1

I'm trying to RE an application which shows after hitting a button a specific number. The number comes from a file after parsing it. Input = 5, number displayed = 5 and so on.

I was able to track down the disassembled code where the number being loaded.

v3 = *(_DWORD *)(*((_DWORD *)AfxGetModuleState() + 1) + 164);

ATL::CStringT<char,StrTraitMFC_DLL<char,ATL::ChTraitsCRT<char>>>::Format(v2 + 168, "%u", *(_DWORD *)(v13 + 1032));

The last part v13 + 1032 told me where to look on the stack and indeed I found the number.

Stack overview

00188F7C  0000000
00188F80  0000004
00188F84  0000001
00188F88  000001D

Now my question is: Is there any way in IDA to show me the code which is putting those 4 values on the stack? The surounding lines (Line1, 3 and 4) always have the same values.

  • I'm not sure if this is what you need, but since you have the place where it reads the stack, you could breakpoint and inspect the frames, and from there, go back to the function that writes to the stack. Could you give us some more context? – rev Feb 15 '15 at 20:53
2

Set a code breakpoint at the point where the stack frame is established and another one at the point where your target value gets used (and hence must have been written already).

In the condition script for the first breakpoint you can add a hardware write breakpoint for your target location; its absolute address can be computed at that point because you have the actual values of ESP and EBP. The second breakpoint is for deleting that hardware breakpoint.

In the condition script for the hardware breakpoint you can do whatever you want: check for a specific value being written, check surrounding values etc.

Note: CheatEngine was written expressly for tasks like that. You might get results quicker and more easily if you get CheatEngine instead of trying to make sense of IDAs meagerly documented - and often quite bizarre - interfaces.

Here's a rudimentary script that you can adapt by modifying the test in target_check_() and adapting the stack offset in set_target_breakpoint_(). The values there are from a quick test that I did to ensure that the code works. This is for IDA 6.7; it will definitely not work with the free IDA (v5.0).

#include "idc.idc"

static main ()
{
   set_helper_breakpoints_(LocByName("test_ufuncs_t"), 0);
}

static target_check_ (ea)
{
   auto e;

   try
   {
      Message("DbgDword(%x): %x @ EIP %x\n", ea, DbgDword(ea), EIP);

      return DbgDword(ea) == 0x410A10;
   }
   catch (e)  {  Message("error: %s\n", e.description);  }

   return 0;
}

static set_target_breakpoint_ (term_bpt)
{
   auto target_ea = ESP - 0x70;

   Message("target_ea %a\n", target_ea);

   SetBptCndEx(term_bpt, form("DelBpt(0x%x) & 0", target_ea), 0);
   AddBptEx(target_ea, 4, BPT_WRITE);
   SetBptCndEx(target_ea, form("target_check_(0x%x)", target_ea), 0);

   return 0;
}

static set_helper_breakpoints_ (init_bpt, term_bpt)
{
   if (term_bpt <= 0)
      term_bpt = FindCode(GetFunctionAttr(init_bpt, FUNCATTR_END), SEARCH_UP);

   Message("set_helper_breakpoints(): %s %s\n", GetFuncOffset(init_bpt), GetFuncOffset(term_bpt));

   AddBptEx(init_bpt, 0, BPT_DEFAULT);
   AddBptEx(term_bpt, 0, BPT_DEFAULT);
   SetBptCndEx(init_bpt, form("set_target_breakpoint_(0x%x)", term_bpt), 0);
   SetBptCndEx(term_bpt, "0", 0);
}
| improve this answer | |
  • 1
    +1 for the Cheat Engine link. many people think it's for 'cheats' and ignore the fact that it even has a full-blown kernel-level debugger! – rev Feb 16 '15 at 15:58
  • Thank you for the answer and the script: I've used now a combination of IDA and Cheat Engine which did the trick. – vigri Feb 18 '15 at 22:54
1

I'll try to guess what happening in your binary, but this will remain only my guess until you provide it.

You need to break API functions while debugging application that process both getting keyboard code and printing the result. In WinDbg it can be done like bp USER32!GetKeyboardState; dd esp+x (or dd poi(esp+x) ) Note, that this operation requires debug symbols installed.

Your question was about IDA, but in my opinion separate debugger suits better for such task.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.