blabberer
September 5th, 2007, 11:37
Quote:
how it obtain pStartupinfo for GetStartupInfoA ? is it hardcoded?
|
ollydbg has one big internal table describing most of the functions in its resources section
when an application is opened in ollydbg it loads the resources,locks it and then finds whats what from them based on resolved import address
suppose it sees an address 77f43216 in the resolved import table
it knows by its analysis that this call is GetModuleWhatever()
now GetModuleWhatever may be defined in defined in psdk as
typedef __stdcall PVOID GetModuleHandle ( int a, PUCHAR *somebuffer,handle modhand);
so ollydbg when it referances the resources will know
push 3 a int a
push 404000 as Pointer to UCHAR and it will also find out if any Ascii or unicode string is referancible
push 46 as handle
then call GetModuleHandle()
no debug information is needed for this it does its own analysis
Quote:
| how does it know how many arguments to a non import call |
it analysis the app and if it finds a closed call it analyes it further and then depending on
return 10h , push pops of registers decides that this call will take two arguments or ten arguments
and then labels them as argument numbers
no not every result is returned in eax (yes almost 95 % retun a result in eax)
int stdcall void foo(in char *blah out char *blahblah); will have rubbish in eax on return
the char * blahblah will have the result if the function operated on char *blah and copied it to char *blahblah
you can define your own function arguments and ollydbg will recognize the call if it was recognising them earlier
for example
ZwSystemDebugControl() will look like this without ntdll.arg file
Code:
020C25A5 6A 00 PUSH 0
020C25A7 6A 00 PUSH 0
020C25A9 6A 00 PUSH 0
020C25AB 6A 00 PUSH 0
020C25AD 6A 00 PUSH 0
020C25AF 6A 06 PUSH 6
020C25B1 FF15 D0EA3002 CALL NEAR DWORD PTR DS:[230EAD0] ; ntdll.ZwSystemDebugControl
after you define a proper function description it will look like this
Code:
020C25A5 |. 6A 00 PUSH 0 ; /PULONG ReturnLength = NULL
020C25A7 |. 6A 00 PUSH 0 ; |ULONG OutputBufferLength = 0
020C25A9 |. 6A 00 PUSH 0 ; |PVOID OutputBuffer = NULL
020C25AB |. 6A 00 PUSH 0 ; |ULONG InputBufferLength = 0
020C25AD |. 6A 00 PUSH 0 ; |PVOID InputBuffer = NULL
020C25AF |. 6A 06 PUSH 6 ; |ControlCode = SysDbgDbgBreakPointWithStatus
020C25B1 |. FF15 D0EA3002 CALL NEAR DWORD PTR DS:[230EAD0] ; \ZwSystemDebugControl
and the ntdll.arg file for this function is like
Code:
INFO Simple .ARG file that decodes ZwSystemDebugControl
TYPE SYSDBG_COMMAND
IF 1 "SysDbgGetTraceInformation"
IF 2 "SysDbgSetInternalBreakpoint"
IF 3 "SysDbgSetSpecialCall"
IF 4 "SysDbgClearSpecialCalls"
IF 5 "SysDbgQuerySpecialCalls"
IF 6 "SysDbgDbgBreakPointWithStatus"
IF 7 "SysDbgSysGetVersion"
IF 8 "SysDbgReadVirtualMemory"
IF 9 "SysDbgWriteVirtualMemory"
IF 10 "SysDbgReadVirtualMemory"
IF 11 "SysDbgWriteVirtualMemory"
IF 12 "SysDbgSysReadControlSpace"
IF 13 "SysDbgSysWriteControlSpace"
IF 14 "SysDbgSysReadIoSpace"
IF 15 "SysDbgSysWriteIoSpace"
IF 16 "SysDbgSysReadMsr"
IF 17 "SysDbgSysWriteMsr"
IF 18 "SysDbgSysReadBusData"
IF 19 "SysDbgSysWriteBusData"
IF 20 "SysDbgSysCheckLowMemory"
IF 21 "SysDbgEnableDebugger"
IF 22 "SysDbgDisableDebugger"
IF 23 "SysDbgGetAutoEnableOnEvent"
IF 24 "SysDbgSetAutoEnableOnEvent"
IF 25 "SysDbgGetPitchDebugger"
IF 26 "SysDbgSetDbgPrintBufferSize"
IF 27 "SysDbgGetIgnoreUmExceptions"
IF 28 "SysDbgSetIgnoreUmExceptions"
ELSEINT
END
STDFUNC ZwSystemDebugControl
"ControlCode" SYSDBG_COMMAND
"PVOID InputBuffer" ADDR
"ULONG InputBufferLength" HEX
"PVOID OutputBuffer" ADDR
"ULONG OutputBufferLength" HEX
"PULONG ReturnLength" ADDR
END
this is the standard way to do it if you are going to add your own descriptions
if not you can check out stolly plugin source code for understanding how ollydbg holds this standard format in a compact format with
an ascii string null terminated with \n seperated values for every function description compressed with ollydbg PluginApi Compress()
like this
Code:
[_GDI_TEB_BATCH]
0=Offset,ULONG,4
1=HDC,ULONG,4
2=Buffer,ULONG[310],1240
