0

being a complete noob in reversing I may have taken on too much here--I have an old piece of software, cadcam, that is still good and functions well but is limited in the size of a number it can allow to be stored for a tool number--this may not make sense to some--here is more detail.

The software has a form that allows you to input a tool number--that number is limited to 999 as a maximum, I have got olldbg 2.01 and I have so far tracked down some values but still have an awful lot to learn as I cannot ever find teh exact number I enter when I say use 99999999 as the tool number which causes an error box.

That said I have dug around in the background and found the numbers for the tool library (tools you make and decide to save for future ref) are stored in ms access db backend--now access I know, I have found how it stores the numbers for saved tools in a long int field, it happily takes 99999999+ (which I would expect). as a test i changed a tool number here to a 99999999 number and restarted the program--it now displays 57599 as the tool number--I may be wrong but I think the software was written and a 2 byte int declared where as I need a 4 (16 bits: maximum representable value 216 − 1 = 65,535).

I am wondering if there is anyway to change the acceptable number to make it bigger somehow--how would I really go about it--I am always keen to have a go even when I know nothing lol.


Some further information as I try a little digging and learning. The current answer could very well be right as the software is 10 years old but upon digging I have managed to follow some of the code as I try to teach myself more, I can speculate that the locations are limited for the number as there are only 2 areas where there is any actual possibility of working with it. The tool number is nothing special and is the simple end of a one to many relationship as the to9 number is just an identifier for any possible number of operations under that top number. (Again speculation)

As it happens, the code when executed takes the number and passes it to Microsoft user code to return the number of “characters” in the text box, say 8 put in 1234 then it returns 5 (num char + null char) so I see wax change to 5 and then moves this to a mem location. Then it calls ntdll and checks something is not too long, this I am tying to work out. I can se a cmp of something to 4 and a call to message a but I am not good enough to follow most of this yet.

As I learn more I hope to find the location in the dll file where it gets its cmp value from and change it to 1 char more than my desired max digit. If that stops the message box appearing I know it will write a bogus number to the db in the background which I have already confirmed is able to store a long int (ms access db file) as it does not handle numbers larger than 65635 or something like that, more investigation.

I have been looking for more in depth reverse engineering texts but seems hard to find. I will keep learning and digging because of the challenges it poses and report back for more help on this as required. Thanks for answers given as it does trigger other thoughts.

  • 2 byte ints would still be quite a few more possible values. Do you really need it to be dword or will removing the hardcoded limit to 999 be enough? – NirIzr Aug 24 '18 at 16:11
1

It must have truncated your database value, 99999999, to a 16-bit unsigned integer: 99999999 = 0x5F5E0FF => 0x5F5E0FF & 0xFFFF = 0xE0FF = 57599 (or more succinctly 99999999 % 65536 = 57599).

Unfortunately, it's probably impossible to easily change that 2-byte integer to a 4-byte one. In memory, structures might be laid out so that everything is aligned with that integer's size in mind:

struct {
    uint16_t yourInt; // offset 0x0
    int otherValue;   // offset 0x2
} x;

This is just a toy example, but suppose in the code there was:

printf("%d\n", x.otherValue);

This might compile down to something like:

lea esi, [ebp-local_var]
mov eax, [esi+2] // +2, since that's the offset of otherValue in structure x
push eax
push "%d\n"
call printf
add esp, 8

In other words, all of the code is laid out to treat memory as if it was setup with that integer as 2-bytes. To change the length of your int, you'd have to "carve out" space where it's stored in memory.

Moreover, the instructions used to access and write that value differs by size:

For 16-bits, it might be:

mov eax, word ptr [edx] // 66 8b 02 - to read 
mov word ptr [edx], eax // 66 89 02 - to write

But for 32-bits, it might be:

mov eax, dword ptr [edx] // 8b 02 - to read
mov dword ptr [edx], eax // 89 02 - to write

Evidently, these instructions have different opcodes, so you'd have to patch the code everywhere that variable is referenced.

One strategy, if you're willing to undertake this, is to put a read/write hardware memory breakpoint on your value. Then, note down everywhere it's used. You can carve out space for the value somewhere in the .data section or add a new section to the PE file. Then, patch all references to that value in code to reference the space you carved out for the new copy of the variable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.