a program which repeats users action

[Eri523]

does anyone know what is that header?
(in this line of code ?

invoke WriteFile,fhandle,addr header,12,addr byteswritten,0

)
and why it is 1246259 only ?
i couldnt find anything on MSDN , i would appreciate if anyone can help me out .

I don't have the slightest idea. I was assuming you had invented that yourself and so know what it's for. If not, where did you get it from (apparently not MSDN)? Doesn't that source explain it?

Note that you're not "only" writing that value which appears to be a file type signature: Youre writing 12 bytes which comprises the variables header, time and msgnbr.

Also, you're writing the header to the file but I don't see any reference to it in the context of reading. I don't know your program well enough to tell whether that might be problematic, though.

[Master.]

I don't have the slightest idea. I was assuming you had invented that yourself and so know what it's for. If not, where did you get it from (apparently not MSDN)? Doesn't that source explain it?

Note that you're not "only" writing that value which appears to be a file type signature: Youre writing 12 bytes which comprises the variables header, time and msgnbr.

Also, you're writing the header to the file but I don't see any reference to it in the context of reading. I don't know your program well enough to tell whether that might be problematic, though.

i didnt ! i just modified the code to suite my needs !
i downloaded it form here :
http://win32assembly.online.fr/source2.html
i attached the whole Original Program! before!( i re attached it again ) ,
for reading it uses oheader ! i wonder where or when this variable gets filled!! ?

[Eri523]

i attached the whole Original Program! before!( i re attached it again ) ,

Ah, this one. I still have it on my HD.

for reading it uses oheader ! i wonder where or when this variable gets filled!! ?

The program reads the first 12 bytes of the input file (the variables oheader, otime and omsgnbr) and compares oheader to the immediate value 1246259:

;-------------------------------------------------------------------------
; play button is pressed...
;_________________________________________________________________________   
.IF         ax == IDC_P_PLAY
.IF         hookflag == 0
            mov stopflag,0
            mov sleepflag,0
            mov lasttime,0
            invoke GetDlgItemText,hWnd,IDC_P_EDIT,addr playfilename,sizeof playfilename
            invoke CreateFile,addr playfilename,GENERIC_READ,0,+\
            NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0
            
.IF         eax != INVALID_HANDLE_VALUE
            mov fhandle,eax
            invoke ReadFile,fhandle,addr oheader,12,addr byteswritten,0                        
.IF         oheader == 1246259
            invoke CloseWindow,hWnd
            invoke SetWindowsHookEx,WH_JOURNALPLAYBACK,addr PlaybckProc,NULL,0  
            mov hhandle,eax   
.ELSE
            invoke CloseHandle,fhandle
            invoke MessageBox,hWnd,addr msg1,addr caption,MB_OK
.ENDIF               
.ELSE
            invoke MessageBox,hWnd,addr msg2,addr caption,MB_OK
.ENDIF            
.ENDIF

If the comparison fails, the file is considered invalid.

The reason why the comparison is done against an immediate value here instead of the actual header which would be more illustrative (and safer when maintaining the program) is most likely brevity: The CMP instruction to which that .IF eventually gets translated doesn't allow to directly compare two memory locations, so a comparison to header would have needed two instructioons.

header is a constant that is filled by loading the program into memory and never written to later. It is used to be written to the output file as the file type signature, along with the two variables following it in memory.

[Master.]

thanks a million Eri523
and about that 12byte ! could it be for this ? :
http://publib.boulder.ibm.com/infoce...ha3c00316.html

if yes, why did he used 12? and not for example 14, or 16?
(i wonder if i looked in a relevant place !)

[Eri523]

and about that 12byte ! could it be for this ? :
http://publib.boulder.ibm.com/infoce...ha3c00316.html

Not really. The record described there practically consists only of variable fields, while the header field we're talking about here is rather a magic number. Unlike at least most of which is described in that article, it doesn't translate into readable ASCII text, though. (Note that although many magic numbers used in popular file formats do translate into readable ASCII, of course this isn't essential for the functionality.)

if yes, why did he used 12? and not for example 14, or 16?
(i wonder if i looked in a relevant place !)

Actually, only the constant DOWRD (i.e. 4 bytes) header is the magic number. The other 8 bytes are the variables time and msgnbr which seem to be part of the file header, yet are just this: variable. I haven't examined the program close enough to tell what they're used for when reading back in the file later.

[Master.]

thank you Eri523
you are indeed a great help to me
God bless you man
by the way i called the original author ( yeah after 12 years ) ) and asked him about the header and that magic number , he kindly replied:
" i was a kid when i wrote that, and now i have no idea what that number stood for and ... : ) "
so i think , this remains still a secret )