Debugging an application's use of msvcrt!_read. Found a nifty Windbg script online Reversing on Windows: intercepting ReadFile that I lightly edited:
$$ Windbg script to intercept when a file is being read.
bp msvcrt!_read
.while(1)
{
g
$$ Get parameters of _read()
r $t0 = dwo(esp+4)
r $t1 = dwo(esp+8)
r $t2 = dwo(esp+0x0c)
$$ Execute until return is reached
pt
$$ Read magic value in the buffer
$$ CHANGE position in buffer here
r $t5 = dwo(@$t1+0x00)
r
.printf "hFile=%p buffer=%p count=%p\n", @$t0, @$t1, @$t2
$$ Check if magic value matches
$$ CHANGE constant here
db @$t1 $$ had to put this here b/c .if never executed 'clause'
.if(@$t5 == 0x00000000) $$magic string
{
db @$t1
$$ UNCOMMENT below to break in the debugger
.break
}
}
$$ Clear BP for ReadFile (assume it is the 0th one)
bc 0
I tried using the following 'magic string' of bytes:
77 30 30 66
in:
.if(@$t5 == 0x77303066) $$magic string
However, it never meets that condition. Most frustrating part is that I see the magic string when the script runs the 'db@$t1'
eax=00000400 ebx=02895cc4 ecx=75b7c2d6 edx=771f70f4 esi=017d0ab8 edi=028b2534
eip=75b7c2d6 esp=03d2fbec ebp=00000003 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
msvcrt!_read+0xd1:
75b7c2d6 c3 ret
hFile=00000003 lpBuffer=05f30020 nNumberOfBytesToRead=00000400
05f30020 77 30 30 66 00 00 00 2e-00 00 00 00 00 00 00 00 w00f............
05f30030 00 2e 2e 2e 2e 2e 00 00-00 2e 00 00 00 2e 2e 00 ................
05f30040 00 2e 2e 00 00 00 04 00-00 00 2e 2e 00 00 2e 2e ................
05f30050 00 00 2e 2e 00 00 00 00-00 00 00 00 00 00 01 2e ................
05f30060 00 2e 00 2e 2e 2e 2e 2e-00 00 00 2e 00 00 00 2e ................
I've also tried changing the magic string in the wds script to little endian, still doesnt work though.
How may I format the if statement to trigger in the above script using the magic string 'w00f?'
