0

I'm interested in a general approach to the following problem:
The function F_Init allocates a byte buffer called Buffer with a size called BufSize. The Buffer is allocated with each frame/iteration resulting in different values for Buffer and BufSize.

There are approximately 50 different functions that pass both values as parameters in an arbitrary order, eg. assuming this is a x64 calling convention (left to right -> rcx, rdx, r8, r9), while Buffer is stored in r8 register, sometimes other functions pass it in rdx register.

Let's say I stopped the execution of the program inside 35th function that processes the Buffer how can I quickly figure out where is F_Init function? So far I've been manually tracing back the values by looking at the mov instructions, eg. currently Buffer pointer value is in rdx, but there was a mov rdx, r9, so the buffer was previously in r9 register and so on. Doing it manually although a great fun, it takes a lot of time so I'd like to know how to automate this process.

Second question, if the allocation and manipulation happens in a one giant function, how to quickly locate the call from which those values originate? The question also applies to other data types like integers, eg. some function calculated the number of files in a directory and returning 5. At some point in a different place in the code I see the value 5 in register r8 and I would like to know where is the first function that created the value 5?

How to do it in x64dbg?

1 Answer 1

1

I don't know if you are using window or linux but the general solution i can think of is this.

Every new allocate buffer must call through function such as VirtualAlloc or NtAllocateVirtualMemory (low level) or malloc for linux.

Hook the allocate function (for window it is VirtualAlloc, malloc for linux) and get the following info:

  • The length of the newly allocated buffer in the argument.
  • The address of the allocate memory from the return of that function.
  • The return address of the VirtualAlloc.

And store to a struct and avl tree (you can check the first 10 min of this video for how the structure look like: https://www.youtube.com/watch?v=icJ8HV22cbc&ab_channel=BlackHat) or you can just log it.

So now you can find the f_init by searching through the log manually.

If you want to automate the process then you must build a balance tree like the video i provided above and search in it.

For you second question it is very hard and i don't think x64dbg can do it, because it require backward slicing. You should ask a new question for that but the answer may not deal with x64dbg.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.