2

Debugging an application's use of msvcrt!_read. Found a nifty Windbg script online Reversing on Windows: intercepting ReadFile that I lightly edited:

$$ Windbg script to intercept when a file is being read.
bp msvcrt!_read
.while(1)
{
  g
  $$ Get parameters of _read()
  r $t0 = dwo(esp+4)
  r $t1 = dwo(esp+8)
  r $t2 = dwo(esp+0x0c)

  $$ Execute until return is reached
  pt

  $$ Read magic value in the buffer
  $$ CHANGE position in buffer here
  r $t5 = dwo(@$t1+0x00)
  r
  .printf "hFile=%p buffer=%p count=%p\n", @$t0, @$t1, @$t2

  $$ Check if magic value matches
  $$ CHANGE constant here
  db @$t1 $$ had to put this here b/c .if never executed 'clause'
  .if(@$t5 == 0x00000000) $$magic string
  {
    db @$t1

    $$ UNCOMMENT below to break in the debugger
    .break
  }
}

$$ Clear BP for ReadFile (assume it is the 0th one)
bc 0

I tried using the following 'magic string' of bytes:

77 30 30 66

in:

.if(@$t5 == 0x77303066) $$magic string

However, it never meets that condition. Most frustrating part is that I see the magic string when the script runs the 'db@$t1'

eax=00000400 ebx=02895cc4 ecx=75b7c2d6 edx=771f70f4 esi=017d0ab8 edi=028b2534
eip=75b7c2d6 esp=03d2fbec ebp=00000003 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
msvcrt!_read+0xd1:
75b7c2d6 c3              ret
hFile=00000003 lpBuffer=05f30020 nNumberOfBytesToRead=00000400
05f30020  77 30 30 66 00 00 00 2e-00 00 00 00 00 00 00 00  w00f............
05f30030  00 2e 2e 2e 2e 2e 00 00-00 2e 00 00 00 2e 2e 00  ................
05f30040  00 2e 2e 00 00 00 04 00-00 00 2e 2e 00 00 2e 2e  ................
05f30050  00 00 2e 2e 00 00 00 00-00 00 00 00 00 00 01 2e  ................
05f30060  00 2e 00 2e 2e 2e 2e 2e-00 00 00 2e 00 00 00 2e  ................

I've also tried changing the magic string in the wds script to little endian, still doesnt work though.

How may I format the if statement to trigger in the above script using the magic string 'w00f?'

4

The first four bytes of the file (77 30 30 66) will be read into @$t5 in little-endian format.

So .if(@$t5 == 0x77303066) should be .if(@$t5 == 0x66303077).

2
  • And if this doesn't work, .printf the value of @$t5 to troubleshoot further. – Jason Geffner Jul 30 '15 at 19:00
  • it works. could have sworn i already tried that lol. Thanks Jason – grepNstepN Jul 30 '15 at 19:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.