[Windows Mobile Apps and Games] flywhc:
I tried IDA pro today.

phcanImages.dll and phcanOverbmp.dll are images resource file.

Opem phcanhtc.dll, enable all options if possible, specify import DLL path to a ROM kitchen.

All DLLs found from Da_G's kitchen.

Look at string/resource table. emm, many logs in plain text, excellent.

Also see some filename like \Windows\Image_BK_Port.png, or resource id like IDB_Speaker_CL. Unfortunately x-ref cannot find the code directly refer to them.

some strings are interesting and linked to code:

rdata:100919F0 aDrawhtcaccum_1 unicode 0, <DrawHTCAccumulator : Draw HTC Accumulator>,0

jump to the code LDR R3, =aDrawhtcaccum_0

after that is BL sub_1006C764, rename it to

HTCPrintLog (1, L".\LargeBtn.cpp", 0x416, L"DrawHTCAccumulator : Draw HTC Accumulator")

...

it must draw Accumulator somewhere close.

actually most of function calls are written for logging.

sub_1006C840 => allocate buffer for logging and there is always a ___V_YAXPAX_Z (delete operator) release that buffer after NKDbgPrintfW.

I guess HTC uses a inefficient macro for logging. rename it to PrintLogInBuffer

PrintLogInBuffer(L"DrawAcc...")

MOV R2, #0x208

MOV R1, #0

ADD R0, SP, #0x218+var_218

BL memset

TCHAR tcsText[0x104]; // var_218 in stack

ZeroMemory(tcsText, 0x104*sizeof(TCHAR));

----------------------------

MOV R2, #0x104

ADD R1, SP, #0x218+var_218

MOV R0, R5

BL GetWindowTextW

GetWindowText(hwnd, tcsText, 0x104); // hwnd is the first parameter of the function.

---------------

....

BL GetParent

CMP R0, #0

MOVNE R1, #1

BLNE sub_1000A668

This function 1000A668 is interesting.

It GetSystemMetrics and setwindowpos and more...

See: BL sub_10017484

LDR R1, =loc_1008B130

IDA cannot recognize loc_1008B130 is a string. go there and click Edit menu->string->unicode.

it is "Software\HTC\Phone\PhoneExtendSetting"

so what is ossvcs_335? RegReadKeyEx and 0x80000002 is HKLM

wonder what is unk_100C9CA8 %1? press D to change it to DWORD. and look at other data nearby. obviously it is a member variable in a VTable (class).

Even one member is refered as LDR PC, [SP], #arg_4, it means it calls member function like pClass->Method4()

in the end it has UpdateWindow and InvalidateRect. that means this function is not for painting. it just updates variables and tells wndproc to repaint screen.

try others:

100AB910 aIncallmainbutt unicode 0, <InCallMainButtonSameSize,portFontHeight(%d),>

jump... wooo, it is a large function, it does:

loadLibrary("phcanrc.dll")

CreateCompatibleDC

LoadString

CreateFontIndirect

SelectObject

GetTextExtentExPointW

...

Looks like draw a button - "In Call Main Button".

It uses phcanrc.dll so let's look at this file:

AvoidSystemIdle 0000000010004CA4 1

CreateVTOpt 00000000100096FC 2

DeleteSBMIntKeyValue 0000000010005B04 3

DeleteVTKeyValue 0000000010004788 4

GetBattery 0000000010004C70 5

GetCFUSettings 0000000010005464 6

GetCSDValue 0000000010004DC4 7

GetCallSession 0000000010005904 8

GetIncomingCallLine 0000000010005514 9

GetLine2Ringtone 00000000100055CC 10

GetMultiLineSettings 00000000100052DC 11

GetPDPSettings 000000001000421C 12

GetPhoneSettings 0000000010003BE4 13

GetPumpkeySettings 00000000100053A0 14

GetSimStatus 0000000010005204 15

GetVTOptSetting 00000000100037E4 16

GetVideoCFSettings 0000000010004330 17

GetVideoCallForwardingStatus 0000000010004FE0 18

IsPowerLow 0000000010003710 19

IsSBMIntRegistered 0000000010005C48 20

IsVTRegistered 0000000010004A90 21

IsVTRegisteredEx 0000000010004B84 22

SBMIntRegister 0000000010005C04 23

SetCSDValue 0000000010004D00 24

SetCallSession 00000000100057E8 25

SetOrientation 00000000100056C8 26

SetVTOptSetting 000000001000349C 27

SetVideoCallForwardingStatus 0000000010004EB4 28

TurnOffLED 0000000010004594 29

TurnOnLED 0000000010005D3C 30

VTRegister 0000000010004A4C 31

fnGetBrightnessPos 0000000010003FD4 32

fnSetBrightnessPos 00000000100040AC 33

start 0000000010009E80

nothing related to UI. we can ignore it.

similarly, smartdialuiext.dll is a COM dll. although its name as "UI" but it doesn't import (use) any UI APIs. it is a extension plugin for smart dialer.

PhoneAdvanced.dll is a property page for advanced phone settings.

So phcanhtc.dll is the one has most stuff we need.

And that DrawInCallMainButton function very possible can give us size information about that button. and maybe sub_10003698, which is DrawControl

and sub_100031D4/sub_10002984, I guess it draws main dialog

see caller of .rdata:100735F0 aCimageCreate_0 unicode 0, <CImage::CreateImageFromFile>

They load images.

CImage::CreateImageFromStream loads from resource file (DLL)

rdata:1008859C aDialerdlgwndpr unicode 0, <DialerDlgWndProc>

rdata:1008C768 aHtcincomingdlg unicode 0, <HTCIncomingDlgWndProc: WM_INITDIALOG>

I am tired. have to sleep now.

good luck