Record all calls to specific function? Olly/x64dbg

Question

I need to find values of arguments that are passed to specific function.

Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this specific function to do it manually, so I'm trying to find some automatic solution.

Any suggestions?

Answer 1

ollydbg v 2.01

ollydbg calc.exe -> ctrl+g ->address or symbol->follow ->shift+f4 ->pause never -> log arguments ->always -> f9 and see the log window

if you are on windbg you simply do

0:003> bp USER32!TranslateMessage "dt ole32!tagMSG poi(@esp+4);kb 2;.echo ========;gc"
breakpoint 0 redefined
0:003> g
   +0x000 hwnd             : (null) 
   +0x004 message          : 0x113
   +0x008 wParam           : 0x3341
   +0x00c lParam           : 0n1954748594
   +0x010 time             : 0x147656d
   +0x014 pt               : tagPOINT
 # ChildEBP RetAddr  Args to Child              
00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage
01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b
========
   +0x000 hwnd             : 0x000e0212 HWND__
   +0x004 message          : 0xf
   +0x008 wParam           : 0
   +0x00c lParam           : 0n0
   +0x010 time             : 0x1477998
   +0x014 pt               : tagPOINT
 # ChildEBP RetAddr  Args to Child              
00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage
01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b
========
   +0x000 hwnd             : 0x001d017e HWND__
   +0x004 message          : 0xf
   +0x008 wParam           : 0
   +0x00c lParam           : 0n0
   +0x010 time             : 0x14779a8
   +0x014 pt               : tagPOINT
 # ChildEBP RetAddr  Args to Child              
00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage
01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b
========

edit

x64 dbg also has an edit breakpoint when you toggle an f2 bp but i dont know how you can coax it to decode teh arguments

with x64 dbg you set an f2 breakpoint from the gui then rightclick edit breakpoint

and set the condition to break as 0 (never break) and in the log text edit box input this formatted string

and see the results in log window

like below

msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: F
msg *:FEDB0;hwnd=:3D0458;msg =: F
msg *:FEDB0;hwnd=:1908B8;msg =: F
msg *:FEDB0;hwnd=:8038E;msg =: F

Answer 2

When there are too many calls to handle I normally use pykd to trace. As an example

class ExceptionHandler(pykd.eventHandler):
    def __init__(self):
        pykd.eventHandler.__init__(self)

    def onBreakpoint(self, id):
        esp = pykd.reg("esp")
        eax = pykd.reg("eax")
        out = ""
        if id == 0:
            out += "RtlAllocateHeap ("
            out += hex(pykd.ptrPtr(esp + 0x4)) + " , "
            out += hex(pykd.ptrMWord(esp + 0x8)) + " , "
            out += hex(pykd.ptrPtr(esp + 0xc)) + ") "
            out += " = "
            out += hex(eax)
        print out

pykd.initialize()
pykd.handler = ExceptionHandler()
pykd.startProcess("test.exe")
alloc_module = pykd.module("ntdll")
alloc_module.reload()
b0 = pykd.setBp(alloc_module.offset('RtlAllocateHeap')+0xe6, callback)
pykd.go()
pykd.killAllProcesses()

This will give you a neat trace of all the alloc calls made. A small script I wrote to manage this easily.