OllyDbg - ReadFile API

Question

I am learning reverse engineering (Lena's Reversing for Newbies) Part 2. I'm confused about ReadFile API.

In Part 2, I created a blank Keyfile.dat near application (without a key in it).

pBytesRead : addresses of number of bytes read

Size (Number of Bytes to Read) = 70 // number of bytes to read.

1. What is -> 0? In pBytesRead and Buffer the sign -> appears with 0 and 00. What does that mean?
2. What is Size (Number of Bytes to Read) = 70 means? Does it mean that the program should read 70 decimal?

I'm confused about this part.

Answer 1

1. What is -> 0? In pBytesRead and Buffer the sign -> appears with 0 and 00. What does that mean?

OllyDbg wants to help you, and offer you an additional info — “What is currently at a given address?”

• address -> something means that at the address is currently something — see the following pictures of memory dump.

(In the C-language parlance, address is a pointer to memory: “address points to something in memory,” so you may read -> as “points to”.)

• pBytesRead = reverseMe.402173 -> 0 means that at address 402173 is currently 0,

• Buffer = reverseMe.40211A -> 00 means that at address 40211A is currently 00.

But why 0 in the first case, and 00 in the second one?

Because - again - OllyDbg wants to help you. It is smart enough to correctly interpret the meaning of the memory content — in a given context — for you, a human:

• In the first case (pBytesRead), the expected data is a number, so it converts the double-word (4 consecutive bytes; LPDWORD in the documentation means Long Pointer to Double-Word) into a decimal number (0 in your case):

  

• in the second case (Buffer), the expected data is a byte (e.g. a character), so it shows it as an ASCII-character (e.g. 'p') if it is possible, or as 2 hexadecimal digits otherwise (00 in your case):

  

---

2. What is Size (Number of Bytes to Read) = 70 means? Does it mean that the program should read 70 decimal?

Yes - more precisely, at most (maximum) 70 bytes.

Answer 2

You can find more info on ReadFile function at MSDN.

The function signature from MSDN:

BOOL ReadFile(
  HANDLE       hFile,
  LPVOID       lpBuffer,
  DWORD        nNumberOfBytesToRead,
  LPDWORD      lpNumberOfBytesRead,
  LPOVERLAPPED lpOverlapped
);

And if you agree with me, that how the function was called:

ReadFile(EAX, OFFSET 0x0040211A, 0x46, OFFSET 0x00402173, 0);

Here 0x46 (a hexadecimal number) is placed on nNumberOfBytesToRead parameter and we will read 70 (in decimal) characters.

• hfile - handle to the file, in this case it is assigned from CreateFileA before.