wirepair
February 23rd, 2005, 04:47
lo all,
I would like to be able to read the arguments to a function call much like a run trace and save them to my own variables. I found the address of the import and I would like to set a break point on each reference. I'm pretty sure that part is easy to do, but i have no idea on how to trap these arguments to the function call. Is this something that is possible with the api?
Thanks,
-wire
I want this stuff below after i set my breakpoint on:
01001CC5 |. FF35 C8900001 PUSH DWORD PTR DS:[10090C8] ; |format = " Ln %d, Col %d "
01001CCB |. 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] ; |
01001CD1 |. 6A 7F PUSH 7F ; |count = 7F (127.)
01001CD3 |. 50 PUSH EAX ; |wstr
01001CD4 |. FF15 14130001 CALL DWORD PTR DS:[<&msvcrt._snwprintf>] ; \_snwprintf
here:
0007FD28 0007FD50 |wstr = 0007FD50
0007FD2C 0000007F |count = 7F (127.)
0007FD30 000A89C4 |format = " Ln %d, Col %d "
0007FD34 00000001 |<%d> = 1
0007FD38 00000005 \<%d> = 5
0007FD3C 77D491A3 USER32.GetMessageW
I would like to be able to read the arguments to a function call much like a run trace and save them to my own variables. I found the address of the import and I would like to set a break point on each reference. I'm pretty sure that part is easy to do, but i have no idea on how to trap these arguments to the function call. Is this something that is possible with the api?
Thanks,
-wire
I want this stuff below after i set my breakpoint on:
01001CC5 |. FF35 C8900001 PUSH DWORD PTR DS:[10090C8] ; |format = " Ln %d, Col %d "
01001CCB |. 8D85 FCFEFFFF LEA EAX,DWORD PTR SS:[EBP-104] ; |
01001CD1 |. 6A 7F PUSH 7F ; |count = 7F (127.)
01001CD3 |. 50 PUSH EAX ; |wstr
01001CD4 |. FF15 14130001 CALL DWORD PTR DS:[<&msvcrt._snwprintf>] ; \_snwprintf
here:
0007FD28 0007FD50 |wstr = 0007FD50
0007FD2C 0000007F |count = 7F (127.)
0007FD30 000A89C4 |format = " Ln %d, Col %d "
0007FD34 00000001 |<%d> = 1
0007FD38 00000005 \<%d> = 5
0007FD3C 77D491A3 USER32.GetMessageW