Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
Does somebody knows what _acmdln_dll is ? I could not find any useful documentation about that.
I am asking because I have the following line in the assembly which I try to analyze:
MOV EAX, DWORD PTR DS : [_acmdln_dll]
After that line I have in register EAX the path of the current process. So my assumption is now the _acmdln_dll stores somehow the path as string sequence.
Is that true ?
Can someone confirm that or does someone know more informations about _acmdln_dll ?
These are global variables provided by the Microsoft run time library. Here is an excerpt of MSDN on-line documentation speaking about the _acmdln variable:
_acmdln,_tcmdln,_wcmdlnThese variables store the complete command line.
_acmdlnstores the data as a character string._wcmdlnstores the data as a wide character string._tcmdlncan be defined as either_acmdlnor_wcmdln, depending on which is appropriate.
well after rereading the original question it appears both my answer
and the answer i followed up do not give an answer to the original question
original question asks about acmdln_dll which is nowhere to be found in vs crt
i leave the answer as it is assuming the suffix __dll to be in code that is not native ms like from reactos here
the answer below is pertinent to _acmdln without the suffix _dll see edit 3 also
the complete source code is available to you for acmdln if you have installed even the express version of visual studio.
compile a simple hello world with debug info /Zi and view the source code as to what it is
source file in crt directory of visual studio
DS:[00408018]=7C812FBD (kernel32.GetCommandLineA)
Jump from __tmainCRTStartup+9B
crt0.c:252. _tcmdln = (_TSCHAR *)GetCommandLineT();
here is a relevent disassembly notice the result of GetCommandline being moved to acmdln a global
/*
* command line, environment, and a few other globals
*/
#ifdef WPRFLAG
wchar_t *_wcmdln; /* points to wide command line */
#else /* WPRFLAG */
char *_acmdln; /* points to command line */
#endif /* WPRFLAG */
char *_aenvptr = NULL; /* points to environment block */
wchar_t *_wenvptr = NULL; /* points to wide environment block */
disassembly
004014D9 CALL newheapt._amsg_exit
004014DE POP ECX
004014DF CALL NEAR DWORD PTR DS:[<&KERNEL32.GetCommandLineA>] ; _tcmdln = (_TSCHAR *)GetCommandLineT();
004014E5 MOV DWORD PTR DS:[_acmdln], EAX
004014EA CALL newheapt.__crtGetEnvironmentStringsA ; _tenvptr = (_TSCHAR *)GetEnvironmentStringsT();
004014EF MOV DWORD PTR DS:[_aenvptr], EAX
004014F4 CALL newheapt._setargv ; if ( _tsetargv() < 0 )
004014F9 TEST EAX, EAX
004014FB JNS SHORT newheapt.00401505
004014FD PUSH 8 ; _amsg_exit(_RT_SPACEARG);
004014FF CALL newheapt._amsg_exit
00401504 POP ECX
00401505 CALL newheapt._setenvp ; if ( _tsetenvp() < 0 )
0040150A TEST EAX, EAX
0040150C JNS SHORT newheapt.00401516
0040150E PUSH 9 ; _amsg_exit(_RT_SPACEENV);
edit 3
from a general search it seems that this is defined in crtdll.dll
C:\WINDOWS\system32>grep -rs _acmdln_dll *
Binary file crtdll.dll matches
Binary file dllcache/crtdll.dll matches
^C
C:\WINDOWS\system32>
loading the dll in ollydbg _acmdln_dll is exactly same as _acmdln
73D91D02 |> \FF15 4410>CALL NEAR DWORD PTR DS:[<&KERNEL32.GetCommandLineA>] ; [GetCommandLineA
73D91D08 |. A3 CC3EDB>MOV DWORD PTR DS:[_acmdln_dll], EAX
73D91D0D |. FF15 4010>CALL NEAR DWORD PTR DS:[<&KERNEL32.GetEnvironmentStrings>>; [GetEnvironmentStrings
73D91D13 |. A3 D03EDB>MOV DWORD PTR DS:[73DB3ED0], EAX
73D91D18 |. FF15 0411>CALL NEAR DWORD PTR DS:[<&KERNEL32.GetVersion>] ; kernel32.GetVersion
and this crtdll.dll seems to be from an older windows sdk a brief google yields one page which alludes crtdll.lib belonging to windows sdk 3.5 era
