cuPegasus your comment make me thing you did reply in some arrogant way. i never said your way was wrong and it will do the same job.. but i'm always open minded to share knowledge + new ideas![]()
ZaiRoN this is how Dede get the info about the Forms.. and where begins, where Ends..
on 0042F784 (6A00) begin the form of the messageboxa....
look in reverse order with your hex editor, in this case i used HexWorkshop in hex value, look for 84F74200
and you'll find --->
636B110084F742000A466F726D437265
ck....B..FormCreate
means that's the RVA for the begin of that form.....
to kill the form we can change or point the rva of the form/begin to other RVA where indicated other function like exit.. or C3 or something else
with your hex editor you should see something like this also
636B10007CF742000965786974436C69
ck..|.B..exitClick
7CF74200 = 42F77C00 and gives the exit command when you have pressed the Exit button![]()
just change 84F74200 for 9CF74200 and see what happends!
9CF74200 = 42F79C00 (C3) = End/Return of Form
Best Regards!
Bookmarks