2

I know that it exists gdb, but i'm talking about windows, i would like know if there is any way to see who access to current stackframe of a specified variable on an X subroutine...

i've tried using CE using the "Find out what accesses this address" option through the stackframe but the stackframe logically it's dynamic then i get over 2000 registers...

  • I'm not sure if I understand you correctly. Can you post how you do it in gdb? – Paweł Łukasik Oct 4 '17 at 9:56
  • @Paweł Łukasik I'm not on linux, but i'm looking something like that for windows... meanwhile i'm using breakpoints and capturing on an X time the stackframe activity... – nikomaster Oct 5 '17 at 0:30
2

If you have a debugger with access to symbols, then you can run to the start of the function, and then place watches on the symbol names.

In the absence of a debugger, if you can hook the function itself, then one way to do it is this:

  • save the original few bytes in the routine, and install a hook;

  • resume execution;

  • when your hook code gains control, create a hardware breakpoint on the address(es) of interest, and an exception handler to receive notifications on access;

  • set the stack parameters, etc, appropriate to call the original function at the point after your hook code (e.g. EIP+5). Calling the function manually in this way will simplify the next step.

  • when the function returns, remove the hardware breakpoint, clean the stack to remove the original invocation, and return to the caller.

  • I'm doing something like that, but without an VEH, i'm tracing the stackpointer, so if i have an local variable like [esp+0x88] then i trace the total address on an X time with breakpoints into of subroutine logically, anyway i will try your way... thanks you. – nikomaster Oct 6 '17 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.