1

I'm debugging a Qt App and trying to view QT string object data within debugger. I'm referring to this blog which shows how to do that however ,i dont have access to source code. windbg lacks the ability to display basic QT data. In windbg I want to see what all QtStrings are being passed to any Qt-API.

In following disassembly string object returned by toString() are being passed to setHttpUserAgent API, arguments are placed on rcx and rdx registers. I want to view those strings in windbg / any debugger.

.text:00000001400424CC                 lea     rdx, [rbp+57h+var_90]
.text:00000001400424D0                 mov     rcx, rax
.text:00000001400424D3                 call    cs:?toString@QVariant@@QEBA?AVQString@@XZ ; QVariant::toString(void)
.text:00000001400424D9                 nop
.text:00000001400424D9 ;   } 
.text:00000001400424DA                 mov     rdx, rax
.text:00000001400424DD                 mov     rcx, r14
.text:00000001400424E0                 call    cs:?setHttpUserAgent@QWebEngineProfile@@QEAAXAEBVQString@@@Z ; QWebEngineProfile::setHttpUserAgent(QString const &)
.text:00000001400424E6                 nop
.text:00000001400424E6 ;   }

To do this i believe i need to have better understanding of Qt string's memory layout. If there is any document which can help me figure that out please let me know.

Thanks in Advance.

2

the function toString Returns a Qstring in rax
doing db poi(@rax) should show you the string after you step over the function

a small automated breakpoint

setting a conditional breakpoint that sets another one shot breakpoint on return address and prints the content of rax and continues

0:006> bl (should be in one line )
     0 e Disable Clear  00000000`5ffd7220     0001 (0001)  0:**** 
Qt5Core!QT::QVariant::toString "bp /1 @$ra \"db poi(@rax) l30;.echo ========;gc\";gc"
0:006> g
0000027c`ca346580  02 00 00 00 05 00 00 00-06 00 00 00 00 00 00 00  ................
0000027c`ca346590  18 00 00 00 00 00 00 00-73 00 74 00 61 00 72 00  ........s.t.a.r.
0000027c`ca3465a0  74 00 00 00 00 00 00 00-d8 be 55 86 00 45 02 80  t.........U..E..
========
0000027c`d0feb620  02 00 00 00 10 00 00 00-11 00 00 00 00 00 00 00  ................
0000027c`d0feb630  18 00 00 00 00 00 00 00-30 00 30 00 30 00 30 00  ........0.0.0.0.
0000027c`d0feb640  30 00 30 00 30 00 30 00-30 00 30 00 34 00 30 00  0.0.0.0.0.0.4.0.
========
0000027c`ca45a750  02 00 00 00 0c 00 00 00-0d 00 00 00 00 00 00 00  ................
0000027c`ca45a760  18 00 00 00 00 00 00 00-5b 00 6d 00 61 00 69 00  ........[.m.a.i.
0000027c`ca45a770  6e 00 20 00 65 00 6e 00-74 00 72 00 79 00 5d 00  n. .e.n.t.r.y.].
========
00000000`60093038  ff ff ff ff 00 00 00 00-00 00 00 00 00 00 00 00  ................
00000000`60093048  18 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
00000000`60093058  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
========
0000027c`ca343040  02 00 00 00 04 00 00 00-05 00 00 00 01 00 00 00  ................
0000027c`ca343050  18 00 00 00 00 00 00 00-4e 00 61 00 6d 00 65 00  ........N.a.m.e.
0000027c`ca343060  00 00 61 74 69 6f 6e 00-84 bb 01 83 00 29 01 90  ..ation......)..
========
0000027c`ca3433d0  02 00 00 00 07 00 00 00-08 00 00 00 01 00 00 00  ................
0000027c`ca3433e0  18 00 00 00 00 00 00 00-41 00 64 00 64 00 72 00  ........A.d.d.r.
0000027c`ca3433f0  65 00 73 00 73 00 00 00-bd bb 48 83 00 3c 01 95  e.s.s.....H..<..
========
1
  • Thank you very much! It worked! That was really helpful. – Dev.K. May 6 '20 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.