0

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):

//C++ code
SCROLLINFO s;
s.cbSize = sizeof(s);    //0x1C
s.fMask = SIF_POS | SIF_TRACKPOS;   //0x4 | 0x10
GetScrollInfo(hWnd, SB_VERT, &s);    //SB_VERT = 1
printf("pos=%d, track=%d", s.nPos, s.nTrackPos);

So I came up with the following Python script to do this from a breakpoint in IDA:

import ctypes
from ctypes import wintypes
hwnd = 0x00020208
user32 = ctypes.WinDLL('user32', use_last_error=True)
class SCROLLINFO(ctypes.Structure):
    _fields_ = (("cbSize", wintypes.DWORD),
                ("fMask", wintypes.DWORD),
                ("nMin", wintypes.LONG),
                ("nMax", wintypes.LONG),
                ("nPage", wintypes.DWORD),
                ("nPos", wintypes.LONG),
                ("nTrackPos", wintypes.LONG))
s = SCROLLINFO(cbSize=0x1C,
        fMask=0x14,
        nPos=-1,
        nTrackPos=-1)
user32.GetScrollInfo(hwnd, 1, ctypes.byref(s))
print s.nPos, s.nTrackPos

Which I thought seemed to work and gave me some values:

enter image description here

But then when I got to the actual code in the process that was doing the same:

enter image description here

The result it received for s.nTrackPos was 1 instead of 8 that is reported by my Python script. Here's the memory dump for the SCROLLINFO struct:

enter image description here

So what am I doing wrong here? Why is the Python script returning the wrong value?

Improve this question

1 Answer 1

Reset to default
1

Your Python code executes inside IDA’s process so you are getting results of the call on IDA, not the debuggee. If you want to execute code inside the process being debugged, you can use Appcall: http://www.hexblog.com/?p=113

Improve this answer
1
  • I ended up writing my own asm function in that module that would call the code I needed to check (first C++ snippet that I gave above.) I used asm so that I could enclose it in PUSHFD, PUSHAD and then at the end in POPAD, POPFD, JMP self instructions. I would then change IP to it whenever I needed to do the check, execute it and get the result and then change IP back to where I was before. (I just had to remember to write down the previous IP.) Kinda like a poor man's version of the task switcher. That's a little bit more work, but at least I could rely on the results.
    – c00000fd
    Jun 14, 2019 at 23:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.