Inspect Parameter passed to Functions with windbg - windows

Question

I working through some example in Windows System Programming 4th. Using windbg.exe I'm trying to inspect the parameters passed to a function (GetCurrentDirectoryA). Below is the source.
int _tmain (int argc, LPTSTR argv [])
{
/* Buffer to receive current directory allows for the CR,
LF at the end of the longest possible path. */
TCHAR pwdBuffer [DIRNAME_LEN];
DWORD lenCurDir;
lenCurDir = GetCurrentDirectory (DIRNAME_LEN, pwdBuffer);
if (lenCurDir == 0)
ReportError (_T ("Failure getting pathname."), 1, TRUE);
if (lenCurDir > DIRNAME_LEN)
ReportError (_T ("Pathname is too long."), 2, FALSE);
PrintMsg (GetStdHandle (STD_OUTPUT_HANDLE), pwdBuffer);
return 0;
}
First I dump the local variables using dv -t -v. In this case I'm interested in the pwdBuffer.
0018ff3c int argc = 0n1
0018ff40 char ** argv = 0x00582470
0018fe18 unsigned long lenCurDir = 0x775b994a
0018fe24 char [262] pwdBuffer = char [262] ""
Then I set a breakpoint at Kernel32!GetCurrentDirectoryA. Which yields the following.
00 0018ff34 00428759 00000001 00582470 005824c0 kernel32!GetCurrentDirectoryA
What I don't understand is value of the parameters to the Function. I was expecting to see 0018fe24 as one value representing pwdbuffer.
The next thing I do is gu. Which executes Kernel32!GetCurrentDirectoryA to its end.
Thereafter I dumped the pwdBuffer value that I got initially with the dv -v -t command.
0:000> da 0018fe24
0018fe24 "C:\microsoft_press\WSP4_Examples"
0018fe44 "\Utility_4_dll"
This is what I expect from the buffer. So my question is why didn't I see this 0018fe24 value passed to GetCurrentDirectory?

Answer 1

Try single stepping past the mov ebp, esp instruction at the start of GetCurrentDirectoryA. The numbers you're seeing look like values from your _tmain function, specifically, its frame pointer (EBP), its return address, and its arguments argc and argv (along with the hidden envp parameter). Once EBP is loaded with the correct frame pointer for GetCurrentDirectoryA, windbg may be able to display the function's arguments correctly.

Answer 2

The stack should show the parameters to the function on hitting the break-point not after you single step i just had similar code (without crt window Apis only) and ran it through and windbg works as expected
when analyzing unknown or potentially malware binaries one unthoughtful single step can result in fatal infection. If logic exists don't use lucky charms.
my current directory
:\>echo %cd%
C:\temp\temp\temp\temp
contents of current directory
:\>ls -l
total 12
-rwxrwxrwx 1 Admin 0 197 2015-10-10 16:29 compile.bat
-rw-rw-rw- 1 Admin 0 336 2015-10-10 16:13 getdir.cpp
-rw-rw-rw- 1 Admin 0 145 2015-10-10 16:47 wtf.txt
src code for test
:\>type getdir.cpp
#include <windows.h>
int main (void) {
PCHAR buff=0;int bufflen=0;
bufflen=GetCurrentDirectory(0,NULL);
buff = (PCHAR)VirtualAlloc(NULL,bufflen,MEM_COMMIT,PAGE_READWRITE);
if(buff){
GetCurrentDirectory(bufflen,buff);
MessageBox(NULL,buff,"Current Directory",MB_OK);
VirtualFree(buff,0,MEM_RELEASE);
}
}
compiled with
:\>type compile.bat
#call "C:\Program Files\Microsoft Visual Studio 10.0\VC\vcvarsall.bat" x86
cl /Zi /EHsc /O2 /nologo /W4 /analyze *.cpp /link /SUBSYSTEM:Windows /RELEASE /E
NTRY:main user32.lib kernel32.lib
pause
:\>compile.bat
Setting environment for using Microsoft Visual Studio 2010 x86 tools.
getdir.cpp
Press any key to continue . . .
executed with
:\>cdb -cf wtf.txt getdir.exe
-cf command line to windbg / cdb takes a file whose content will be executed as if you type them at the prompt
the contents of wtf.txt is
:\>type wtf.txt
bp kernel32!VirtualAlloc
g
gu
? #eax
bc *
bp kernel32!GetCurrentDirectoryA
g
dd #esp l3
r $t0 = poi(#esp+8)
? #$t0
gu
da #$t0;
g
q
on the first system break
set a breakpoint on virtualalloc and run the binary
when the breakpoint is hit goup (we are interested only in the return value from this function ) and inspect eax (return value from function)
clear all breakpoints
set a breakpoint in GetCurrentDirectoryA
execute the binary again with g on hitting the breakpoint inspect the stack
with dd #esp l3
(display three dwords from Stack pointer one return address and two function parameters to the Function GetCurrentDirectoryA()
note the stack will contain the same address we previously inspected at the return of VirtualAlloc using ? #eax
save the address of buffer to a pseudo variable and go up
print the ascii string from the buffer da #$t0
exit the session
the result of this session is as follows note we got 35000 as the allocated memory address of buffer from virtual alloc and that was indeed passed to GetCurrentDirectory and that hold the string Current directory
:\>cdb -cf wtf.txt getdir.exe
0:000> bp kernel32!VirtualAlloc
0:000> g
Breakpoint 0 hit
kernel32!VirtualAlloc:
7c809af1 8bff mov edi,edi
0:000> gu
getdir!main+0x21:
00401021 8bf0 mov esi,eax
0:000> ? #eax
Evaluate expression: 3473408 = 00350000 <--------
0:000> bc *
0:000> bp kernel32!GetCurrentDirectoryA
0:000> g
Breakpoint 0 hit
kernel32!GetCurrentDirectoryA:
7c83502e 8bff mov edi,edi
0:000> dd #esp l3
0013ffac 0040102b 00000017 00350000 <------
0:000> r $t0 = poi(#esp+8)
0:000> ? #$t0
Evaluate expression: 3473408 = 00350000 <----------
0:000> gu
getdir!main+0x2b:
0040102b 6a00 push 0
0:000> da #$t0;
00350000 "C:\temp\temp\temp\temp"
0:000> g
edit all others being same just added a kb command to the script file and executed to show the stacktrace