? - ? , . — - PDF .

API Monitor v2. "" imgUtils.dll imgUI.dll… , 233 . , .

GetBW\SetBW\GetStartSheet , , .. .

- OptionsXPSExport. … , PDF', - ? Get' Set'

. , 300 . — ? ID — , "400 DPI".

400 16- , 190h. … 1 :

9. .

— , ? ! ! , 190h 96h ( 150). > PDF> … 400 DPI 150 DPI. ! — "" . — 300 , .

, ? r12 r13? :

10. R2D2.

r12 , r13 , , .. xor, mov. xor mov, .

, , rbp+330h 0, 32h - 1.

, — (1) (0).

, . " " , — . — .

r13b r12b [rbp+326h], , mov . mov . . . . — .

1 0, . - — , . — , 10-20 -.

— " ? 5 7 ?" , 0FFFFFFh "", "".

— mov rpb+314, r12 . 0, 1! ? , . , 1 0 . , — mov rpb+314 r12 mov rpb+314 r13 … … " " !

, , . 14 .

. 0 — , 1 — , 2.

, — mov rpb+314 r12 mov rpb+314 00002h

, :

11. 24.

.. eax , mov rpb+314 eax mov rpb+314 r12!

— ? . , :

• ( )
• ( )
• nop —
• …. , .

— NOP, .. - NOP "90".

… , . PDF. :

11. PDF.

7.

We've come too far to give up who we are

So let's raise the bar and our cups to the stars

Daft Punk — Get Lucky

, , . , . " ", JMP' , , , - .

It's a little offensive that this knowledge will never go into "production", and engineers will continue to suffer because of a couple of programmers, but C'est La Vie, that's the license agreement.

Hopefully this post can inspire someone to improve working tools, even if you are a design engineer and are quite far from reverse engineering.