How to view the content of a file before it is written?

Question

I've got a process that writes to a file (database). In process monitor I see WriteFile. After this I see the file is about to be either written or updated (offset:length).

How can I reveal the content that is about to be written or updated in this file using Ollydbg? Is there a tutorial or something similar? And how to specify the function on Ollydbg?

In process monitor, I see WriteFile, but in Ollydbg, what is the function?

Answer 1

You can have a look at Woodmann or tuts4you if you need tutorials. And if you want to see what is writes you will have to have where the pointers are stored for the function in question.

This has a lot to do with calling conventions, cdecl and stdcall and knowing about them is important for this..

I am going to try to explain using the writeFile function.

How does WriteFile Work

First we look at the WriteFile declaration (taken from MSDN)

BOOL WINAPI WriteFile(
  _In_         HANDLE hFile,
  _In_         LPCVOID lpBuffer,
  _In_         DWORD nNumberOfBytesToWrite,
  _Out_opt_    LPDWORD lpNumberOfBytesWritten,
  _Inout_opt_  LPOVERLAPPED lpOverlapped
);

Now when we assume that Windows has stdcall (win32api has). We can figure out where we can find the variables. (for more about the stdcall see Wikipedia).

Due to our wikipedia article we a few things:

• The parameters are pushed onto the stack in right-to-left order
• Registers EAX, ECX, and EDX are designated for use within the function.
• Return values are stored in the EAX register.
• stdcall is the standard calling convention for the Microsoft Win32 API.

This is great

Now we have everything we need to figure out where we can find the location of the information you need. When a breakpoint is placed on the function call you'll know that all the variables are stored on the stsck. LPCVOID is a Pointer, all that is left is to follow it and read the data.