3

I want to reverse-engineer a Qt crackme written for linux. I would like to follow where introduced text gets. I have found this gdb macro to print QStrings (Qt5). To test it I wrote a simple helloworld application containing:

QString str("almafa");
qDebug() << str;

This prints the QString as expected.

(gdb) printqs5static str
(Qt5 QString)0xffffdf50 length=6: "almafa"

After this I tried to inspect QStrings where no variable names are present.

The compiled code looks like (in radare2):

|           0x00400ab7      488d45b0       leaq -0x50(%rbp), %rax
|           0x00400abb      488d55c0       leaq -0x40(%rbp), %rdx
|           0x00400abf      4889d6         movq %rdx, %rsi
|           0x00400ac2      4889c7         movq %rax, %rdi
|           0x00400ac5      e816feffff     callq sym.QMessageLogger::debug
|           0x00400aca      488d55a0       leaq -0x60(%rbp), %rdx
|           0x00400ace      488d45b0       leaq -0x50(%rbp), %rax
|           0x00400ad2      4889d6         movq %rdx, %rsi
|           0x00400ad5      4889c7         movq %rax, %rdi
|           0x00400ad8      e863020000     callq sym.QDebug::operator__

I do not have experience debugging Qt applications, but I expected that from the above code snippet that at 0x400ad8 either rsi or rdi will be the QString. Unfortunately printqs5static $rsi is not working. i r $rsi gives 0x7ffffffdf50, the address from printqs5static str result.

The question is how to inspect QStrings when only memory addresses are available?

Edit: The web page I am referring is down at this moment, but a cashed version is here. gdbpretty printers are also able to print QStrings if there are symbolic names available. Still do not know how to work without them.

1
1

Did you try printqs5static $rdi? Assuming that call goes to the function with the prototype QDebug & QDebug::operator<<(const QString & s), then it's rdi that should contain the QString, not RSI.

Another option is to dump memory around rdi and rsi. I doubt the object is super complicated, so there should be a pointer to a normal C string nearby.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.