I am learning reverse engineering. (Lenas Reversing for Newbies) Part 2 I'm confused about Readfile API.

In part2 , i created blank Keyfile.dat near application. (Without key in it)

enter image description here

pBytesRead : addresses of number of bytes read

Size (Number of Bytes to Read) = 70 // number of bytes to read.

  1. What is -> 0 ? in pBytesRead and Buffer the sign -> appear with 0 and 00. what does that mean?
  2. What is Size (Number of Bytes to Read) = 70 means? it mean the program should read 70 decimal?

i confused about this part.


You can find more info on Readfile function at MSDN:

From MSDN the function signature:

BOOL ReadFile(
  HANDLE       hFile,
  LPVOID       lpBuffer,
  DWORD        nNumberOfBytesToRead,
  LPDWORD      lpNumberOfBytesRead,
  LPOVERLAPPED lpOverlapped

And if you agree with me, that how the function was called: ReadFile(EAX, OFFSET 0x0040211A, 0x46, OFFSET 0x00402173, 0);

here 0x46 in hex is placed on nNumberOfBytesToRead parameter where we will read 70(in decimal) characters

  • hfile - handle to the file, in this case it is assigned from CreateFileA before.
  • Right, but what is 0x46 ? when the Keyfile.dat file is empty, why ReadFile read 0x46 or 70d ?
    – Jason
    Jun 23 at 15:18
  • @Jason 0x46 is the value for nNumberOfBytesToRead parameter. That function will read 0x46 in hex characters.
    – Pi Pony
    Jun 23 at 15:24
  • Can you explain more? Where did this value come from? The ReadFile function read keyfile.dat and the value is 0x64? the 0x64 or 70d character is F in ascii. i confused :(
    – Jason
    Jun 23 at 15:28
  • @jason look at the asciitable asciitable.com
    – Pi Pony
    Jun 23 at 15:34
  • @jason It's 0x46 not 0x64! That's where you get confused, that value is for readFile function saying to read 70 characters from the file
    – Pi Pony
    Jun 23 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.