0

I am using Time Travel Debugging feature of WinDbg to log string output with position of trace to help me more easily isolate sections of codes I want to analyse, using command like below:

bp MSVCR100!wcscpy_s ".printf \"msvcr100!wcscpy_s source='%mu' \",r8;!position;g"

However when I use examine symbols command the wcscpy_s is specified in so many DLLs. At the moment I am using breakpoint on the C/C++ runtime versions and NTDLL versions, however to avoid missing info should I also be setting breakpoints on these routines in other DLLs? What is there purpose? What is the significant of _imp__o and _imp prefix?

0:000> x *!*wcscpy_s*
00007ff8`6be51668 TTDRecordCPU!_imp_wcscpy_s = <no type information>
00007ff8`6bdef4d0 TTDRecordCPU!wcscpy_s (wcscpy_s)
00007ff8`8eac9498 KERNEL32!_imp_wcscpy_s = <no type information>
00007ff8`8ffe7920 USER32!_imp_wcscpy_s = <no type information>
00007ff8`9042a358 OLEAUT32!_imp_wcscpy_s = <no type information>
00007ff8`9042a358 OLEAUT32!_imp__o_wcscpy_s = <no type information>
00007ff8`90797b20 ntdll!wcscpy_s (wcscpy_s)
00000000`56d68c6c MSVCR90!wcscpy_s (unsigned short *, unsigned int64, wchar_t *)
00000000`56f169d8 MSVCR100!wcscpy_s (wcscpy_s)
00000000`5706f6e0 ATL100!wcscpy_s (wcscpy_s)
00007ff8`6ee5cde0 mscoreei!wcscpy_s (wcscpy_s)
00007ff8`7383ac64 mscoree!wcscpy_s (wcscpy_s)
00007ff8`7590a8d0 AcGenral!_imp_wcscpy_s = <no type information>
00007ff8`767d6298 ncryptsslp!_imp_wcscpy_s = <no type information>
00007ff8`7a9e73d0 Oleacc!_imp_wcscpy_s = <no type information>
00007ff8`7a9e73d0 Oleacc!_imp__o_wcscpy_s = <no type information>
00007ff8`829c1640 MPR!_imp_wcscpy_s = <no type information>
00007ff8`82e0ae90 iertutil!_imp_wcscpy_s = <no type information>
00007ff8`835eed50 urlmon!_imp_wcscpy_s = <no type information>
00007ff8`88e6d860 CoreUIComponents!_imp_wcscpy_s = <no type information>
00007ff8`894d1258 wintypes!_imp_wcscpy_s = <no type information>
00007ff8`894d1258 wintypes!_imp__o_wcscpy_s = <no type information>
00007ff8`8acf7020 dcomp!_imp_wcscpy_s = <no type information>
00007ff8`8acf7020 dcomp!_imp__o_wcscpy_s = <no type information>
00007ff8`8ae61580 CoreMessaging!_imp_wcscpy_s = <no type information>
00007ff8`8b6502f0 apphelp!_imp_wcscpy_s = <no type information>
00007ff8`8c2a1698 dxcore!_imp_wcscpy_s = <no type information>
00007ff8`8c2a1698 dxcore!_imp__o_wcscpy_s = <no type information>
00007ff8`8c3b6e78 dxgi!_imp_wcscpy_s = <no type information>
00007ff8`8c6a2ca8 ntmarta!_imp_wcscpy_s = <no type information>
00007ff8`8c6a2ca8 ntmarta!_imp__o_wcscpy_s = <no type information>
00007ff8`8c952838 schannel!o_wcscpy_s (_o_wcscpy_s)
00007ff8`8c99f328 schannel!_imp_wcscpy_s = <no type information>
00007ff8`8c99f328 schannel!_imp__o_wcscpy_s = <no type information>
00007ff8`8c952838 schannel!wcscpy_s (wcscpy_s)
00007ff8`8ca23900 rsaenh!_imp_wcscpy_s = <no type information>
00007ff8`8cbca398 IPHLPAPI!_imp_wcscpy_s = <no type information>
00007ff8`8ce913d0 mswsock!_imp_wcscpy_s = <no type information>
00007ff8`8d4958e0 sxs!_imp_wcscpy_s = <no type information>
00007ff8`8d623cee powrprof!o_wcscpy_s (_o_wcscpy_s)
00007ff8`8d633380 powrprof!_imp_wcscpy_s = <no type information>
00007ff8`8d633380 powrprof!_imp__o_wcscpy_s = <no type information>
00007ff8`8d623cee powrprof!wcscpy_s (wcscpy_s)
00007ff8`8d6a2970 ucrtbase!o_wcscpy_s (_o_wcscpy_s)
00007ff8`8d6b4340 ucrtbase!wcscpy_s (wcscpy_s)
00007ff8`8da86040 KERNELBASE!_imp_wcscpy_s = <no type information>
00007ff8`8dc47278 msvcp_win!_imp_wcscpy_s = <no type information>
00007ff8`8dc47278 msvcp_win!_imp__o_wcscpy_s = <no type information>
00007ff8`8dccef94 gdi32full!o_wcscpy_s (_o_wcscpy_s)
00007ff8`8dd6f0d8 gdi32full!_imp_wcscpy_s = <no type information>
00007ff8`8dd6f0d8 gdi32full!_imp__o_wcscpy_s = <no type information>
00007ff8`8dccef94 gdi32full!wcscpy_s (wcscpy_s)
00007ff8`8e3e9580 windows_storage!_imp_wcscpy_s = <no type information>
00007ff8`8e3e9580 windows_storage!_imp__o_wcscpy_s = <no type information>
00007ff8`8e6ba310 bcryptPrimitives!_imp_wcscpy_s = <no type information>
00007ff8`8f810af0 SHELL32!_imp_wcscpy_s = <no type information>
00007ff8`8f810af0 SHELL32!_imp__o_wcscpy_s = <no type information>
00007ff8`8f9d0078 ADVAPI32!_imp_wcscpy_s = <no type information>
00007ff8`8ff38b20 WS2_32!_imp_wcscpy_s = <no type information>
00007ff8`9016d4e8 sechost!_imp_wcscpy_s = <no type information>
00007ff8`902ab920 msctf!_imp_wcscpy_s = <no type information>
00007ff8`9034e1b0 msvcrt!wcscpy_s (wcscpy_s)
00007ff8`90551fb8 ole32!_imp_wcscpy_s = <no type information>
00007ff8`90551fb8 ole32!_imp__o_wcscpy_s = <no type information>

Checking in IDA Pro one example from ole32 seems to indicate it is in the import table

;Imports from api-ms-win-crt-private-l1-1-0.dll
extrn __imp__o_wcscpy_s:qword

If I disassemble the reference with WinDbg it doesn't look like valid wcscpy function showing:

0:000> uf ole32!_imp_wcscpy_s
Flow analysis was incomplete, some code may be missing
ole32!_imp__o_wcscpy_s:
00007ff8`90551fb8 7029            jo      ole32!_imp___C_specific_handler+0x3 (00007ff8`90551fe3)

ole32!_imp__o_wcscpy_s+0x2:
00007ff8`90551fba 6a8d            push    0FFFFFFFFFFFFFF8Dh
00007ff8`90551fbc f8              clc
00007ff8`90551fbd 7f00            jg      ole32!_imp__o_wcscpy_s+0x7 (00007ff8`90551fbf)  Branch

ole32!_imp__o_wcscpy_s+0x7:
00007ff8`90551fbf 00d0            add     al,dl
00007ff8`90551fc1 0a6f8d          or      ch,byte ptr [rdi-73h]
00007ff8`90551fc4 f8              clc
00007ff8`90551fc5 7f00            jg      ole32!_imp__o_wcsncat_s+0x7 (00007ff8`90551fc7)  Branch

ole32!_imp__o_wcsncat_s+0x7:
00007ff8`90551fc7 00d0            add     al,dl
  • 1
    it's not code, it's an address. Look at the bytes (read from the end): 007ff88d6a2970. – Paweł Łukasik Jan 8 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.