[ExtractStream] Released: TyTool alpha #1.

[Don Starr]

The EM_REPLACESEL message really uses -1 as the LPARAM (forgot about
the sign extension when pushing an 8- or 16-bit immediate operand). So
the whole function is just a printf() to the end of a window's text.
In this case, the window is the edit control that appears to be used
for message output (I don't know, since I've never run the app).

BTW: who needs stinkin' debug symbols :)


-----Original Message-----
From: Don Starr [mailto:don@s...]
Sent:	Monday, May 27, 2002 12:05 PM
To:	ExtractStream@yahoogroups.com
Subject:	RE: [ExtractStream] Released: TyTool alpha #1.

It's a call to wvsprintf (in USER32.DLL) from TyTool.exe offset
0x00405168. It's the SECOND call from this location in TyTool. The
first call passes "Ready...<cr><lf>" as the format string. The second
call passes NULL as the format string.

. . . time passes . . .

After a little more investigation, it appears there's a function like
the following:

void func( HWND wnd, const char *fmtString, ... )
{
char buffer[1024];
int len = SendMessage( wnd, WM_GETTEXTLENGTH, WPARAM(0),
LPARAM(0) );
va_list args;
va_start( args, fmtString );
wvsprintf( buffer, fmtString, args );
SendMessage( wnd, EM_SETSEL, WPARAM(len), LPARAM(0xFF) );
SendMessage( wnd, EM_REPLACESEL, 0, buffer );
va_end( args );
}

This function is called twice. In both cases, the HWND is an edit
control in the "Tivo Client" dialog. The first call passes
"Ready...<cr><lf>" in <fmtString>. The second call passes NULL,
blowing up wvsprintf().

The edit control is the read-only, multiline control with ID 1005.

-Don