Analyse structure from memory dump

Question

I'm trying to extract master key from OpenSSL 1.0.2l (statically linked without debug symbols).

I'm using x64dbg, I was able to locate int SSL_connect(SSL *s) method, so I have a breakpoint there (the breakpoint gets hit). In the result, I have a pointer to SSL parameter that contains SSL_SESSION *session member, in which the master key is located.

The SSL pointer points me the following place in dump:

Is there any easy way to find my poiner to SSL_SESSION *session member here? Any other tool suggestions?

Useful links to OpenSSL source code:

int SSL_connect(SSL *s)

SSL structure

SSL_SESSION *session member in SSL

SSL_SESSION structure

Answer 1

I would use the x64dbg methods to add a custom type:

1. You can do this using a combination of these commands:

• DataUnknown
• DataByte/db
• DataWord/dw
• DataDword/dw
• DataFword
• DataQword/dq
• DataTbyte
• DataOwordD
• DataMmword
• DataXmmword
• DataYmmword
• DataFloat/DataReal4/df
• DataDouble/DataReal8
• DataLongdouble/DataReal10
• DataAscii/da
• DataUnicode/du
• DataCode/dc
• DataJunk
• DataMiddle
• AddType
• AddStruct
• AddUnion
• AddMember
• AppendMember
• AddFunction
• AddArg
• AppendArg
• SizeofType
• VisitType
• ClearTypes
• RemoveType
• EnumTypes
• LoadTypes
• ParseTypes

2. Create a type definition in types JSON example:

{ "types": [ { "type": "unsigned int", "name": "DWORD" }, { "type": "_FILETIME*", "name": "LPFILETIME" } ], "structs": [ { "name": "ST", "members": [ { "type": "char", "name": "a", "arrsize": 0, "offset": -1 }, { "type": "int", "name": "y", "arrsize": 0, "offset": -1 } ] }, { "name": "_FILETIME", "members": [ { "type": "DWORD", "name": "dwLoDateTime" }, { "type": "DWORD", "name": "dwHighDateTime" } ] }, { "name": "BLUB", "members": [ { "type": "short", "name": "c" }, { "type": "int", "name": "d", "arrsize": 2 } ] }, { "name": "TEST", "members": [ { "type": "int", "name": "a" }, { "type": "char", "name": "b" }, { "type": "BLUB", "name": "e" }, { "type": "int", "name": "f" } ] }, { "name": "POINTEE", "members": [ { "type": "int", "name": "n" }, { "type": "TEST", "name": "t" } ] }, { "name": "POINTER", "members": [ { "type": "int", "name": "x" }, { "type": "POINTEE*", "name": "next" }, { "type": "int", "name": "y" } ] }, { "name": "LIST_ENTRY", "members": [ { "type": "int", "name": "x" }, { "type": "LIST_ENTRY*", "name": "next" }, { "type": "int", "name": "y" } ] }, { "name": "STRINGTEST", "members": [ { "type": "const char*", "name": "str" }, { "type": "const wchar_t*", "name": "wstr" } ] } ], "unions": [ { "name": "UT", "members": [ { "type": "char", "name": "a" }, { "type": "short", "name": "b" }, { "type": "int", "name": "c" }, { "type": "long long", "name": "d" } ] } ], "functions": [ { "rettype": "int", "callconv": "cdecl", "noreturn": false, "name": "strcasecmp", "arguments": [ { "type": "const char*", "name": "s1" }, { "type": "const char*", "name": "s2" } ] } ] }

3. Load a simple C header definition of the type

Once a type is imported you can use VisitType cmd to view it. Additional info: x64dbg type system Weekly Digest 14 - Types