1

I want to hook a certain function in a program, the problem is I don't know where the function is located. All I know is that it takes as an argument a string. A string that I know. My problem is I am unable to find the function I tried Dieder Steven's OllyStepNSearch plugin. But no success, my guess is that the function has several parameters and that the pointer to string is passed via the stack. Is there a plugin of any existing debugger that can help me find that string when is referenced ?

Please help

Thanks

  • A hardware breakpoint when reading at the memory address where the string is? – joxeankoret Apr 4 '15 at 11:10
  • the string is dinamic, is not static can't find references to it – opc0de Apr 4 '15 at 11:12
  • If the string is created at runtime, do you know how is it created/calculated? If you know that part, put a hw breakpoint after it's created. If not... good luck. You may want to record a trace with Intel PIN or similar to determine when is it being created. – joxeankoret Apr 4 '15 at 11:15
  • If there's anything done to the string (written to a file, written to the registry, sent over the network), tracing the process with procmon and checking the stack at the relevant instruction might help. – Guntram Blohm Apr 4 '15 at 12:43
2

you should have something to grip at if you know that eax may contain the string at some point or [esp+8] contains the string at some point

you can employ ollydbg's (1.10) Set Condition to RunTrace and trace the execution

a simple message box app loaded in ollydbg poi(esp+4) when broken on a call to user32!MessageBoxW will contain the Text I know so let me set a ctrl+t condition as follows and traceover (ctrl+f12)

UNICODE [[esp+4]] == "cannot" 

here is the log of the all the breaks where [[esp+4]] was unicode string "cannot find XXXXXXXXXXX

before the last log i modified the srch string to "say"

Log data
Message
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 401011  stack contains  unicode [[esp+4]] = cannot find "hello"
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 401025  stack contains  unicode [[esp+4]] = cannot find "iello"
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 401039  stack contains  unicode [[esp+4]] = cannot find "jello"
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 40104d  stack contains  unicode [[esp+4]] = cannot find "fello"
Conditional pause: UNICODE [[esp+4]] == "cannot"
broke here eip  = 401061  stack contains  unicode [[esp+4]] = cannot find "kello"
broke here eip  = 401061  stack contains  unicode [[esp+4]] = cannot find "kello"
Conditional pause: UNICODE [[esp+4]] == "say"
broke here eip  = 401075  stack contains  unicode [[esp+4]] = saying "hello" baby

one can also set complex conditions to locate srch pattern of interest

here is a log of ollydbg opening notepad,exe and looking for the path of cmd.exe when eip > imagebase with ctrl+f11 (trace in ) it traced

Run trace, selected line
 Back=141932.
commands before pausing 

log

Log data, item 0
 Message=Conditional pause:  eax > 0x400000  &&  UNICODE [eax] == "c:\\windows\\system32\\cmd.exe"

where eip was 
Log data, item 0
 Message=eip = 7c918154

which is part of ntdll!_wcscat

7C91814E        /MOV     CX, WORD PTR DS:[ESI]       ;  55.
7C918151        |MOV     WORD PTR DS:[EDX], CX       ;  55.
7C918154        |INC     EDX                         ;  54.
7C918155        |INC     EDX                         ;  54.
7C918156        |INC     ESI                         ;  54.
7C918157        |INC     ESI                         ;  54.
7C918158        |TEST    CX, CX                      ;  54.
7C91815B        \JNZ     SHORT ntdll.7C91814E        ;  54.

whcih shows the string ise being constructed dynamically

Log data, item 0
 Message=edx  = 5cb800f4  unicode [edx]  = e  cx  = 65  unicode [eax] = C:\WINDOWS\System32\cmd.exe

the 55. / 54. in the disassembly is count the instruction was executed prior to break len ( unicode ( c:\windows\system32\cmd.exe)) == 53 . / chars count starts from 1 eax became srchstr and ollydbg broke the next instruction is yet to be executed

copy con strlen
C.:.\.W.I.N.D.O.W.S.\.S.y.s.t.e.m.3.2.\.c.m.d...e.x.e^Z
        1 file(s) copied.

wc strlen
      0       1      53 strlen

reading the comment it appears there is a misconception about the proposed method above so to clarify this is not a conditional breakpoint and is not tied to any offset that should be known beforehand this method of setting a pause is dynamic evaluation of the condition on each step (in both trace in and trace over) and pause the trace when condition is met condition can also be modified inflight

  • This would be a good answer if the OP hadn't explicitly stated he doesn't know where the function is, so he can't set your conditional breakpoint to begin with. – Guntram Blohm Apr 4 '15 at 13:10
  • hehe guntram he said stack :) a function can take only so much arguments :) brute forcing around with [[esp+4]] [[esp+8]] on system calls shouldnt take much of time i think mileage can obviously vary but not undoable why one can launch 10 ollydbgs with different conditions and go for a coffee if feasible (if no multiinstances then multi vms) – blabb Apr 4 '15 at 13:14
  • ctrl+f12 executes program instruction by instruction I need to interact with program too press some buttons in order to trigger the function I am interested into. Any way thanks for help – opc0de Apr 4 '15 at 13:24
  • i clciked five buttons in the log for 5 messageboxes with ctrl+f12 – blabb Apr 4 '15 at 13:26
  • @GuntramBlohm i reread your comment and i think you have a misconception also about the method proposed setting a pause with ctrl+t is not a conditional breakpoint it is dynamic evaluation on each step so it is not tied to an offset as such and can be set independent of any offset even while tracing is in progress – blabb Apr 4 '15 at 20:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.