search

DarkShadow44 / UIRibbon-Reversing

My try at reverse engineering the binary resource format used by the Ribbon Framework (UIRibbon.dll)
10 stars 0 forks source link

Maybe we can collaborate #2

Open rikka0w0 opened 4 years ago

rikka0w0 commented 4 years ago

I'm doing a similar work. One of the limitation of the Win32 Ribbon Framework is that it does not support adding buttons/commands during runtime. My goal was to modify the ribbon UI of some existing application (e.g. Windows Explorer) by hooking the LoadUI and LoadResource WIN32 API then patching the binary resource.

https://github.com/rikka0w0/UICC_BML_Parser

Currently the structure of the file is known, but the meaning of some property fields remain unknown. Maybe we can collaborate!

DarkShadow44 commented 4 years ago

Sure thing! Are you familiar with kaitai struct? IMHO that's the easiest way to document the structure, and as you might have noticed, I use that to generate a parser.

Out of curiosity, did you do your your analysis from scratch or base it on mine? Fresh insights are always welcome!

rikka0w0 commented 4 years ago

I started my analysis from scratch. I wrote my own xml files, compiled them with UICC.exe and observe the difference in the binary output file. Then I wrote my parser and did tests on the ribbon resource file from MSPaint, WordPad and ExplorerFrame.dll. This should be good enough to cover most possible/common cases. The meaning of some property fields (binary) cannot be easily understood. I use IDA to peek the internal algorithms of the uicc.dll, some binary data start to make sense, but most still remain unknown. Finally I just wanted to confirm if there's a WINE implementation of the UIRibbon.dll or UICC.exe, so I googled it, I didn't find the implementation but your project /w\

I have never used kaitai before, but today after few hours of reading, I found it pretty straight-forward. It could save tons of time for me. Descriptive is much better than hardcoding /w\ I think it time for me to migrate to the kaitai struct /w\

rikka0w0 commented 4 years ago

I think the application_views section should have a tree-like structure. Sections starts with 0x16 are called "Nodes", Sections starts with 0x18 are called "Collections", there are also "Properties" (0x01), "Arrays"(0x3B) and "Pointers"(0x3E). Nodes can contain all the other elements. Collections can have nodes or arrays as child element, but not at the same time. Arrays seems to be a list of some property-data pairs. Pointers point to some location within the binary file.

You may have seen a lot of "18 01 3E XX XX" stuff in the binary file. The outcome of IDA reverse-engineering indicates that the third byte is the type of this collection:

FooterItems 0x49
MRUItems 0x48
Items 0x3E
rikka0w0 commented 4 years ago

EXPLORER_RIBBON.zip

DarkShadow44 commented 4 years ago

I wrote my own xml files, compiled them with UICC.exe and observe the difference in the binary output file.

Yes, that's how I did it as well.

I use IDA to peek the internal algorithms of the uicc.dll, some binary data start to make sense, but most still remain unknown.

That's against Wine cleanroom rules, so I can't do that. Since you're not working on Wine that doesn't apply to you, but please don't post details found by disassembled code, since I won't be able to use them.

I agree that my parsing structure is not perfect yet though, I'll see if I can improve that.

DarkShadow44 commented 4 years ago

FWIW, I reworked the parsing, and should now have a proper tree structure. Only have a few unknowns left, but all my tests do still pass.

Yvonne5531773 commented 2 years ago

Hi all, I'm trying to change win32 explorer ribbon background, do you have any suggestions? (e.g. hook)?

Yvonne5531773 commented 2 years ago

I'm doing a similar work. One of the limitation of the Win32 Ribbon Framework is that it does not support adding buttons/commands during runtime. My goal was to modify the ribbon UI of some existing application (e.g. Windows Explorer) by hooking the LoadUI and LoadResource WIN32 API then patching the binary resource.

https://github.com/rikka0w0/UICC_BML_Parser

Currently the structure of the file is known, but the meaning of some property fields remain unknown. Maybe we can collaborate!

Hi rikka0w0, do you have any suggestions for the win32 explorer Ribbon hook? Thanks~

DarkShadow44 commented 2 years ago

Hi all, I'm trying to change win32 explorer ribbon background, do you have any suggestions? (e.g. hook)?

That's not something that is stored in the ribbon markup, so I'm afraid we won't be able to change that.

Yvonne5531773 commented 2 years ago

Hi all, I'm trying to change win32 explorer ribbon background, do you have any suggestions? (e.g. hook)?

That's not something that is stored in the ribbon markup, so I'm afraid we won't be able to change that.

Thanks for your reply, I will try hard. But I want to know why switch system from bright to dark, the ribbon background color changing from white to black.