Check if cursor is hovering over control (ASM)

[[Beatrice]]

Hi, with this udf you can check if a control is being hovered. The whole point of this function is that it runs in a separate thread. You need to set a variable to get a return from this function and it will simply set that to 0-1.

Code:

 Spoiler

Func ControlIsHovered($hHandle,$hWnd,$idControl,$dwHoveringAddress, $iSleep = 5)
	$hKernel32 = _WinAPI_GetModuleHandle("Kernel32.dll")
	$hUser32 = _WinAPI_GetModuleHandle("User32.dll")
	$dwKernel32Sleep = _WinAPI_GetProcAddress($hKernel32, "Sleep")
	$dwUser32GetForegroundWindow = _WinAPI_GetProcAddress($hUser32, "GetForegroundWindow")
	$dwUser32GetWindowRect = _WinAPI_GetProcAddress($hUser32, "GetWindowRect")
	$dwUser32GetPhysicalCursorPos = _WinAPI_GetProcAddress($hUser32, "GetPhysicalCursorPos")
	$dwPage = "0x" & Hex(VirtualAllocEx($hHandle,0,0x128,0x3000,0x40),8)
	$dwButtonPos = "0x" & Hex(VirtualAllocEx($hHandle,0,0x16,0x3000,0x40),8)
	$dwWindowPos = "0x" & Hex(VirtualAllocEx($hHandle,0,0x16,0x3000,0x40),8)
	$dwCursorPos = "0x" & Hex(VirtualAllocEx($hHandle,0,0x16,0x3000,0x40),8)
	$aControlPosition = ControlGetPos($hWnd,"",$idControl)
	$aWindowPosition = WinGetPos($Form1)
	$aClientSize = WinGetClientSize($Form1)
	$iBarSize = $aWindowPosition[3] - $aClientSize[1]
	$aControlPosition[1] = $aControlPosition[1] + $iBarSize
	$sBytes = Calculate($dwPage, _
	"0xC705-" & $dwHoveringAddress & "-00000000" _ ; mov dword ptr [$dwHoveringAddress],0
	& "6A" & Hex($iSleep,2) _ ; push xx
	& "E8|" & $dwKernel32Sleep & "|" _  ; call Kernel32.Sleep
	& "BE-" & Hex($hWnd,8) & "-" _ ; mov esi, hWnd
	& "E8|" & $dwUser32GetForegroundWindow & "|" _ ; call User32.GetForegroundWindow
	& "39F0"  _ ; cmp eax,esi
	& "75E1" _ ; jne dwPage
	& "BB-" & $dwWindowPos & "-" _ ; mov ebx,$dwWindowPos
	& "53" _ ; push ebx
	& "56" _ ; push esi
	& "E8|" & $dwUser32GetWindowRect & "|" _ ; call User32.GetWindowRect
	& "A1-" & $dwButtonPos & "-" _ ; mov eax, [$dwButtonPos]
	& "0103" _ ; add [ebx],eax
	& "8B03" _ ; mov eax,[ebx]
	& "0305-" & Hex($dwButtonPos+0x8,8) & "-" _ ; add eax, [$dwButtonPos+8]
	& "894308" _ ; mov [ebx+08],eax
	& "A1-" & Hex($dwButtonPos+0x4,8) & "-" _ ; add eax, [$dwButtonPos+4]
	& "014304" _ ; add [ebx+04],eax
	& "8B4304" _ ; mov eax,[ebx+04]
	& "0305-" & Hex($dwButtonPos+0xC,8) & "-" _ ; add eax, [$dwButtonPos+C]
	& "89430C" _ ; mov [ebx+0C],eax
	& "BE-" & $dwCursorPos & "-" _ ; mov esi, $dwCursorPos
	& "56" _ ; push esi
	& "E8|" & $dwUser32GetPhysicalCursorPos & "|" _ ; call User32.GetPhysicalCursorPos
	& "8B7E04" _ ; mov edi,[esi+04]
	& "8B36" _ ; mov esi,[esi]
	& "3B33" _ ; cmp esi,[ebx]
	& "729B" _ ; jb dwPage
	& "3B7B04" _ ; cmp edi,[ebx+04]
	& "7296" _ ; jb dwPage
	& "3B7308" _ ; cmp esi,[ebx+08]
	& "7791" _ ; ja dwPage
	& "3B7B0C" _ ; cmp edi,[ebx+0C]
	& "778C" _ ; ja dwPage
	& "C705-" & $dwHoveringAddress & "-01000000" _ ; mov dword ptr [$dwHoveringAddress], 1
	& "EB8A") ; jmp dwPage+0xA

	WriteProcessMemory($hHandle,$dwPage,"0x" & $sBytes,"Byte[" & StringLen($sBytes)/2 & "]")

	For $i = 0 To 3
		WriteProcessMemory($hHandle,$dwButtonPos+($i*4),$aControlPosition[$i],"dword")
	Next
	$hThread = CreateRemoteThread($hHandle,$dwPage)
	Return $hThread
EndFunc

To stop the function you can simply call TerminateThread and clear the page with VirtualFree.

Example and library is attached.
Libraries used:
by @buFFy!
by me
by me