So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using the command eb
it gives me Memory Access Error
. is there a correct way to do this trivial but complicated for a beginner task?
Thanks in advance
text:
Microsoft (R) Windows Debugger Version 6.11.0001.402 X86
Copyright (c) Microsoft Corporation. All rights reserved.
CommandLine: E:\tests\rr\test.exe
FindTheBuild service not found
Symbol search path is: srv*
Executable search path is:
ModLoad: 00400000 0041d000 image00400000
ModLoad: 7c900000 7c9af000 ntdll.dll
ModLoad: 7c800000 7c8f6000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 7e410000 7e4a1000 C:\WINDOWS\system32\USER32.dll
ModLoad: 77f10000 77f59000 C:\WINDOWS\system32\GDI32.dll
(6dc.43c): Break instruction exception - code 80000003 (first chance)
eax=00341eb4 ebx=7ffdc000 ecx=00000007 edx=00000080 esi=00341f48 edi=00341eb4
eip=7c90120e esp=0022fb20 ebp=0022fc94 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
ntdll!DbgBreakPoint:
7c90120e cc int 3
0:000> g
(6dc.1e8): Break instruction exception - code 80000003 (first chance)
eax=7ffdc000 ebx=00000001 ecx=00000002 edx=00000003 esi=00000004 edi=00000005
eip=7c90120e esp=0097ffcc ebp=0097fff4 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246
ntdll!DbgBreakPoint:
7c90120e cc int 3
0:001>
0:001> s -w 00400000 0041d000 6d 66
00404042 006d 0066 0000 0042 0055 0054 0054 004f m.f...B.U.T.T.O.
0:001> db 00404042
00404042 6d 00 66 00 00 00 42 00-55 00 54 00 54 00 4f 00 m.f...B.U.T.T.O.
00404052 4e 00 00 00 00 00 53 00-61 00 6d 00 70 00 6c 00 N.....S.a.m.p.l.
00404062 65 00 20 00 57 00 69 00-6e 00 64 00 6f 00 77 00 e. .W.i.n.d.o.w.
00404072 20 00 43 00 6c 00 61 00-73 00 73 00 00 00 70 18 .C.l.a.s.s...p.
00404082 40 00 55 6e 6b 6e 6f 77-6e 20 65 72 72 6f 72 00 @.Unknown error.
00404092 00 00 5f 6d 61 74 68 65-72 72 28 29 3a 20 25 73 .._matherr(): %s
004040a2 20 69 6e 20 25 73 28 25-67 2c 20 25 67 29 20 20 in %s(%g, %g)
004040b2 28 72 65 74 76 61 6c 3d-25 67 29 0a 00 00 41 72 (retval=%g)...Ar
0:001> eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00
^ Memory access error in 'eb 00404042 41 41 66 00 00 00 42 00 55 00 54 00 54 00 4f 00'
program:
#ifndef UNICODE
#define UNICODE
#endif
#include <windows.h>
#include <windowsx.h>
#include <stdio.h>
LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam);
int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PWSTR pCmdLine, int nCmdShow)
{
// Register the window class.
const wchar_t CLASS_NAME[] = L"Sample Window Class";
WNDCLASS wc = { };
wc.lpfnWndProc = WindowProc;
wc.hInstance = hInstance;
wc.lpszClassName = CLASS_NAME;
RegisterClass(&wc);
// Create the window.
HWND hwnd = CreateWindowEx(
0, // Optional window styles.
CLASS_NAME, // Window class
L"Learn to Program Windows", // Window text
WS_OVERLAPPEDWINDOW, // Window style
// Size and position
CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT,
NULL, // Parent window
NULL, // Menu
hInstance, // Instance handle
NULL // Additional application data
);
if (hwnd == NULL)
{
return 0;
}
HWND hwndButton = CreateWindow(
L"BUTTON", // Predefined class; Unicode assumed
L"special_mf", // Button text
WS_TABSTOP | WS_VISIBLE | WS_CHILD | BS_DEFPUSHBUTTON, // Styles
10, // x position
10, // y position
200, // Button width
25, // Button height
hwnd, // Parent window
NULL, // No menu.
(HINSTANCE)GetWindowLongPtr(hwnd, GWLP_HINSTANCE),
NULL); // Pointer not needed.
Button_Enable(hwndButton , FALSE);
ShowWindow(hwnd, nCmdShow);
// Run the message loop.
MSG msg = { };
while (GetMessage(&msg, NULL, 0, 0))
{
TranslateMessage(&msg);
DispatchMessage(&msg);
}
return 0;
}
LRESULT CALLBACK WindowProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
switch (uMsg)
{
case WM_DESTROY:
PostQuitMessage(0);
return 0;
case WM_PAINT:
{
PAINTSTRUCT ps;
HDC hdc = BeginPaint(hwnd, &ps);
FillRect(hdc, &ps.rcPaint, (HBRUSH) (COLOR_WINDOW+1));
EndPaint(hwnd, &ps);
}
return 0;
}
return DefWindowProc(hwnd, uMsg, wParam, lParam);
}
INT WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
PSTR lpCmdLine, INT nCmdShow)
{
wWinMain(hInstance , hPrevInstance, lpCmdLine, nCmdShow);
return 0;
}
compiling options with mingw:
gcc -m32 -w -mwindows test.c -o test.exe
eb
command?