1

I'm new to using x32/64dbg and I have an EXE with PDB symbols and want to disassemble and debug an unmanaged function call. It's from an x86 .NET 2.0 DLL where the unmanaged code sits compiled inside the EXE.

I have looked up the internal call that I want to debug in the symbols, and set up breakpoints on the entry and exit of the function.

The function takes a set of 3 32-bit floats in the .NET DLL method call as inputs through an internal call that runs some calculations and then outputs a set of 4 32-bit floats back to .NET.

The function basically does a few sin/cos/atan2 calls on the parameters, along with some other math that I want to review for accuracy. Is there a way to read the parameter values as floats? I couldn't seem to find this in the docs anywhere. Basically I just need to get the values of the inputs and outputs to the function.

In the lack of finding a method I tried to whip up a quick app to input 4 bytes as hex and output the sign/exponent/significand based on some docs here (https://msdn.microsoft.com/en-us/library/system.single(v=vs.110).aspx) but my results aren't matching up with the app's input, I'm sure I'm not doing something right.

Disassembly of the function looks like so:

push ebp
mov ebp,esp
mov eax,dword ptr ss:[ebp+8]
sub esp,10
push 4
push eax
lea ecx,dword ptr ss:[ebp-10]
push ecx
call <testapp.ConversionFunction>
movq xmm0,qword ptr ds:[eax]
mov ecx,dword ptr ss:[ebp+C]
movq dword ptr ds:[ecx],xmm0
movq xmm0,qword ptr ds:[eax+8]
add esp,C
movq qword ptr ds:[ecx+8],xmm0
mov esp,ebp
pop ebp
ret

1 Answer 1

1

After a little digging I got it. Right click your Dump to change data types between address and float. You have to follow the address of the address pointed to by esp-4 to get the parameters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.