1

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using the command eb it gives me Memory Access Error. is there a correct way to do this trivial but complicated for a beginner task? Thanks in advance text:


Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: E:\tests\rr\test.exe
FindTheBuild service not found
Symbol search path is: srv*
Executable search path is: 
ModLoad: 00400000 0041d000   image00400000
ModLoad: 7c900000 7c9af000   ntdll.dll
ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
(6dc.43c): Break instruction exception - code 80000003 (first chance)
eax=00341eb4 ebx=7ffdc000 ecx=00000007 edx=00000080 esi=00341f48 edi=00341eb4
eip=7c90120e esp=0022fb20 ebp=0022fc94 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - 
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:000> g
(6dc.1e8): Break instruction exception - code 80000003 (first chance)
eax=7ffdc000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c90120e esp=0097ffcc ebp=0097fff4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000246
ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:001> 
0:001> s -w 00400000 0041d000 6d 66
00404042  006d 0066 0000 0042 0055 0054 0054 004f  m.f...B.U.T.T.O.
0:001> db 00404042
00404042  6d 00 66 00 00 00 42 00-55 00 54 00 54 00 4f 00  m.f...B.U.T.T.O.
00404052  4e 00 00 00 00 00 53 00-61 00 6d 00 70 00 6c 00  N.....S.a.m.p.l.
00404062  65 00 20 00 57 00 69 00-6e 00 64 00 6f 00 77 00  e. .W.i.n.d.o.w.
00404072  20 00 43 00 6c 00 61 00-73 00 73 00 00 00 70 18   .C.l.a.s.s...p.
00404082  40 00 55 6e 6b 6e 6f 77-6e 20 65 72 72 6f 72 00  @.Unknown error.
00404092  00 00 5f 6d 61 74 68 65-72 72 28 29 3a 20 25 73  .._matherr(): %s
004040a2  20 69 6e 20 25 73 28 25-67 2c 20 25 67 29 20 20   in %s(%g, %g)  
004040b2  28 72 65 74 76 61 6c 3d-25 67 29 0a 00 00 41 72  (retval=%g)...Ar
0:001> eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00
                                                                 ^ Memory access error in 'eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00'

program:

#ifndef UNICODE
#define UNICODE
#endif 

#include <windows.h>
#include <windowsx.h>
#include <stdio.h>

LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);

int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PWSTR pCmdLine, int nCmdShow)
{
    // Register the window class.
    const wchar_t CLASS_NAME[]  = L"Sample Window Class";
    
    WNDCLASS wc = { };

    wc.lpfnWndProc   = WindowProc;
    wc.hInstance     = hInstance;
    wc.lpszClassName = CLASS_NAME;

    RegisterClass(&wc);

    // Create the window.

    HWND hwnd = CreateWindowEx(
        0,                              // Optional window styles.
        CLASS_NAME,                     // Window class
        L"Learn to Program Windows",    // Window text
        WS_OVERLAPPEDWINDOW,            // Window style

        // Size and position
        CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,

        NULL,       // Parent window    
        NULL,       // Menu
        hInstance,  // Instance handle
        NULL        // Additional application data
        );

    if (hwnd == NULL)
    {
        return 0;
    }

   HWND hwndButton = CreateWindow( 
    L"BUTTON",  // Predefined class; Unicode assumed 
    L"special_mf",      // Button text 
    WS_TABSTOP | WS_VISIBLE | WS_CHILD | BS_DEFPUSHBUTTON,  // Styles 
    10,         // x position 
    10,         // y position 
    200,        // Button width
    25,        // Button height
    hwnd,     // Parent window
    NULL,       // No menu.
    (HINSTANCE)GetWindowLongPtr(hwnd, GWLP_HINSTANCE), 
    NULL);      // Pointer not needed.

    Button_Enable(hwndButton , FALSE);

    ShowWindow(hwnd, nCmdShow);
    
    // Run the message loop.

    MSG msg = { };
    while (GetMessage(&msg, NULL, 0, 0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    return 0;
}

LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
    switch (uMsg)
    {
    case WM_DESTROY:
        PostQuitMessage(0);
        return 0;

    case WM_PAINT:
        {
            PAINTSTRUCT ps;
            HDC hdc = BeginPaint(hwnd, &ps);



            FillRect(hdc, &ps.rcPaint, (HBRUSH) (COLOR_WINDOW+1));

            EndPaint(hwnd, &ps);
        }
        return 0;

    }
    return DefWindowProc(hwnd, uMsg, wParam, lParam);
}


INT WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
    PSTR lpCmdLine, INT nCmdShow)
{
   wWinMain(hInstance , hPrevInstance, lpCmdLine,  nCmdShow);
    return 0;
}

compiling options with mingw:

gcc -m32 -w -mwindows test.c -o test.exe
4
  • Tried your example and didn't get any memory access error, but aren't you mixing wide char with regular ones in your eb command? Jun 5, 2021 at 6:49
  • eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00 @PawełŁukasik ?
    – Someone
    Jun 5, 2021 at 22:53
  • @PawełŁukasik still giving me the same error
    – Someone
    Jun 5, 2021 at 23:50
  • well as pawel said i also compiled your code as windows with vs 2017 somedays back and didnt find any crash on windbg one thing i can say is you are using a very old windbg 6.1 on probably a new machine may be check with some latest versionof windbg ? image of edit
    – blabb
    Jun 6, 2021 at 15:31

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.