I've been trying to apply hooks on Win32
ReadFile so I can read the buffer and the params,however am not even sure whether the output is correct since it doesn't matchup with the stack-view pane nor the input.
If anyone can confirm whether am doing it right I'll be most thankful.
I cannot test this code properly atm since the modem I was using got bricked. Using local files as input for
Readfile is giving me junk output in the log window.
// === break on load module === mov sApi, "ReadFile" mov sDLL, "kernel32" gpa sApi, sDLL // store address mov handle, $RESULT log handle cmp handle, 0 je abort lbl_bp: // run go handle mov adrRet, [esp] mov hFile, [esp+4.] mov InBuffer, [esp+8.] mov nNumberOfBytesToRead, [esp+12.] mov lpNumberOfBytesRead, [esp+16.] mov lpOverlapped, [esp+20.] log InBuffer log hFile log nNumberOfBytesToRead log lpNumberOfBytesRead log lpOverlapped cmp InBuffer,0 je noIn mov INN, [InBuffer], nNumberOfBytesToRead log INN jmp lbl_bp noIn: jmp lbl_bp abort: