1

I am learning reverse engineering (Lena's Reversing for Newbies) Part 2. I'm confused about ReadFile API.

In Part 2, I created a blank Keyfile.dat near application (without a key in it).

enter image description here

pBytesRead : addresses of number of bytes read

Size (Number of Bytes to Read) = 70 // number of bytes to read.

  1. What is -> 0? In pBytesRead and Buffer the sign -> appears with 0 and 00. What does that mean?
  2. What is Size (Number of Bytes to Read) = 70 means? Does it mean that the program should read 70 decimal?

I'm confused about this part.

2 Answers 2

1
  1. What is -> 0? In pBytesRead and Buffer the sign -> appears with 0 and 00. What does that mean?

OllyDbg wants to help you, and offer you an additional info — “What is currently at a given address?”

  • address -> something means that at the address is currently something — see the following pictures of memory dump.

(In the C-language parlance, address is a pointer to memory: “address points to something in memory,” so you may read -> as “points to”.)

  • pBytesRead = reverseMe.402173 -> 0 means that at address 402173 is currently 0,

  • Buffer = reverseMe.40211A -> 00 means that at address 40211A is currently 00.

But why 0 in the first case, and 00 in the second one?

Because - again - OllyDbg wants to help you. It is smart enough to correctly interpret the meaning of the memory content — in a given context — for you, a human:

  • In the first case (pBytesRead), the expected data is a number, so it converts the double-word (4 consecutive bytes; LPDWORD in the documentation means Long Pointer to Double-Word) into a decimal number (0 in your case):

    enter image description here

  • in the second case (Buffer), the expected data is a byte (e.g. a character), so it shows it as an ASCII-character (e.g. 'p') if it is possible, or as 2 hexadecimal digits otherwise (00 in your case):

    enter image description here


  1. What is Size (Number of Bytes to Read) = 70 means? Does it mean that the program should read 70 decimal?

Yes - more precisely, at most (maximum) 70 bytes.

0

You can find more info on ReadFile function at MSDN.

The function signature from MSDN:

BOOL ReadFile(
  HANDLE       hFile,
  LPVOID       lpBuffer,
  DWORD        nNumberOfBytesToRead,
  LPDWORD      lpNumberOfBytesRead,
  LPOVERLAPPED lpOverlapped
);

And if you agree with me, that how the function was called:

ReadFile(EAX, OFFSET 0x0040211A, 0x46, OFFSET 0x00402173, 0);

Here 0x46 (a hexadecimal number) is placed on nNumberOfBytesToRead parameter and we will read 70 (in decimal) characters.

  • hfile - handle to the file, in this case it is assigned from CreateFileA before.
7
  • Right, but what is 0x46 ? when the Keyfile.dat file is empty, why ReadFile read 0x46 or 70d ?
    – Jason
    Jun 23, 2021 at 15:18
  • @Jason 0x46 is the value for nNumberOfBytesToRead parameter. That function will read 0x46 in hex characters.
    – BadSugar
    Jun 23, 2021 at 15:24
  • Can you explain more? Where did this value come from? The ReadFile function read keyfile.dat and the value is 0x64? the 0x64 or 70d character is F in ascii. i confused :(
    – Jason
    Jun 23, 2021 at 15:28
  • @jason look at the asciitable asciitable.com
    – BadSugar
    Jun 23, 2021 at 15:34
  • 1
    ReadFile takes a parameter x==NoofBytesToRead if the file has more x api will read only x if it is less than x it will read whatever is available since you created a blank file it will read 0 bytes if you fill garbage of 3 mb in your keyfile it will return you 70 decimal bytes from that garbage at the file seek position if your file seek positon is at1.5 mb of thatgarbage it will return you 70 bytes from the 1.5 mb position
    – blabb
    Jun 23, 2021 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.