I've been trying to apply hooks on Win32 ReadFile so I can read the buffer and the params,however am not even sure whether the output is correct since it doesn't matchup with the stack-view pane nor the input.

If anyone can confirm whether am doing it right I'll be most thankful.

I cannot test this code properly atm since the modem I was using got bricked. Using local files as input for Readfile is giving me junk output in the log window.


// === break on load module ===
mov sApi, "ReadFile"
mov sDLL, "kernel32"
gpa sApi, sDLL

// store address
mov handle, $RESULT
log handle
        cmp handle, 0
je abort

// run
go handle

    mov adrRet, [esp]
    mov hFile, [esp+4.]
    mov InBuffer,  [esp+8.]
    mov nNumberOfBytesToRead, [esp+12.]
    mov lpNumberOfBytesRead, [esp+16.]
    mov lpOverlapped, [esp+20.]

    log InBuffer
    log hFile
    log nNumberOfBytesToRead
    log lpNumberOfBytesRead
    log lpOverlapped

    cmp InBuffer,0
    je noIn 

    mov INN, [InBuffer], nNumberOfBytesToRead
    log INN

    jmp lbl_bp

    jmp lbl_bp


1 Answer 1


It works !. I just used a different api function. But don't use the above where there is no input, as the nNumberOfBytesToRead will cause olly to allocate an unknown size of memory since the variable has not been initialized, hence the crashes. Or at-least initialize the variable before using it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.