0

Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv

Now, the two parameters for the function are:

LEA param_2=>local_8,[EBP + -0x4]
MOV param_1,dword ptr [param_1 + 0x288]

I know that param_2 is the address where the returned value of the function will be stored.

I know that param_1 is the address of the address of the form, so param_1 is 050f6d70. I go there and find address D83F4400 (00443FD8) I right click the address and choose follow in dump, at 00443FD8 I find some sort of form:

00443FD8  FC EA 47 00 B4 19 47 00 F8 E9 47 00 78 2E 48 00  üêG.´.G.øéG.x.H.  
00443FE8  04 09 47 00 A0 21 47 00 CC 0D 47 00 00 32 48 00  ..G. !G.Ì.G..2H.  
00443FF8  94 2E 48 00 8C 2E 48 00 64 7B 44 00 F4 4C 47 00  ..H...H.d{D.ôLG.  
00444008  14 4D 47 00 CC 4A 47 00 BC 07 47 00 70 08 47 00  .MG.ÌJG.¼.G.p.G.  
00444018  B4 0E 47 00 6C 31 47 00 64 4B 47 00 E0 4B 47 00  ´.G.l1G.dKG.àKG.  
00444028  28 47 47 00 C4 4B 47 00 84 25 47 00 70 2D 47 00  (GG.ÄKG..%G.p-G.  
00444038  6C 80 44 00 70 2C 47 00 28 81 44 00 0C 2D 47 00  l.D.p,G.(.D..-G.  
00444048  CC 81 44 00 A4 34 47 00 80 49 47 00 60 4C 47 00  Ì.D.¤4G..IG.`LG.  
00444058  10 7C 44 00 4C 7E 44 00 08 7E 44 00 D0 7F 44 00  .|D.L~D..~D.Ð.D.  
00444068  7C 7E 44 00 2C 7E 44 00 E0 7E 44 00 34 7F 44 00  |~D.,~D.à~D.4.D.  
00444078  05 54 45 64 69 74 90 90 84 40 44 00 07 05 54 45  [email protected]  
00444088  64 69 74 D8 3F 44 00 44 3F 44 00 33 00 08 53 74  ditØ?D.D?D.3..St  
00444098  64 43 74 72 6C 73 2A 00 BC DD 48 00 20 01 00 FF  dCtrls*.¼ÝH. ..ÿ  
004440A8  20 01 00 FF 01 00 00 00 00 00 00 80 01 00 00 00   ..ÿ............  
004440B8  0A 00 0A 41 75 74 6F 53 65 6C 65 63 74 BC DD 48  ...AutoSelect¼ÝH  
004440C8  00 1F 01 00 FF 30 7C 44 00 01 00 00 00 00 00 00  ....ÿ0|D........  
004440D8  80 01 00 00 00 0B 00 08 41 75 74 6F 53 69 7A 65  ........AutoSize  
004440E8  60 20 46 00 1C 01 00 FF 44 7C 44 00 01 00 00 00  ` F....ÿD|D.....  
004440F8  00 00 00 80 01 00 00 00 0C 00 0B 42 6F 72 64 65  ...........Borde  
00444108  72 53 74 79 6C 65 DC 3D 44 00 23 01 00 FF 68 7C  rStyleÜ=D.#..ÿh|  
00444118  44 00 01 00 00 00 00 00 00 80 00 00 00 00 0D 00  D...............  
00444128  08 43 68 61 72 43 61 73 65 2C 89 45 00 54 00 00  .CharCase,.E.T..  
00444138  FF 38 11 47 00 54 11 47 00 00 00 00 80 05 00 00  ÿ8.G.T.G........  
00444148  80 0E 00 05 43 6F 6C 6F 72 BC DD 48 00 D5 00 00  ....Color¼ÝH.Õ..  
00444158  FF 2C 4D 47 00 50 4D 47 00 00 00 00 80 00 00 00  ÿ,MG.PMG........  
00444168  80 0F 00 05 43 74 6C 33 44 D8 E8 46 00 5A 00 00  ....Ctl3DØèF.Z..  
00444178  FF 5A 00 00 FF 01 00 00 00 00 00 00 80 F4 FF FF  ÿZ..ÿ........ôÿÿ  
00444188  FF 10 00 0A 44 72 61 67 43 75 72 73 6F 72 C8 EA  ÿ...DragCursorÈê  
00444198  46 00 49 00 00 FF 3C 00 00 FE 01 00 00 00 00 00  F.I..ÿ<..þ......  
004441A8  00 80 00 00 00 00 11 00 08 44 72 61 67 4D 6F 64  .........DragMod  
004441B8  65 BC DD 48 00 45 00 00 FF 78 0F 47 00 01 00 00  e¼ÝH.E..ÿx.G....  
004441C8  00 00 00 00 80 01 00 00 00 12 00 07 45 6E 61 62  ............Enab  
004441D8  6C 65 64 7C 8C 45 00 50 00 00 FF B0 10 47 00 C0  led|.E.P..ÿ°.G.À  
004441E8  10 47 00 00 00 00 80 00 00 00 80 13 00 04 46 6F  .G............Fo  
004441F8  6E 74 BC DD 48 00 21 01 00 FF 7C 7C 44 00 01 00  nt¼ÝH.!..ÿ||D...  
00444208  00 00 00 00 00 80 01 00 00 00 14 00 0D 48 69 64  .............Hid  
00444218  65 53 65 6C 65 63 74 69 6F 6E 5C EF 46 00 E4 00  eSelection\ïF.ä.  
00444228  00 FF E4 00 00 FF 01 00 00 00 00 00 00 80 03 00  .ÿä..ÿ..........  
00444238  00 00 15 00 07 49 6D 65 4D 6F 64 65 E4 EF 46 00  .....ImeModeäïF.  
00444248  E8 00 00 FF E8 00 00 FF 01 00 00 00 00 00 00 80  è..ÿè..ÿ........  
00444258  00 00 00 80 16 00 07 49 6D 65 4E 61 6D 65 10 DE  .......ImeName.Þ  
00444268  48 00 18 01 00 FF 90 7C 44 00 01 00 00 00 00 00  H....ÿ.|D.......  
00444278  00 80 00 00 00 00 17 00 09 4D 61 78 4C 65 6E 67  .........MaxLeng  
00444288  74 68 BC DD 48 00 22 01 00 FF C0 7C 44 00 01 00  th¼ÝH."..ÿÀ|D...  
00444298  00 00 00 00 00 80 00 00 00 00 18 00 0A 4F 45 4D  .............OEM  
004442A8  43 6F 6E 76 65 72 74 BC DD 48 00 47 00 00 FF 5C  Convert¼ÝH.G..ÿ\  
004442B8  11 47 00 01 00 00 00 00 00 00 80 00 00 00 00 19  .G..............  
004442C8  00 0B 50 61 72 65 6E 74 43 6F 6C 6F 72 BC DD 48  ..ParentColor¼ÝH  
004442D8  00 D6 00 00 FF 5C 4D 47 00 01 00 00 00 00 00 00  .Ö..ÿ\MG........  
004442E8  80 01 00 00 00 1A 00 0B 50 61 72 65 6E 74 43 74  ........ParentCt  
004442F8  6C 33 44 BC DD 48 00 46 00 00 FF DC 10 47 00 01  l3D¼ÝH.F..ÿÜ.G..  
00444308  00 00 00 00 00 00 80 01 00 00 00 1B 00 0A 50 61  ..............Pa  
00444318  72 65 6E 74 46 6F 6E 74 BC DD 48 00 6A 00 00 FF  rentFont¼ÝH.j..ÿ  
00444328  18 11 47 00 01 00 00 00 00 00 00 80 01 00 00 00  ..G.............  
00444338  1C 00 0E 50 61 72 65 6E 74 53 68 6F 77 48 69 6E  ...ParentShowHin  
00444348  74 E4 DD 48 00 1D 01 00 FF 44 7D 44 00 01 00 00  täÝH....ÿD}D....  
00444358  00 00 00 00 80 00 00 00 00 1D 00 0C 50 61 73 73  ............Pass  
00444368  77 6F 72 64 43 68 61 72 90 C1 44 00 5C 00 00 FF  wordChar.ÁD.\..ÿ  
00444378  AC 0F 47 00 01 00 00 00 00 00 00 80 00 00 00 80  ¬.G.............  
00444388  1E 00 09 50 6F 70 75 70 4D 65 6E 75 BC DD 48 00  ...PopupMenu¼ÝH.  
00444398  1E 01 00 FF CC 7D 44 00 01 00 00 00 00 00 00 80  ...ÿÌ}D.........  
004443A8  00 00 00 00 1F 00 08 52 65 61 64 4F 6E 6C 79 BC  .......ReadOnly¼  
004443B8  DD 48 00 69 00 00 FF FC 10 47 00 D4 10 47 00 00  ÝH.i..ÿü.G.Ô.G..  
004443C8  00 00 80 00 00 00 80 20 00 08 53 68 6F 77 48 69  ....... ..ShowHi  
004443D8  6E 74 FC EA 46 00 80 4D 47 00 00 4E 47 00 01 00  ntüêF..MG..NG...  
004443E8  00 00 00 00 00 80 FF FF FF FF 21 00 08 54 61 62  ......ÿÿÿÿ!..Tab  
004443F8  4F 72 64 65 72 BC DD 48 00 D4 00 00 FF 18 4E 47  Order¼ÝH.Ô..ÿ.NG  
etc etc.

And then I'm stuck, I went through all the functions involved in that function but I was unable to determine how the function find out which TEdit retrieve the text from.

Is there any way either in x64dbg, ghidra,ollydbg or Ida pro to find out how it knows? or even a script/plugin that gives the reference when you run a sort of analysis?

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.