使用windbg检查Win32 ReadFile lpBuffer参数

Question

使用windbg检查Win32 ReadFile lpBuffer参数

我正在使用 Johnson M. Hart 所著的《Windows 系统编程 4th》一书中的以下函数。熟悉 Win32 API。我还在使用 Windbg 检查该功能。当检查指向接收从文件读取的数据的缓冲区的参数时。我从调试器得到以下输出。有人可以解释如何使用windbg来检查lpBuffer吗？

#include "Everything.h"

#define BUF_SIZE 256      

BOOL cci_f (LPCTSTR fIn, LPCTSTR fOut, DWORD shift)
{
    HANDLE hIn, hOut;
    DWORD nIn, nOut, iCopy;
    BYTE buffer [BUF_SIZE], bShift = (BYTE)shift;
    BOOL writeOK = TRUE;

    hIn = CreateFile (fIn, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hIn == INVALID_HANDLE_VALUE) return FALSE;

    hOut = CreateFile (fOut, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
    if (hOut == INVALID_HANDLE_VALUE) {
        CloseHandle(hIn);
        return FALSE;
    }

    while (writeOK && ReadFile (hIn, buffer, BUF_SIZE, &nIn, NULL) && nIn > 0) {
        for (iCopy = 0; iCopy < nIn; iCopy++)
            buffer[iCopy] = buffer[iCopy] + bShift;
        writeOK = WriteFile (hOut, buffer, nIn, &nOut, NULL);
    }

    CloseHandle (hIn);
    CloseHandle (hOut);

    return writeOK;
}

0:000> bp kernel32!readfile
0:000> g
Breakpoint 1 hit
eax=00000000 ebx=00000000 ecx=0018bf0c edx=00000030 esi=00000030 edi=0018ff20
eip=77383f11 esp=0018bddc ebp=0018be20 iopl=0         nv up ei ng nz ac po cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000293
kernel32!ReadFile:
77383f11 ff25ec093877    jmp     dword ptr [kernel32!_imp__ReadFile (773809ec)] ds:002b:773809ec={KERNELBASE!ReadFile (75efdc4a)}
0:000> k
ChildEBP RetAddr  
0018be20 00411551 kernel32!ReadFile
0018ff44 00411b50 cpW!main+0x181 [c:\microsoft_press\wsp4_examples\chaptr01\cpw.c @ 31]
0018ff88 7738338a cpW!__tmainCRTStartup+0x122 [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 555]
0018ff94 779b9f72 kernel32!BaseThreadInitThunk+0xe
0018ffd4 779b9f45 ntdll!__RtlUserThreadStart+0x70
0018ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000> dd ebp
0018be20  0018ff44 00411551 00000030 0018bf0c
0018be30  00004000 0018ff20 00000000 0041757c
0018be40  00000001 00000000 cccccccc cccccccc
0018be50  cccccccc cccccccc cccccccc cccccccc
0018be60  cccccccc cccccccc cccccccc cccccccc
0018be70  cccccccc cccccccc cccccccc cccccccc
0018be80  cccccccc cccccccc cccccccc cccccccc
0018be90  cccccccc cccccccc cccccccc cccccccc
0:000> da 0018bf0c
0018bf0c  "................................"
0018bf2c  "................................"
0018bf4c  "................................"
0018bf6c  "................................"
0018bf8c  "................................"
0018bfac  "................................"
0018bfcc  "................................"
0018bfec  "................................"
0018c00c  "................................"
0018c02c  "................................"
0018c04c  "................................"
0018c06c  "................................"

Run Code Online (Sandbox Code Playgroud)

建议后的附加调试输出如下。

0:000> lm
start    end        module name
00400000 0040a000   cci        (deferred)             
71580000 71656000   MSVCR110   (deferred)             
71660000 71703000   MSVCR90    (deferred)             
72660000 72666000   Utility_4_0   (deferred)             
76630000 76677000   KERNELBASE   (deferred)             
76950000 76a60000   kernel32   (deferred)             
771d0000 77350000   ntdll      (pdb symbols)          c:\symbol\wntdll.pdb\69DDFBCBBC14421D8CB974F8EDC414102\wntdll.pdb
0:000> .sympath+ C:\Microsoft_Press\WSP4_Examples\Projects2008\cci\Debug
Symbol search path is: SRV*c:\symbol*http://msdl.microsoft.com/download/symbols;C:\Microsoft_Press\WSP4_Examples\Projects2008\cci\Debug
Expanded Symbol search path is: srv*c:\symbol*http://msdl.microsoft.com/download/symbols;c:\microsoft_press\wsp4_examples\projects2008\cci\debug

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       SRV*c:\symbol*http://msdl.microsoft.com/download/symbols
OK                                             C:\Microsoft_Press\WSP4_Examples\Projects2008\cci\Debug
0:000> bp cci!main
*** WARNING: Unable to verify checksum for cci.exe
0:000> g
Breakpoint 0 hit
eax=71648634 ebx=00000000 ecx=0048e198 edx=00000000 esi=00000001 edi=00000000
eip=00401020 esp=0018ff4c ebp=0018ff88 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
cci!main:
00401020 55              push    ebp
0:000> bp kernel32!Readfile
0:000> g
Breakpoint 1 hit
eax=00000000 ebx=00000000 ecx=0018fd24 edx=0000003c esi=0000003c edi=0018fe44
eip=76963f11 esp=0018fbdc ebp=0018fc20 iopl=0         nv up ei ng nz ac po cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000293
kernel32!ReadFile:
76963f11 ff25ec099676    jmp     dword ptr [kernel32!_imp__ReadFile (769609ec)] ds:002b:769609ec={KERNELBASE!ReadFile (7663dc4a)}
0:000> k
ChildEBP RetAddr  
0018fc20 004011f3 kernel32!ReadFile
0018fe68 004010a3 cci!cci_f+0xe3 [c:\microsoft_press\wsp4_examples\chaptr02\cci_f.c @ 29]
0018ff48 00401765 cci!main+0x83 [c:\microsoft_press\wsp4_examples\chaptr02\cci.c @ 24]
0018ff88 7696338a cci!__tmainCRTStartup+0xfd [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 536]
0018ff94 77209f72 kernel32!BaseThreadInitThunk+0xe
0018ffd4 77209f45 ntdll!__RtlUserThreadStart+0x70
0018ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000> r esp
esp=0018fbdc
0:000> dd 0018fbdc
0018fbdc  76963ee7 0000003c 0018fd24 00000100
0018fbec  0018fe44 00000000 988c6ffa 0018fe68
0018fbfc  0018fc3c 00000000 769653d0 0018fbf4
0018fc0c  0018fc3c 0018ff78 76a04643 ee02ad2a
0018fc1c  fffffffe 0018fe68 004011f3 0000003c
0018fc2c  0018fd24 00000100 0018fe44 00000000
0018fc3c  0018ff48 0018fe7c 00000000 cccccccc
0018fc4c  cccccccc cccccccc cccccccc cccccccc
0:000> !handle 0000003c f
Handle 3c
  Type          File
  Attributes    0
  GrantedAccess 0x120089:
         ReadControl,Synch
         Read/List,ReadEA,ReadAttr
  HandleCount   2
  PointerCount  19
  No Object Specific Information available
0:000> da 0018fd24
0018fd24  "................................"
0018fd44  "................................"
0018fd64  "................................"
0018fd84  "................................"
0018fda4  "................................"
0018fdc4  "................................"
0018fde4  "................................"
0018fe04  "................................"
0018fe24  "................................"
0018fe44  ""
0:000> r ebp
ebp=0018fc20
0:000> dd 0018fc20
0018fc20  0018fe68 004011f3 0000003c 0018fd24
0018fc30  00000100 0018fe44 00000000 0018ff48
0018fc40  0018fe7c 00000000 cccccccc cccccccc
0018fc50  cccccccc cccccccc cccccccc cccccccc
0018fc60  cccccccc cccccccc cccccccc cccccccc
0018fc70  cccccccc cccccccc cccccccc cccccccc
0018fc80  cccccccc cccccccc cccccccc cccccccc
0018fc90  cccccccc cccccccc cccccccc cccccccc
0:000> da 0018fd24
0018fd24  "................................"
0018fd44  "................................"
0018fd64  "................................"
0018fd84  "................................"
0018fda4  "................................"
0018fdc4  "................................"
0018fde4  "................................"
0018fe04  "................................"
0018fe24  "................................"
0018fe44  ""

Run Code Online (Sandbox Code Playgroud)

转储 Kernel32!Writefile lBuffer 显示要写入文件的数据。我不清楚为什么 kernel32!ReadFile 没有显示 lpBuffer 参数中的数据。

0:000> bp kernel32!writefile
0:000> g
Breakpoint 2 hit
eax=00000040 ebx=00000000 ecx=0018fe38 edx=00000000 esi=0018fc3c edi=0018fe68
eip=769617ad esp=0018fc08 ebp=0018fc20 iopl=0         nv up ei ng nz ac po cy
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000293
kernel32!WriteFile:
769617ad ff25e4099676    jmp     dword ptr [kernel32!_imp__WriteFile (769609e4)] ds:002b:769609e4={KERNELBASE!WriteFile (7663ddbc)}
0:000> k
ChildEBP RetAddr  
0018fc20 0040125b kernel32!WriteFile
0018fe68 004010a3 cci!cci_f+0x14b [c:\microsoft_press\wsp4_examples\chaptr02\cci_f.c @ 36]
0018ff48 00401765 cci!main+0x83 [c:\microsoft_press\wsp4_examples\chaptr02\cci.c @ 24]
0018ff88 7696338a cci!__tmainCRTStartup+0xfd [f:\dd\vctools\crt_bld\self_x86\crt\src\crtexe.c @ 536]
0018ff94 77209f72 kernel32!BaseThreadInitThunk+0xe
0018ffd4 77209f45 ntdll!__RtlUserThreadStart+0x70
0018ffec 00000000 ntdll!_RtlUserThreadStart+0x1b
0:000> dd 0018fc20
0018fc20  0018fe68 0040125b 00000040 0018fd24
0018fc30  00000100 0018fe38 00000000 0018ff48
0018fc40  0018fe7c 00000000 cccccccc cccccccc
0018fc50  cccccccc cccccccc cccccccc cccccccc
0018fc60  cccccccc cccccccc cccccccc cccccccc
0018fc70  cccccccc cccccccc cccccccc cccccccc
0018fc80  cccccccc cccccccc cccccccc cccccccc
0018fc90  cccccccc cccccccc cccccccc cccccccc
0:000> da 0018fd24
0018fd24  "9:(86:::@@98<?8:@;<A<;..9:(86:::"
0018fd44  "@@98<?8:@;<A<;..9:(86:::@@98<?8:"
0018fd64  "@;<A<;..9:(86:::@@98<?8:@;<A<;.."
0018fd84  "9:(86:::@@98<?8:@;<A<;..9:(86:::"
0018fda4  "@@98<?8:@;<A<;..9:(86:::@@98<?8:"
0018fdc4  "@;<A<;..9:(86:::@@98<?8:@;<A<;.."
0018fde4  "9:(86:::@@98<?8:@;<A<;..9:(86:::"
0018fe04  "@@98<?8:@;<A<;..9:(86:::@@98<?8:"
0018fe24  "........"

Run Code Online (Sandbox Code Playgroud)

感谢社区提供的见解。我可以通过首先在 Kernel32!ReadFile 处设置断点来查看 lpBuffer 中的数据。然后执行gu（gu命令使目标执行，直到当前函数完成）。此后我可以转储缓冲区。现在显示了我感兴趣的数据。

Answer 1

bla*_*abb 4

BOOL WINAPI ReadFile(
  _In_         HANDLE hFile,
  _Out_        LPVOID lpBuffer,
  _In_         DWORD nNumberOfBytesToRead,
  _Out_opt_    LPDWORD lpNumberOfBytesRead,
  _Inout_opt_  LPOVERLAPPED lpOverlapped
);

Run Code Online (Sandbox Code Playgroud)

当您拥有该broken on ReadFile缓冲区时，该缓冲区将被文件的内容填充以跳出函数使用并检查缓冲区（以便稍后在 32 位系统上的 kernel32.dll 中的 ReadFile 上中断时进行检查lpBufferrubbish/ garbage/ zeros/ or pre initialised content based on how you allocated and initialised the bufferonly after you return from the APIgu (goup)save the address of buffer firstaddress of buffer should be at @esp+08

the walk through下面的creates a new file in current directorythenwrites to it用于resets the file position读取文件的开头reads the file，prints the content to stdout并在后退出Closing the handle。

cdbWindbg 是控制台模式
-cswitch 接受针对事件执行的命令
g main执行文件直到 main 以避免 ReadFile 中无意义的中断
bp kernel32!ReadFile在 API 上设置断点
g to execute the file这样它就会在我们的断点处中断
bc * to clear any breakpoints（建议在编写脚本时养成这个习惯）
r $t0 = poi(@esp+8)保存指向 lpBuffer 的指针
poi(@esp+0)始终是返回地址
poi(@esp+4)在 32 位系统中，在 Function Start 上损坏时始终是第一个参数。
.echo is to output a comment。
db @$t0 l20打印 lpBuffer 的第一个 20 个字节prior to执行 ReadFile()
gu是组
.echo is to output a comment。
db @$t0 l20打印 lpBuffer 的第一个 20 个字节post执行 ReadFile()
g;q is to continue and quit当执行完文件时

readfile>类型 readfile.cpp & %compile% readfile.cpp & readfile.exe

#include <stdio.h>
#include <Windows.h>
int main(void)    {
    char writein[] = {"Iam going to write me in\n"};
    char readin [] = {"Iam rubbish Iam garbage Readfile will clean me up\n" };
    DWORD bytesreadoutin = 0;
    BOOL result = FALSE;
    HANDLE hFile = CreateFileA("mynewtxt.txt",GENERIC_ALL,FILE_SHARE_WRITE |
        FILE_SHARE_READ,NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL,NULL);
    if (INVALID_HANDLE_VALUE != hFile) {
        if ((result = WriteFile(
            hFile,writein,sizeof(writein),&bytesreadoutin,NULL)) == TRUE ) {
            if (bytesreadoutin == sizeof(writein))  {
                if ( INVALID_SET_FILE_POINTER != SetFilePointer(
                    hFile,NULL,NULL,FILE_BEGIN) ) {
                    if (( result = ReadFile(
                        hFile,readin,sizeof(writein),&bytesreadoutin,
                        NULL))== TRUE)  {
                        printf(readin);
                    }
                }
            }
        }
        CloseHandle(hFile);
    }
    return 0;
}Setting environment for using Microsoft Visual Studio 2010 x86 tools.
readfile.cpp
Press any key to continue . . .
I am going to write me in

Run Code Online (Sandbox Code Playgroud)

与 Windbg

readfile>cdb -c "g main;bp kernel32!ReadFile;g;bc *;r $t0 = poi(@esp+8);.echo =============读文件前的缓冲区内容================;db @$t0 l20;gu;.echo ========================缓冲区readfile 内容=================;db @$t0 l20;g;q" readfile.exe

ntdll!DbgBreakPoint:
7c90120e cc              int     3
0:000> cdb: Reading initial command 'g main;bp kernel32!ReadFile;g;bc *;r $t0 =
poi(@esp+8);.echo =============buffer contents pre readfile================;db @
$t0 l20;gu;.echo ======================buffer contents post readfile============
=====;db @$t0 l20;g;q'

Breakpoint 0 hit
=============buffer contents pre readfile================
0013ff34  49 20 61 6d 20 72 75 62-62 69 73 68 20 49 20 61  I am rubbish I a
0013ff44  6d 20 67 61 72 62 61 67-65 49 20 77 69 6c 6c 20  m garbageI will
======================buffer contents post readfile=================
0013ff34  49 20 61 6d 20 67 6f 69-6e 67 20 74 6f 20 77 72  I am going to wr
0013ff44  69 74 65 20 6d 65 20 69-6e 0a 00 77 69 6c 6c 20  ite me in..will
I am going to write me in
quit:

Run Code Online (Sandbox Code Playgroud)

记录所有 ReadFile 调用以及write a simple script所有命令.block {}set a conditional breakpoint like bp kernel32!ReadFile "$$>a< X:\\blah.ext"

请注意，ReadFile 是一个Very Busy Api通常do not需要
设置的值permanent breaks in busy apis，因为它可能会导致性能非常差
或会话中出现不希望的缓慢，并且在调试与时间相关的代码问题时可能会引入严重问题

脚本文件内容

0:004> .shell -ci " " type c:\\readfile.txt
.block {
r $t0 = poi(@esp+0x8);
.echo ========================================pre&post===========================
db @$t0 l10;
gu;
db @$t0 l10;
g;
}.shell: Process exited

Run Code Online (Sandbox Code Playgroud)

结果

0:002> $$ start of logging ReadFile 
0:002> bl
 0 e 7c801812     0001 (0001)  0:**** kernel32!ReadFile "$$>a< c:\\readfile.txt"
0:002> .bpcmds
bp0 0x7c801812  "$$>a< c:\\readfile.txt";
0:002> g
========================================pre&post===========================
0011fa10  00 00 00 00 00 00 00 00-60 00 00 00 00 00 00 00  ........`.......
0011fa10  49 54 53 46 03 00 00 00-60 00 00 00 01 00 00 00  ITSF....`.......
========================================pre&post===========================
001271d8  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
001271d8  49 54 53 50 01 00 00 00-54 00 00 00 0a 00 00 00  ITSP....T.......
========================================pre&post===========================
000e9038  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
000e9038  50 4d 47 4c 10 0b 00 00-00 00 00 00 ff ff ff ff  PMGL............
========================================pre&post===========================
009eed38  f0 f9 11 00 a8 ed 9e 00-fd f3 e2 65 f0 f9 11 00  ...........e....
009eed38  1e 00 11 00 a8 ed 9e 00-fd f3 e2 65 f0 f9 11 00  ...........e....
========================================pre&post===========================
0011ef42  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
0011ef42  02 00 0c 00 55 00 6e 00-63 00 6f 00 6d 00 70 00  ....U.n.c.o.m.p.
========================================pre&post===========================
009ef018  50 0a 15 00 d8 6b 3d 00-34 f0 9e 00 6c f0 9e 00  P....k=.4...l...
009ef018  03 00 00 00 d8 6b 3d 00-34 f0 9e 00 6c f0 9e 00  .....k=.4...l...
========================================pre&post===========================

Run Code Online (Sandbox Code Playgroud)

归档时间：	11 年，7 月前
查看次数：	2401 次
最近记录：	11 年，7 月前