I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the static data structure that are passed as argument to the function call.

I'm ussing x64dbg for the disassembly and have the posibility to use snowman also.

The specific "struct" is the one defined here (DCB used for serial ports configuration)

  • 2
    Can you view the application's imports? If so, then consider setting a BP on SetCommState() and observe the data that's passed to it when it breaks (which will be made more meaningful if you identify the calling convention). You could also look for cross-references (xrefs) to SetCommState() and glean what information you can from that. – dsasmblr Dec 5 at 18:06
  • 1
    if the structure is defined as local to a function like int foo() { DCB dcb .... SetCommState(handle , &dcb); ... } then it would be in stack you cannot get that statically if DCB is a global you can look at the disassembly and get the Address from the pushed arguments – blabb Dec 5 at 20:24
  • @Biswapriyo I'm not sure about how to do this. On the other hand, 'dsasmblr'and 'blabb', yes, I can set a breakpoint. but I was wondering if it could be possible to find the static data in the code without debuging. I will check taking into account your comments. Thank you – gavioto Dec 6 at 0:07
  • @Biswapriyo a program that uses that function – gavioto yesterday

For this case, here I compile the MS Docs example in 64 bit PE binary with gcc -ggdb command (or use gcc -S for the assembly file). Here is the assembly section of SetCommState function in Intel syntax:

mov     dword ptr [rbp-44], 57600       ; dcb.BaudRate = CBR_57600
mov     byte ptr [rbp-30], 8            ; dcb.ByteSize = 8
mov     byte ptr [rbp-29], 0            ; dcb.Parity = NOPARITY
mov     byte ptr [rbp-28], 0            ; dcb.StopBits = ONESTOPBIT
lea     rdx, [rbp-48]                   ; lpDCB
mov     rax, [rbp-16]                   ; move the Handle returned by CreateFile
mov     rcx, rax                        ; hFile
mov     rax, cs:__imp_SetCommState
call    rax ; __imp_SetCommState        ; call the SetCommState function
mov     [rbp-20], eax                   ; move return 32 bit integer value to stack

Here are the general steps you may follow to find any input variable of a function: 1. Find the imported function in the assembly (here SetCommState) 2. Find or guess the calling convention used in that function (here __fastcall) 3. If any parameter is a structure type find the stack pointer and/or base pointer above the function call (here [rbp-48]). It will be the first member of that stack. Then follow the stack allocations one by one, you will get all the structure members (here [rbp-48], [rbp-44], [rbp-30] and so on).

  • ok, In my case, it is a 32 bit application, so it can't use 64 bit registers. But I've got the general idea. – gavioto 1 hour ago
  • I'm having problems locating the code section (memory address to SetCommState using x64dbg – gavioto 12 mins ago

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.