0

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using the command eb it gives me Memory Access Error. is there a correct way to do this trivial but complicated for a beginner task? Thanks in advance text:


Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: E:\tests\rr\test.exe
FindTheBuild service not found
Symbol search path is: srv*
Executable search path is: 
ModLoad: 00400000 0041d000   image00400000
ModLoad: 7c900000 7c9af000   ntdll.dll
ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
(6dc.43c): Break instruction exception - code 80000003 (first chance)
eax=00341eb4 ebx=7ffdc000 ecx=00000007 edx=00000080 esi=00341f48 edi=00341eb4
eip=7c90120e esp=0022fb20 ebp=0022fc94 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:000> g
(6dc.1e8): Break instruction exception - code 80000003 (first chance)
eax=7ffdc000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c90120e esp=0097ffcc ebp=0097fff4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:001> 
0:001> s -w 00400000 0041d000 6d 66
00404042  006d 0066 0000 0042 0055 0054 0054 004f  m.f...B.U.T.T.O.
0:001> db 00404042
00404042  6d 00 66 00 00 00 42 00-55 00 54 00 54 00 4f 00  m.f...B.U.T.T.O.
00404052  4e 00 00 00 00 00 53 00-61 00 6d 00 70 00 6c 00  N.....S.a.m.p.l.
00404062  65 00 20 00 57 00 69 00-6e 00 64 00 6f 00 77 00  e. .W.i.n.d.o.w.
00404072  20 00 43 00 6c 00 61 00-73 00 73 00 00 00 70 18   .C.l.a.s.s...p.
00404082  40 00 55 6e 6b 6e 6f 77-6e 20 65 72 72 6f 72 00  @.Unknown error.
00404092  00 00 5f 6d 61 74 68 65-72 72 28 29 3a 20 25 73  .._matherr(): %s
004040a2  20 69 6e 20 25 73 28 25-67 2c 20 25 67 29 20 20   in %s(%g, %g)  
004040b2  28 72 65 74 76 61 6c 3d-25 67 29 0a 00 00 41 72  (retval=%g)...Ar
0:001> eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00
                                                                 ^ Memory access error in 'eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00'

program:

#ifndef UNICODE
#define UNICODE
#endif 

#include <windows.h>
#include <windowsx.h>
#include <stdio.h>

LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);

int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PWSTR pCmdLine, int nCmdShow)
{
    // Register the window class.
    const wchar_t CLASS_NAME[]  = L"Sample Window Class";
    
    WNDCLASS wc = { };

    wc.lpfnWndProc   = WindowProc;
    wc.hInstance     = hInstance;
    wc.lpszClassName = CLASS_NAME;

    RegisterClass(&wc);

    // Create the window.

    HWND hwnd = CreateWindowEx(
        0,                              // Optional window styles.
        CLASS_NAME,                     // Window class
        L"Learn to Program Windows",    // Window text
        WS_OVERLAPPEDWINDOW,            // Window style

        // Size and position
        CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,

        NULL,       // Parent window    
        NULL,       // Menu
        hInstance,  // Instance handle
        NULL        // Additional application data
        );

    if (hwnd == NULL)
    {
        return 0;
    }

   HWND hwndButton = CreateWindow( 
    L"BUTTON",  // Predefined class; Unicode assumed 
    L"special_mf",      // Button text 
    WS_TABSTOP | WS_VISIBLE | WS_CHILD | BS_DEFPUSHBUTTON,  // Styles 
    10,         // x position 
    10,         // y position 
    200,        // Button width
    25,        // Button height
    hwnd,     // Parent window
    NULL,       // No menu.
    (HINSTANCE)GetWindowLongPtr(hwnd, GWLP_HINSTANCE), 
    NULL);      // Pointer not needed.

    Button_Enable(hwndButton , FALSE);

    ShowWindow(hwnd, nCmdShow);
    
    // Run the message loop.

    MSG msg = { };
    while (GetMessage(&msg, NULL, 0, 0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    return 0;
}

LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    switch (uMsg)
    {
    case WM_DESTROY:
        PostQuitMessage(0);
        return 0;

    case WM_PAINT:
        {
            PAINTSTRUCT ps;
            HDC hdc = BeginPaint(hwnd, &ps);



            FillRect(hdc, &ps.rcPaint, (HBRUSH) (COLOR_WINDOW+1));

            EndPaint(hwnd, &ps);
        }
        return 0;

    }
    return DefWindowProc(hwnd, uMsg, wParam, lParam);
}


INT WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
    PSTR lpCmdLine, INT nCmdShow)
{
   wWinMain(hInstance , hPrevInstance, lpCmdLine,  nCmdShow);
    return 0;
}

compiling options with mingw:

gcc -m32 -w -mwindows test.c -o test.exe
4
  • Tried your example and didn't get any memory access error, but aren't you mixing wide char with regular ones in your eb command? – Paweł Łukasik Jun 5 at 6:49
  • eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00 @PawełŁukasik ? – Someone Jun 5 at 22:53
  • @PawełŁukasik still giving me the same error – Someone Jun 5 at 23:50
  • well as pawel said i also compiled your code as windows with vs 2017 somedays back and didnt find any crash on windbg one thing i can say is you are using a very old windbg 6.1 on probably a new machine may be check with some latest versionof windbg ? image of edit – blabb Jun 6 at 15:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.