Reading from buffer and printing output to a text file

Question

00001f10  2846       mov     r0, r5 
00001f12  6349       ldr     r1, [pc, #0x18c]  {data_20a0} 
00001f14  7944       add     r1, pc  {data_ce5e, "OK:%16[^:]:%16[^:]:%d:%d:%d:%d:%…"} 
00001f16  fff756ea   blx     #sscanf
00001f1c  4dd1       b     #0x1fba

After disassembling a binary I found the above ARM instructions. As far as I know the sscanf function (at 0x1f16) reads from the buffer using the format obtained from address 0x1f14 and stores the values to addresses contained in other general purpose registers. I want to know the contents of the buffer and so I thought my option is to print the buffer string to a file while the binary is running. Maybe someone can help me achieve this.

Answer 1

the buffer is at data_20a0 as comment next to instruction shows

>>> hex(0x1f12+2+0x18c)----------'0x20a0'  

are you running it under a debugger if so set a conditional logging breakpoint to print and continue

if you are not running it under debugger you may need to use some instrumentation framework

shown below is a windows example see if you can adapt it to your needs

#include <stdio.h>
int d[10] = {0};
int main(int argc, char *argv[])
{
    if (argc == 2)
    {
        sscanf_s(argv[1], "%d%d%d%d%d%d%d%d%d",
                 &d[0], &d[1], &d[2], &d[3], &d[4], &d[5], &d[6], &d[7], &d[8]);//checkpass(...);
    }
    return 0;
}

on compiling and executing this source assume checkpass(..) does some magic with sscanf_s() result
you need to know the contents of buffer , format string, and resulting output

install frida ( pip install frida-tools on windows 10 x64)
create a javascript file as below
(since I have pdb (symbols) I can use the symbol name if you don't have the symbol use address
since this is windows x64 the first 4 arguments are passed via registers rcx,rdx,r8,r9 (use appropriate registers/stack for your architecture)

var myfunc = DebugSymbol.fromName("sscanf_s");
Interceptor.attach(
    myfunc.address, {
        onEnter(args) {
            this.res = this.context.r8;//save the resultant array address touse onLeave()
            console.log("entered " + myfunc.name + "\n");
            console.log(hexdump(this.context.rcx, { length: 0x30 }) + "\n");
            console.log(hexdump(this.context.rdx, { length: 0x30 }) + "\n");
            console.log(hexdump(this.context.r8, { length: 0x30 }) + "\n");
            console.log(hexdump(this.context.r9, { length: 0x30 }) + "\n");
        },
        onLeave(args) {
            console.log(hexdump(this.res,{length:0x30}))
        }

});

run the compiled binary under frida to log the arguments and return vales as below

frida --no-pause -l sscanf.js -f sscanf.exe "1 25 39 401 598 6003 700054 800098 99999999"
     ____
    / _  |   Frida 15.1.4 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
Spawned `sscanf.exe 1 25 39 401 598 6003 700054 800098 99999999`. Resuming main thread!
entered sscanf_s

              0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
2306e24efa3  31 20 32 35 20 33 39 20 34 30 31 20 35 39 38 20  1 25 39 401 598
2306e24efb3  36 30 30 33 20 37 30 30 30 35 34 20 38 30 30 30  6003 700054 8000
2306e24efc3  39 38 20 39 39 39 39 39 39 39 39 00 00 00 00 00  98 99999999.....

               0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7ff7f3e9f340  25 64 25 64 25 64 25 64 25 64 25 64 25 64 25 64  %d%d%d%d%d%d%d%d
7ff7f3e9f350  25 64 00 00 00 00 00 00 c0 28 e4 f3 f7 7f 00 00  %d.......(......
7ff7f3e9f360  78 f3 e9 f3 f7 7f 00 00 b8 f3 e9 f3 f7 7f 00 00  x...............

               0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7ff7f3eb1bd0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7ff7f3eb1be0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7ff7f3eb1bf0  00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00  ................

               0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7ff7f3eb1bd4  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7ff7f3eb1be4  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7ff7f3eb1bf4  00 00 00 00 02 00 00 00 00 00 00 00 02 00 00 00  ................

               0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7ff7f3eb1bd0  01 00 00 00 19 00 00 00 27 00 00 00 91 01 00 00  ........'.......
7ff7f3eb1be0  56 02 00 00 73 17 00 00 96 ae 0a 00 62 35 0c 00  V...s.......b5..
7ff7f3eb1bf0  ff e0 f5 05 00 00 00 00 02 00 00 00 00 00 00 00  ................
[Local::sscanf.exe]-> Process terminated
[Local::sscanf.exe]->

Thank you for using Frida!

check the hexdump of this address 7ff7f3eb1bd0 (shown twice one onEnter() and one onLeave()

you will notice the buffer is filled with the input onLeave();