I got writing pad custom.exe to work on Vista

I got Ruier's software/driver (custom.exe) that came with my handwriting pad (Legend LX-WRP-1) to work on Vista, finally, here is how...

Many years ago I bought this handwriting pad for cheap. It had apparently low quality software, cause even on Windows XP it had alot of problems: it assumed administrative rights for all users. To get it to work with limited user accounts, I had to make the entire ruier directory writable to all users. But at least it worked after that.

Recently I plugged it into my Vista machine, and at first it acted as if the driver wasn't recognized. No matter what I scribbled on the pad, nothing showed. Soon I realized I need to calibrate it from its configuration window found in Control Panel.

Now, I can draw 1 stroke but custom.exe (the main program) would just crash after that. I hook up the debugger and tried to debug, and found this call stack

0012fba8 031e0352 0x0
0012fbd0 031dfc1b PPGHOST!DSS+0xd112
0012fbf4 75f40f96 PPGHOST!DSS+0xc9db
0012fc0c 776399ce USER32!__fnHkINLPMOUSEHOOKSTRUCTEX+0x35
0012fc4c 75f3bc77 ntdll!KiUserCallbackDispatcher+0x2e
0012fc78 031ea80c USER32!NtUserCallNextHookEx+0xc
0012fcac 75f2f794 PPGHOST!SE+0x9e2c
0012fd24 75f30008 USER32!UserCallWinProcCheckWow+0x14b
0012fd88 75f25a2c USER32!DispatchMessageWorker+0x322
0012fd98 0040448f USER32!DispatchMessageA+0xf
0012fe30 77645b87 Custom+0x448f
0012fec0 75f29791 ntdll!RtlpLowFragHeapAllocFromContext+0xa6f
0012fee8 0040104b USER32!RegisterWindowMessageA+0x44
0012fef0 00407329 Custom+0x104b
0012fefc 004050b0 Custom+0x7329
0012ff88 76704911 Custom+0x50b0
0012ff94 7761e4b6 kernel32!BaseThreadInitThunk+0xe
0012ffd4 7761e489 ntdll!__RtlUserThreadStart+0x23
0012ffec 00000000 ntdll!_RtlUserThreadStart+0x1b

I could tell it was referencing some mouse hook struct, probably a callback to mouse events, but other than that, no help there. All I knew was it crashed in ppghost.dll. I brought up Microsoft Dependency Walker to try to gain some insight on ppghost.dll... oh well, almost all of its exported functions are just 2 to 3 letters long - someone tried very hard to obfuscate the code. I had to try something different.



I noticed something strange though. It only crashed when I started writing. It won't crash if I had just changed the settings. However, those settings were never saved. Normally settings are saved in the registry so I pulled up Process Monitor to trace registry activities; didn't find anything. But I noticed this application uses alot of .ini file. So I switched to look for file activities.

Bingo.



When it started up, it was trying to read WinPenJR (presumably Win Pen Junior?? another company's product?) directory under Windows directory, which did not exist. I went ahead and created C:\Windows\WinPenJR directory, and my handwriting pad started working.

I suspect there is some piracy going on here. Ruier itself looks like a shady company even from its own web page (I was trying to find updated driver). Though its binaries are all Ruier branded, the file names (custom.exe, WinPenJR) are identical to other products. Unless you tell me they are OEM (doubtful, cause it's crappy)... it smells funky.

What do you think?