Trouble with Tabs

[SaintedRogue]

I am having trouble with Tabs in my code. I create tabs, and each tab has a series of check boxes or labels read from a file. However, the first tab doesn't show anything until you click into the other tab and then click back into it.

Any ideas on how to fix this issue?

Code is a bit hard to post because I'm basically writing a GUI for a different tool and it needs specific set of files to run and then read from.

Any help would be appreciated.

Kind Regards

[BrewManNH]

Create a small script that reproduces the problem, because there's no way to tell you what is happening in your code if we can't see how you're doing it. We can make some educated guesses, but that's all they'd be.

[SaintedRogue]

That's kind of the trouble... the same, seemingly, same implementation works. However, for this it does not. My code is below for my implementation.

expandcollapse popup

VolGUI()

Func VolGUI()

$imgpath = FileOpenDialog("Location of Memory Dump", @MyDocumentsDir, "Image Files (*.img)")

GUICreate("Volatility", 250, 50)

$processmsg = GUICtrlCreateLabel("Processing Memory Image Info", 60, 20)

GUISetState()

$GUIimginfo = RunWait('cmd /c ' & @ScriptDir & 'vol.exe -f ' & $imgpath & ' imageinfo > ' & @ScriptDir & 'ImageInfo.txt', "", @SW_HIDE)

GUIDelete()

GUICreate("Volatility Frontend", 800, 400)

$filemenu = GUICtrlCreateMenu("File")

$fmexit = GUICtrlCreateMenuItem("Exit", $filemenu)

$helpmenu = GUICtrlCreateMenu("Help")

$hmdoc = GUICtrlCreateMenuItem("Documenation", $helpmenu)

$hmabout = GUICtrlCreateMenuItem("About", $helpmenu)

$close = GUICtrlCreateButton("Close", 762, 350)

$img = GUICtrlCreateInput($imgpath, 5, 8, 500, 22)

$profile = GUICtrlCreateInput("Profile Settings", 595, 8, 200, 22)

$voltab = GUICtrlCreateTab(5, 35, 792, 315)

$imgidtab = GUICtrlCreateTabItem("Image ID")

$iiFile = FileOpen(@ScriptDir & 'ImageInfo.txt')

$H = 70

For $i = 3 to 14 Step 1
$iiString = FileReadLine($iiFile, $i)
$imgString = StringStripWS($iiString, 1)
$gui_imgid = GUICtrlCreateLabel($imgString, 30, $H)
$H = $H + 20
Next

$processtab = GUICtrlCreateTabItem("Processes and DLLs")

$gui_pslist = GUICtrlCreateCheckbox("pslist", 15, 70)
$guih_pslist = GUICtrlSetTip($gui_pslist, "Print active processes by following the _EPROCESS list")

$gui_pstree = GUICtrlCreateCheckbox("pstree", 15, 90)
$guih_pstree = GUICtrlSetTip($gui_pstree, "Print process list as a tree")

$gui_psscan = GUICtrlCreateCheckbox("psscan", 15, 110)
$guih_psscan = GUICtrlSetTip($gui_psscan, "Scan Physical memory for _EPROCESS pool allocations")

$gui_psdispscan = GUICtrlCreateCheckbox("psdispscan", 15, 130)
$guih_psdispscan = GUICtrlSetTip($gui_psdispscan, "Scan Physical memory for _EPROCESS objects based on Dispatch Headers (Windows XP x86 only)")

$gui_dlllist = GUICtrlCreateCheckbox("dlllist", 15, 150)
$guih_dlllist = GUICtrlSetTip($gui_dlllist, "Print list of loaded DLLs for each process")

$gui_dlldump = GUICtrlCreateCheckbox("dlldump", 15, 170)
$guih_dlldump = GUICtrlSetTip($gui_dlldump, "Dump DLLs from a process address space")

$gui_handles = GUICtrlCreateCheckbox("handles", 15, 190)
$guih_handles = GUICtrlSetTip($gui_handles, "Print list of open handles for each process")

$gui_getsids = GUICtrlCreateCheckbox("getsids", 15, 210)
$guih_getsids = GUICtrlSetTip($gui_getsids, "Print the SIDs owning each process")

$gui_verinfo = GUICtrlCreateCheckbox("verinfo", 15, 230)
$guih_verinfo = GUICtrlSetTip($gui_verinfo, "Print a PE file's version information")

$gui_enumfunc = GUICtrlCreateCheckbox("enumfunc", 15, 250)
$guih_enumfunc = GUICtrlSetTip($gui_enumfunc, "Enumerate a PE file's imports and exports")

$gui_envars = GUICtrlCreateCheckbox("envars", 15, 270)
$guih_envars = GUICtrlSetTip($gui_envars, "Display process environment variables")

$gui_cmdscan = GUICtrlCreateCheckbox("cmdscan", 15, 290)
$guih_cmdscan = GUICtrlSetTip($gui_cmdscan, "Extract command history by scanning for _COMMAND_HISTORY")

$gui_consoles = GUICtrlCreateCheckbox("consoles", 15, 310)
$guih_consoles = GUICtrlSetTip($gui_consoles, "Extract command history by scanning for _CONSOLE_INFORMATION")

$procmemtab = GUICtrlCreateTabItem("Process Memory")

$gui_memmap = GUICtrlCreateCheckbox("memmap", 15, 70)
$guih_memmap = GUICtrlSetTip($gui_memmap, "Print the memory map")

$gui_memdump = GUICtrlCreateCheckbox("memdump", 15, 90)
$guih_memdump = GUICtrlSetTip($gui_memdump, "Dump the addressable memory for a process")

$gui_procexedump = GUICtrlCreateCheckbox("procexedump", 15, 110)
$guhprocexedump = GUICtrlSetTip($gui_procexedump, "Dump a process to an executable file")

$gui_procmemdump = GUICtrlCreateCheckbox("procmemdump", 15, 130)
$guih_procmemdump = GUICtrlSetTip($gui_procmemdump, "Dump a process to an executable memory sample")

$gui_vadwalk = GUICtrlCreateCheckbox("vadwalk", 15, 150)
$guih_vadwalk = GUICtrlSetTip($gui_vadwalk, "Walk the VAD tree")

$gui_vadtree = GUICtrlCreateCheckbox("vadtree", 15, 170)
$guih_vadtree = GUICtrlSetTip($gui_vadtree, "Walk the VAD tree and display in tree format")

$gui_vadinfo = GUICtrlCreateCheckbox("vadinfo", 15, 190)
$guih_vadinfo = GUICtrlSetTip($gui_vadinfo, "Dump the VAD info")

$gui_vaddump = GUICtrlCreateCheckbox("vaddump", 15, 210)
$guih_vaddump = GUICtrlSetTip($gui_vaddump, "Dumps out the vad sections to a file")

$gui_evtlogs = GUICtrlCreateCheckbox("evtlogs", 15, 230)
$guih_evtlogs = GUICtrlSetTip($gui_evtlogs, "Parse XP and 2003 event logs from memory")

$kerntab = GUICtrlCreateTabItem("Kernel Memory and Objects")

$gui_modules = GUICtrlCreateCheckbox("modules", 15, 70)
$guih_modules = GUICtrlSetTip($gui_modules, "Print list of loaded modules")

$gui_modscan = GUICtrlCreateCheckbox("modscan", 15, 90)
$guih_modscan = GUICtrlSetTip($gui_modscan, "Scan Physical memory for _LDR_DATA_TABLE_ENTRY objects")

$gui_moddump = GUICtrlCreateCheckbox("moddump", 15, 110)
$guih_moddump = GUICtrlSetTip($gui_moddump, "Extract a kernel driver to disk")

$gui_ssdt = GUICtrlCreateCheckbox("ssdt", 15, 130)
$guih_ssdt = GUICtrlSetTip($gui_ssdt, "Print the Native and GDI System Service Descriptor Tables")

$gui_driverscan = GUICtrlCreateCheckbox("driverscan", 15, 150)
$guih_driverscan = GUICtrlSetTip($gui_driverscan, "Scan physical memory for _DRIVER_OBJECT objects")

$gui_filescan = GUICtrlCreateCheckbox("filescan", 15, 170)
$guih_filescan = GUICtrlSetTip($gui_filescan, "Scan physical memory for _FILE_OBJECT objects")

$gui_mutantscan = GUICtrlCreateCheckbox("mutantscan", 15, 190)
$guih_mutantscan = GUICtrlSetTip($gui_mutantscan, "Scan physical memory for _KMUTANT objects")

$gui_symlinkscan = GUICtrlCreateCheckbox("symlinkscan", 15, 210)
$guih_symlinkscan = GUICtrlSetTip($gui_symlinkscan, "Scans for symbolic link objects")

$gui_thrdscan = GUICtrlCreateCheckbox("thrdscan", 15, 230)
$guih_thrdscan = GUICtrlSetTip($gui_thrdscan, "Scan physical memory for _ETHREAD objects")

$nettab = GUICtrlCreateTabItem("Networking")

$gui_connections = GUICtrlCreateCheckbox("connections", 15, 70)
$guih_connections = GUICtrlSetTip($gui_connections, "Print open connections (XP and 2003 only)")

$gui_connscan = GUICtrlCreateCheckbox("connscan", 15, 90)
$guih_connscan = GUICtrlSetTip($gui_connscan, "Scan Physical memory for _TCPT_OBJECT objects (XP and 2003 only)")

$gui_sockets = GUICtrlCreateCheckbox("sockets", 15, 110)
$guih_sockets = GUICtrlSetTip($gui_sockets, "Print open sockets (XP and 2003 only)")

$gui_sockscan = GUICtrlCreateCheckbox("sockscan", 15, 130)
$guih_sockscan = GUICtrlSetTip($gui_sockscan, "Scan Physical memory for _ADDRESS_OBJECT (XP and 2003 only)")

$gui_netscan = GUICtrlCreateCheckbox("netscan", 15, 150)
$guih_netscan = GUICtrlSetTip($gui_netscan, "Scan physical memory for network objects (Vista, 2008, and 7)")

$regtab = GUICtrlCreateTabItem("Registry")

$gui_hivescan = GUICtrlCreateCheckbox("hivescan", 15, 70)
$guih_hivescan = GUICtrlSetTip($gui_hivescan, "Scan Physical memory for _CMHIVE objects")

$gui_hivelist = GUICtrlCreateCheckbox("hivelist", 15, 90)
$guih_hivelist = GUICtrlSetTip($gui_hivelist, "Print list of registry hives")

$gui_printkey = GUICtrlCreateCheckbox("printkey", 15, 110)
$guih_printkey = GUICtrlSetTip($gui_printkey, "Print a registry key, and its subkeys and values")

$gui_hivedump = GUICtrlCreateCheckbox("hivedump", 15, 130)
$guih_hivedump = GUICtrlSetTip($gui_hivedump, "Recursively prints all keys and timestamps in a given hive")

$gui_hashdump = GUICtrlCreateCheckbox("hashdump", 15, 150)
$guih_hashdump = GUICtrlSetTip($gui_hashdump, "Dumps passwords hashes (LM/NTLM) from memory (x86 only)")

$gui_lsadump = GUICtrlCreateCheckbox("lsadump", 15, 170)
$guih_lsadump = GUICtrlSetTip($gui_lsadump, "Dump (decrypted) LSA secrets from the registry (XP and 2003 x86 only)")

$gui_userassist = GUICtrlCreateCheckbox("userassist", 15, 190)
$guih_userassist = GUICtrlSetTip($gui_userassist, "Parses and output User Assist keys from the registry")

$gui_shimcache = GUICtrlCreateCheckbox("shimcache", 15, 210)
$guih_shimcache = GUICtrlSetTip($gui_shimcache, "Parses the Application Compatibility Shim Cache registry key")

$gui_getservicesids = GUICtrlCreateCheckbox("getserviceids", 15, 230)
$guih_getserviceids = GUICtrlSetTip($gui_getservicesids, "Calculate SIDs for windows services in the registry")

$maltab = GUICtrlCreateTabItem("Malware")

$gui_malfind = GUICtrlCreateCheckbox("malfind", 15, 70)
$guih_malfind = GUICtrlSetTip($gui_malfind, "Find hidden and injected code")

$gui_svcscan = GUICtrlCreateCheckbox("svcscan", 15, 90)
$guih_svcscan = GUICtrlSetTip($gui_svcscan, "Scan for Windows services")

$gui_ldrmodules = GUICtrlCreateCheckbox("ldrmodules", 15, 110)
$guih_ldrmodules = GUICtrlSetTip($gui_ldrmodules, "Detect unlinked DLLs")

$gui_impscan = GUICtrlCreateCheckbox("impscan", 15, 130)
$guih_impscan = GUICtrlSetTip($gui_impscan, "Scan for calls to imported functions")

$gui_apihooks = GUICtrlCreateCheckbox("apihooks", 15, 150)
$guih_apihooks = GUICtrlSetTip($gui_apihooks, "Detect API hooks in process and kernel memory (x86 only)")

$gui_idt = GUICtrlCreateCheckbox("idt", 15, 170)
$guih_idt = GUICtrlSetTip($gui_idt, "Dumps the Interrupt Descriptor Table (x86 only)")

$gui_gdt = GUICtrlCreateCheckbox("gdt", 15, 190)
$guih_gdt = GUICtrlSetTip($gui_gdt, "Dumps the Global Descriptor Table (x86 only)")

$gui_threads = GUICtrlCreateCheckbox("threads", 15, 210)
$guih_threads = GUICtrlSetTip($gui_threads, "Investigate _ETHREAD and _KTHREADs")

$gui_callbacks = GUICtrlCreateCheckbox("callbacks", 15, 230)
$guih_callbacks = GUICtrlSetTip($gui_callbacks, "Print system-wide notification routines (x86 only)")

$gui_driverirp = GUICtrlCreateCheckbox("driverirp", 15, 250)
$guih_driverirp = GUICtrlSetTip($gui_driverirp, "Driver IRP hook detection")

$gui_devicetree = GUICtrlCreateCheckbox("devicetree", 15, 270)
$guih_devicetree = GUICtrlSetTip($gui_devicetree, "Show device tree")

$gui_psxview = GUICtrlCreateCheckbox("psxview", 15, 290)
$guih_psxview = GUICtrlSetTip($gui_psxview, "Find hidden processes with various process listings")

$gui_timers = GUICtrlCreateCheckbox("timers", 15, 310)
$guih_timers = GUICtrlSetTip($gui_timers, "Print kernel timers and associated module DPCs (x86 only)")

$guitab = GUICtrlCreateTabItem("Win32k/GUI Memory")

$gui_sessions = GUICtrlCreateCheckbox("sessions", 15, 70)
$guih_sessions = GUICtrlSetTip($gui_sessions, "List details on _MM_SESSION_SPACE (user logon sessions)")

$gui_wndscan = GUICtrlCreateCheckbox("wndscan", 15, 90)
$guih_wndscan = GUICtrlSetTip($gui_wndscan, "Pool scanner for tagWINDOWSTATION (window stations)")

$gui_deskscan = GUICtrlCreateCheckbox("deskscan", 15, 110)
$guih_deskscan = GUICtrlSetTip($gui_deskscan, "Poolscaner for tagDESKTOP (desktops)")

$gui_atomscan = GUICtrlCreateCheckbox("atomscan", 15, 130)
$guih_atomscan = GUICtrlSetTip($gui_atomscan, "Pool scanner for _RTL_ATOM_TABLE")

$gui_atoms = GUICtrlCreateCheckbox("atoms", 15, 150)
$guih_atoms = GUICtrlSetTip($gui_atoms, "Print session and window station atom tables")

$gui_clipboard = GUICtrlCreateCheckbox("clipboard", 15, 170)
$guih_clipboard = GUICtrlSetTip($gui_clipboard, "Extract the contents of the windows clipboard")

$gui_eventhooks = GUICtrlCreateCheckbox("eventhooks", 15, 190)
$guih_eventhooks = GUICtrlSetTip($gui_eventhooks, "Print details on windows event hooks")

$gui_gathi = GUICtrlCreateCheckbox("gathi", 15, 210)
$guih_gathi = GUICtrlSetTip($gui_gathi, "Dump the USER handle type information")

$gui_messagehooks = GUICtrlCreateCheckbox("messagehooks", 15, 230)
$guih_messagehooks = GUICtrlSetTip($gui_messagehooks, "List desktop and thread window message hooks")

$gui_screenshot = GUICtrlCreateCheckbox("screenshot", 15, 250)
$guih_screenshot = GUICtrlSetTip($gui_screenshot, "Save a pseudo-screenshot based on GDI windows")

$gui_userhandles = GUICtrlCreateCheckbox("userhandles", 15, 270)
$guih_userhandles = GUICtrlSetTip($gui_userhandles, "Dump the USER handle tables")

$gui_windows = GUICtrlCreateCheckbox("windows", 15, 290)
$guih_windows = GUICtrlSetTip($gui_windows, "Print Desktop Windows (verbose details)")

$gui_wintree = GUICtrlCreateCheckbox("wintree", 15, 310)
$guih_wintree = GUICtrlSetTip($gui_wintree, "Print Z-Order Desktop Windows Tree")


GUISetState(@SW_SHOW)

While 1

$msg = GUIGetMsg()

If $msg = $GUI_EVENT_CLOSE Then ExitLoop

If $msg = $fmexit Then ExitLoop

If $msg = $close Then ExitLoop

WEnd

EndFunc

[Melba23]

SaintedRogue,

You never close the tab structure - which often leads to problems. Add:

GUICtrlCreateTabItem(""); end tabitem definition

just before the GUISetState line and see if that helps.

M23

[SaintedRogue]

And that is why I love the AutoIt forums! Solution found in 20 minutes. Thanks so much M! You save me again.

[Melba23]

SaintedRogue,

My pleasure as always.

M23