the buffer is at data_20a0 as comment next to instruction shows
>>> hex(0x1f12+2+0x18c)----------'0x20a0'
are you running it under a debugger if so set a conditional logging breakpoint to print and continue
if you are not running it under debugger you may need to use some instrumentation framework
shown below is a windows example see if you can adapt it to your needs
#include <stdio.h>
int d[10] = {0};
int main(int argc, char *argv[])
{
if (argc == 2)
{
sscanf_s(argv[1], "%d%d%d%d%d%d%d%d%d",
&d[0], &d[1], &d[2], &d[3], &d[4], &d[5], &d[6], &d[7], &d[8]);//checkpass(...);
}
return 0;
}
on compiling and executing this source assume checkpass(..) does some magic with sscanf_s() result
you need to know the contents of buffer , format string, and resulting output
install frida ( pip install frida-tools on windows 10 x64)
create a javascript file as below
(since I have pdb (symbols) I can use the symbol name if you don't have the symbol use address
since this is windows x64 the first 4 arguments are passed via registers rcx,rdx,r8,r9 (use appropriate registers/stack for your architecture)
var myfunc = DebugSymbol.fromName("sscanf_s");
Interceptor.attach(
myfunc.address, {
onEnter(args) {
this.res = this.context.r8;//save the resultant array address touse onLeave()
console.log("entered " + myfunc.name + "\n");
console.log(hexdump(this.context.rcx, { length: 0x30 }) + "\n");
console.log(hexdump(this.context.rdx, { length: 0x30 }) + "\n");
console.log(hexdump(this.context.r8, { length: 0x30 }) + "\n");
console.log(hexdump(this.context.r9, { length: 0x30 }) + "\n");
},
onLeave(args) {
console.log(hexdump(this.res,{length:0x30}))
}
});
run the compiled binary under frida to log the arguments and return vales as below
frida --no-pause -l sscanf.js -f sscanf.exe "1 25 39 401 598 6003 700054 800098 99999999"
____
/ _ | Frida 15.1.4 - A world-class dynamic instrumentation toolkit
| (_| |
> _ | Commands:
/_/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://frida.re/docs/home/
Spawned `sscanf.exe 1 25 39 401 598 6003 700054 800098 99999999`. Resuming main thread!
entered sscanf_s
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
2306e24efa3 31 20 32 35 20 33 39 20 34 30 31 20 35 39 38 20 1 25 39 401 598
2306e24efb3 36 30 30 33 20 37 30 30 30 35 34 20 38 30 30 30 6003 700054 8000
2306e24efc3 39 38 20 39 39 39 39 39 39 39 39 00 00 00 00 00 98 99999999.....
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
7ff7f3e9f340 25 64 25 64 25 64 25 64 25 64 25 64 25 64 25 64 %d%d%d%d%d%d%d%d
7ff7f3e9f350 25 64 00 00 00 00 00 00 c0 28 e4 f3 f7 7f 00 00 %d.......(......
7ff7f3e9f360 78 f3 e9 f3 f7 7f 00 00 b8 f3 e9 f3 f7 7f 00 00 x...............
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
7ff7f3eb1bd0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
7ff7f3eb1be0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
7ff7f3eb1bf0 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ................
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
7ff7f3eb1bd4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
7ff7f3eb1be4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
7ff7f3eb1bf4 00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00 ................
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
7ff7f3eb1bd0 01 00 00 00 19 00 00 00 27 00 00 00 91 01 00 00 ........'.......
7ff7f3eb1be0 56 02 00 00 73 17 00 00 96 ae 0a 00 62 35 0c 00 V...s.......b5..
7ff7f3eb1bf0 ff e0 f5 05 00 00 00 00 02 00 00 00 00 00 00 00 ................
[Local::sscanf.exe]-> Process terminated
[Local::sscanf.exe]->
Thank you for using Frida!
check the hexdump of this address 7ff7f3eb1bd0 (shown twice one onEnter() and one onLeave()
you will notice the buffer is filled with the input onLeave();