0

I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program. Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-function and I wonder: where can I see the concrete arguments for this function while debugging?

Currently I am at this point:

enter image description here

I am pretty sure you can (almost) see the arguments (or at least its address) in this screenshot. But I am a beginner in reverse engineering. I don't get it/don't see it.

What is the easiest/best way to get the URL that should be downloaded in this case?

0

Since eax,ebx etc are used instead of rax,rbx etc in your screen shot
i assume it is some x86 code and not x64 code

since there doesnt appear a push {} for arguments prior to the call
i assume this code is not compiled with msvc

it appears to use a mov arguments to stack kind which ida doesnt seem to decode
(ida should usually show the hFile,etc args if it was standard vs compiled exe

(screenshot shows the disassembly of src code compiled from here using vs2017 15.8.1 x86 32bit

enter image description here

the prototype for this function is

BOOLAPI InternetReadFile(
  HINTERNET hFile,
  LPVOID    lpBuffer,
  DWORD     dwNumberOfBytesToRead,
  LPDWORD   lpdwNumberOfBytesRead
);

in your screenshot var 47c,478,474,470 are the arguments to this specific function

take a look at VIEW ESP window in your screen shot
cc0xxx is your HINTERNET hFile argument
var 454 is your LPVOID lpBuffer
0x3E8 is the DWORD dwNumberOfBytesToRead,
var_458 is the pointer to recieve the number of bytes read LPDWORD lpdwNumberOfBytesRead

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.