0

Let's bring example

We have string

0000000000bd2906 db "CurrentKey", 0 ; DATA XREF=sub_555670+3390

And it's used here

00000000005563ae lea rsi, qword [0xbd2906] ; "CurrentKey"

Disassembler already knows where is variable reference. Knows that "CurrentKey" string is stored at 0xbd2906 and used at 0x5563ae. Question is, how can i manually locate where variable is used without using disassembler (to do this automatically from code) ?

Can someone explain it or provide cpp example ?

| improve this question | | | | |
  • 2
    Sorry, I don't get it... could you improve your question? – kn0x Aug 18 '17 at 20:51
  • Sorry, that could have been unclear. I think it's more straightforward now. – user21284 Aug 18 '17 at 21:01
  • 2
    @user3370412: you should ask another question explaining all details and what you're really after. Why do you need this information and what you're going to do with it? So far it seems to be a classic XY question, so not sure it's useful to the others. – Igor Skochinsky Aug 20 '17 at 19:34
  • I simply need to find address where string i've found by byte array pattern scanning is being used from c++ code level. – user21284 Aug 21 '17 at 1:15
  • still not clear. in the same program or another? can you use debugging APIs? why do you need to find those instructions? – Igor Skochinsky Aug 21 '17 at 5:23
2

It depends on what exactly the context is. What type of binary is it? Are you talking about on-disk or in-memory? What os are you on?

I would highly recommend you use a disassembly engine library which makes most of these questions moot. Capstone is nice.

If you really want to do it by yourself, you can. For instance, if your target is a PE file, you'll need to map it into memory. This means understanding the PE format or using a library such as PeLib. Once you've done that, you'll want to search for the string in question. This would generally be in the ".rdata" section (marked for RO) if it's a constant string, or in the ".data" section (marked for RW) if it's a mutable string. Once you've found it, you'll need to scan through the ".text" section (marked for RWE) for the address that corresponds to the string.

There's a few caveats here. First, these section names and protections may be different if the binary is packed, written in managed code, or compiled by a non-standard compiler. These same things can lead to greatly complicating the task.

Second, you will have to deal with ASLR. The binary will either have ASLR enabled, meaning there is a relocations table which needs to be parsed and applied to the binary to get the final addresses; or it won't have ASLR, meaning all of the addresses will assume 0x00040000 as a base and you will need to take this into account when calculating the address of the string once you've found it (oh, you mapped the binary at 0x0006500 and the string was found at 0x00006516? You must scan for address (0x00006516 - 0x0006500) + 0x00040000). This is similar to what you need to do when applying relocations.

One thing to keep in mind is that relocations can be useful. Generally, when they exist, they will tell of every single offset that uses an address in the binary relative to the base address. So you might also just scan each offset that is relocated, checking for one whose proper address resolves to one containing your target string.

I wish I could be more helpful, but this is what I can offer with the information you've provided. Hopefully it puts you in the right direction.

| improve this answer | | | | |
  • I really wanted to do this manually, however Capstone is a really decent solution. Thank you. – user21284 Aug 27 '17 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy