Logging lpRect and uFormat from DrawTextA

Question

Using APIMonitor from Rohitab I found that DrawTextA has some additional arguments I would like to log using Python and Pydbg (I'm currently logging lpchText, se below).

My current hooking code looks something like this:

def DrawTextHook(dbg, args):
   # Log lpchText
   text = dbg.get_ascii_string(incremental_read(dbg, args[1], 255))

The argument I would like to log is lpRect and uFormat. How do I extend my currrent code to log these two arguments?

Answer 1

if you really ask me i will say dump pydbg and start using logged ollydbg conditional break points it will give you the function's arguments cleanly formatted into its components or even windbg

you asked pydbg here is how you can do it in pydbg

from pydbg import *
from pydbg.defines import *

def handler_breakpoint (pydbg):   
   if pydbg.first_breakpoint:
    return DBG_CONTINUE

   arg1 =   dbg.get_arg(1,dbg.context)
   arg2 =   dbg.get_arg(2,dbg.context)
   arg3 =   dbg.get_arg(3,dbg.context)
   arg4 =   dbg.get_arg(4,dbg.context)
   arg5 =   dbg.get_arg(5,dbg.context)
   text =   dbg.read_process_memory(arg2,0x20)
   lprect = dbg.read_process_memory(arg4,0x10)

   print "hDc = %08x\nText = %08x %s\nCount = %08x\nlpRect = %08x %s\nuFormat = %08x\n" % (arg1,arg2,pydbg.get_unicode_string(text),arg3,arg4,lprect,arg5)
   return DBG_CONTINUE

dbg = pydbg()
dbg.set_callback(EXCEPTION_BREAKPOINT, handler_breakpoint)
dbg.attach(2708)
DrawTextW = dbg.func_resolve("user32", "DrawTextW")
dbg.bp_set(DrawTextW)
pydbg.debug_event_loop(dbg)

and an output for calc.exe (uses DrawTextW not A)

C:\Python27\Lib\site-packages>python calc.py

hDc = 48010f0d
Text = 000b85fe Sta
Count = ffffffff
lpRect = 0007fa7c         $   ↔
uFormat = 00000025

hDc = 4b010f0d
Text = 000b85fe Sta
Count = ffffffff
lpRect = 0007fa7c         $   ↔
uFormat = 00000025

hDc = 6c010ea9
Text = 000b8668 tan
Count = ffffffff
lpRect = 0007fa7c         $   ↔
uFormat = 00000025

hDc = 79010ea9
Text = 000b8668 tan
Count = ffffffff
lpRect = 0007fa7c         $   ↔
uFormat = 00000025

hDc = 7c010f0d
Text = 000b8688 x^2
Count = ffffffff
lpRect = 0007fa7c         $   ↔
uFormat = 00000025

hDc = 8e010f0d
Text = 000b8688 x^2
Count = ffffffff
lpRect = 0007fa7c         $   ↔
uFormat = 00000025

hDc = ab010ea9
Text = 000b869e 1/x
Count = ffffffff
lpRect = 0007fa7c         $   ↔
uFormat = 00000025

hDc = bf010ea9
Text = 000b869e 1/x
Count = ffffffff
lpRect = 0007fa7c         $   ↔
uFormat = 00000025

if you want to change to ollydbg

c:> ollydbg.exe calc.exe

alt+e -> select calc.exe -> ctrl+N ->Start typing Draw->select and rightclick ->follow import in disassembler ->shift + f4-> enable radio log function arguments to always 
leave all else to default and hit ok and f9 to run the exe

ollydbg will log all the arguments (you can selectively log only args you want also) like log only if hDc = XXX and Text == X^2 and Uformat != y

a sample output from ollydbg running calc.ex and loggging function arguments to DrawTextW

7E42D7E2   CALL to DrawTextW from calc.010061F1
             hDC = DA011041
             Text = "Sta"
             Count = FFFFFFFF (-1.)
             pRect = 0007FA28 {0.,0.,36.,29.}
             Flags = DT_CENTER|DT_VCENTER|DT_SINGLELINE
7E42D7E2   CALL to DrawTextW from calc.010061F1
             hDC = DB010B34
             Text = "Ave"
             Count = FFFFFFFF (-1.)
             pRect = 0007FA28 {0.,0.,36.,29.}
             Flags = DT_CENTER|DT_VCENTER|DT_SINGLELINE
7E42D7E2   CALL to DrawTextW from calc.010061F1
             hDC = A0010D69
             Text = "Sum"
             Count = FFFFFFFF (-1.)
             pRect = 0007FA28 {0.,0.,36.,29.}
             Flags = DT_CENTER|DT_VCENTER|DT_SINGLELINE
7E42D7E2   CALL to DrawTextW from calc.010061F1

With windbg do this

bp USER32!DrawTextW ".printf \"Text=%mu\\nRect.L=%x\\nRect.R=%x\\n\",poi(esp+8),poi(poi(esp+10)+8),poi(poi(esp+10)+c);gc"

windbg conditinal bp output

0:001> g
Text=F-E
Rect.L=24
Rect.R=1d
Text=dms
Rect.L=24
Rect.R=1d
Text=sin
Rect.L=24
Rect.R=1d
Text=cos
Rect.L=24
Rect.R=1d
Text=tan
Rect.L=24
Rect.R=1d
Text=(
Rect.L=24