2

I need to find values of arguments that are passed to specific function.

Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this specific function to do it manually, so I'm trying to find some automatic solution.

Any suggestions?

2

ollydbg v 2.01

ollydbg calc.exe -> ctrl+g ->address or symbol->follow ->shift+f4 ->pause never -> log arguments ->always -> f9 and see the log window

enter image description here

if you are on windbg you simply do

0:003> bp USER32!TranslateMessage "dt ole32!tagMSG poi(@esp+4);kb 2;.echo ========;gc"
breakpoint 0 redefined
0:003> g
   +0x000 hwnd             : (null) 
   +0x004 message          : 0x113
   +0x008 wParam           : 0x3341
   +0x00c lParam           : 0n1954748594
   +0x010 time             : 0x147656d
   +0x014 pt               : tagPOINT
 # ChildEBP RetAddr  Args to Child              
00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage
01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b
========
   +0x000 hwnd             : 0x000e0212 HWND__
   +0x004 message          : 0xf
   +0x008 wParam           : 0
   +0x00c lParam           : 0n0
   +0x010 time             : 0x1477998
   +0x014 pt               : tagPOINT
 # ChildEBP RetAddr  Args to Child              
00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage
01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b
========
   +0x000 hwnd             : 0x001d017e HWND__
   +0x004 message          : 0xf
   +0x008 wParam           : 0
   +0x00c lParam           : 0n0
   +0x010 time             : 0x14779a8
   +0x014 pt               : tagPOINT
 # ChildEBP RetAddr  Args to Child              
00 0017eee0 002b1c9f 0017efbc 00304a68 004f2b44 USER32!TranslateMessage
01 0017fc50 002c219a 002b0000 00000000 004f2b44 calc!WinMain+0x85b
========

edit

x64 dbg also has an edit breakpoint when you toggle an f2 bp but i dont know how you can coax it to decode teh arguments

with x64 dbg you set an f2 breakpoint from the gui then rightclick edit breakpoint

and set the condition to break as 0 (never break) and in the log text edit box input this formatted string

and see the results in log window

like below

msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: 118
msg *:FEDB0;hwnd=:160252;msg =: F
msg *:FEDB0;hwnd=:3D0458;msg =: F
msg *:FEDB0;hwnd=:1908B8;msg =: F
msg *:FEDB0;hwnd=:8038E;msg =: F

enter image description here

  • Thanks, thats exactly what I needed! I did it with OllyDbg, but had to change from arguments "guessing" to expressions because otherwise it wouldn't guess _thiscall and value of ECX. Unfortunately x64dbg gives me BREAKPOINT_EXCEPTION after too many calls then I can't even resume with exception swallowing/ignoring option. Any idea why it happens? – Zax Ftw Jan 25 '18 at 10:16
  • It’s probably happening because of a race condition. A similar bug is present in all debuggers but it’s very possible you will never see it again :) – mrexodia Jan 25 '18 at 23:25
  • @mrexodia unfortunately it happened multiple times in row, had to restart the app and x96dbg because it wouldn't let me resume otherwise. There was like 15000 calls of this function in less than minute in OllyDbg log file. – Zax Ftw Jan 27 '18 at 17:15
1

When there are too many calls to handle I normally use pykd to trace. As an example

class ExceptionHandler(pykd.eventHandler):
    def __init__(self):
        pykd.eventHandler.__init__(self)

    def onBreakpoint(self, id):
        esp = pykd.reg("esp")
        eax = pykd.reg("eax")
        out = ""
        if id == 0:
            out += "RtlAllocateHeap ("
            out += hex(pykd.ptrPtr(esp + 0x4)) + " , "
            out += hex(pykd.ptrMWord(esp + 0x8)) + " , "
            out += hex(pykd.ptrPtr(esp + 0xc)) + ") "
            out += " = "
            out += hex(eax)
        print out

pykd.initialize()
pykd.handler = ExceptionHandler()
pykd.startProcess("test.exe")
alloc_module = pykd.module("ntdll")
alloc_module.reload()
b0 = pykd.setBp(alloc_module.offset('RtlAllocateHeap')+0xe6, callback)
pykd.go()
pykd.killAllProcesses()

This will give you a neat trace of all the alloc calls made. A small script I wrote to manage this easily.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.