1

I've been trying to apply hooks on Win32 ReadFile so I can read the buffer and the params,however am not even sure whether the output is correct since it doesn't matchup with the stack-view pane nor the input.

If anyone can confirm whether am doing it right I'll be most thankful.

I cannot test this code properly atm since the modem I was using got bricked. Using local files as input for Readfile is giving me junk output in the log window.

Script

// === break on load module ===
mov sApi, "ReadFile"
mov sDLL, "kernel32"
gpa sApi, sDLL

// store address
mov handle, $RESULT
log handle
        cmp handle, 0
je abort



lbl_bp:
// run
go handle

    mov adrRet, [esp]
    mov hFile, [esp+4.]
    mov InBuffer,  [esp+8.]
    mov nNumberOfBytesToRead, [esp+12.]
    mov lpNumberOfBytesRead, [esp+16.]
    mov lpOverlapped, [esp+20.]

    log InBuffer
    log hFile
    log nNumberOfBytesToRead
    log lpNumberOfBytesRead
    log lpOverlapped

    cmp InBuffer,0
    je noIn 

    mov INN, [InBuffer], nNumberOfBytesToRead
    log INN



    jmp lbl_bp

 noIn:  
    jmp lbl_bp

abort:
1

It works !. I just used a different api function. But don't use the above where there is no input, as the nNumberOfBytesToRead will cause olly to allocate an unknown size of memory since the variable has not been initialized, hence the crashes. Or at-least initialize the variable before using it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.