Skip to content

Commit 7434a87

Browse files
mrexodiamrexodia
committed
DBG: resolved issue x64dbg#49 (module RVA + file offset conversion notation). Implemented as "[module]:$[rva]" and "[module]:#[offset]"
1 parent e8f4cd2 commit 7434a87

File tree

2 files changed

+66
-69
lines changed

2 files changed

+66
-69
lines changed

‎help/Input.htm

Lines changed: 41 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -15,36 +15,20 @@
1515
</head>
1616

1717
<body>
18-
<P class=rvps3><SPAN class=rvts10><STRONG>Input</STRONG><BR></SPAN><SPAN
19-
class=rvts9>This program accepts various options of input:</SPAN><SPAN
20-
class=rvts9><BR></SPAN></P>
21-
<P class=rvps3><SPAN class=rvts11><U>commands</U></SPAN><SPAN class=rvts9>:
22-
Commands have the following format: "</SPAN><SPAN
23-
class=rvts10>command[space]arg1,[optional space]arg2,argN</SPAN><SPAN
24-
class=rvts9>".</SPAN><SPAN class=rvts9><BR></SPAN></P>
25-
<P class=rvps3><SPAN class=rvts11><U>variables</U></SPAN><SPAN class=rvts9>:
18+
<P class=rvps3><STRONG>Input</STRONG><BR>This program accepts
19+
various options of input:</P>
20+
<P class=rvps3><U>commands</U>:
21+
Commands have the following format: "command[space]arg1,[optional
22+
space]arg2,argN".</P>
23+
<P class=rvps3><U>variables</U>:
2624
Variables optionally start with a $ and can only store one DWORD (QWORD on
27-
x64).</SPAN><SPAN class=rvts9><BR></SPAN></P>
28-
<P class=rvps3><SPAN class=rvts11><U>debug registers</U></SPAN><SPAN
29-
class=rvts9>: All debug registers (all sizes) can be used as
30-
variables.</SPAN><SPAN class=rvts9><BR></SPAN></P>
31-
<P class=rvps3><SPAN class=rvts11><U>memory locations</U></SPAN><SPAN
32-
class=rvts9>: You can read from a memory location by using one of the
25+
x64).</P>
26+
<P class=rvps3><U> registers</U>: All
27+
registers (of all sizes) can be used as variables.</P>
28+
<P class=rvps3><U>memory locations</U>: You can read from a memory location by using one of the
3329
following expressions:<BR>[addr]&nbsp;&nbsp;&nbsp; - read a
34-
DWORD/QWORD, depending on the architecture.<BR>
35-
36-
37-
38-
39-
</SPAN><SPAN
40-
class=rvts9>@addr&nbsp;&nbsp;&nbsp;&nbsp; - same as
41-
above.<BR><EM>n</EM>:[addr]&nbsp;&nbsp;- read <EM>n</EM>
42-
43-
44-
45-
46-
bytes.</SPAN><SPAN
47-
class=rvts9><BR>
30+
DWORD/QWORD, depending on the architecture.<BR>@addr&nbsp;&nbsp;&nbsp;&nbsp; - same as
31+
above.<BR><EM>n</EM>:[addr]&nbsp;&nbsp;- read <EM>n</EM> bytes.<BR>
4832
@<EM>n</EM>:addr&nbsp;&nbsp; - same as
4933
above.<BR><STRONG>REMARKS</STRONG>:<BR>- <EM>n</EM> is the amount of bytes to
5034
read, this can be anything smaller than 4 on x32 and smaller than 8 on x64 when
@@ -55,42 +39,32 @@
5539

5640

5741

58-
@(addr+1), @addr+1 will read: [addr]+1.</SPAN></P>
59-
<P class=rvps3><SPAN
60-
class=rvts9>
61-
62-
63-
64-
65-
</SPAN><SPAN
66-
class=rvts9><U>flags</U> : Debug flags
67-
(interpreted as integer) can be used as input. Flags are prefixed with a '!' following the flag name.
68-
Valid flags are: !cf, !pf, !af, !zf, !sf, !tf, !if, !df, !of, !rf, !vm, !ac, !vif, !vip and !id.</SPAN><SPAN class=rvts9></P></SPAN>
69-
<P class=rvps3><SPAN class=rvts11><U>numbers</U></SPAN><SPAN class=rvts9>:
70-
All numbers are interpreted as
71-
hex by default. If you want to be sure, you can use the "x" prefix or
72-
the "0x" prefix. Decimal numbers can be used by prefixing the number with a "."
73-
(.123=7B).</SPAN></P>
74-
<P class=rvps3><SPAN class=rvts9><U>basic calculations</U>:
75-
See "Calculations" for more
76-
information.</SPAN></P>
77-
<P class=rvps3><SPAN class=rvts9><U>DLL exports</U>: Type 'GetProcAddress' and it will
78-
automatically be resolved to the actual address of the function. To explicitly
79-
define from which module to load the API, use: "kernel32.dll:GetProcAddress" or "kernel32:GetProcAddress". In a similar way
80-
you can resolve ordinals, try "ntdll:1". Another macro allows you to get the loaded
81-
base of a module. Try
82-
83-
"ntdll:0", "ntdll:base", "ntdll:imagebase" or
84-
"ntdll:header".</SPAN></P>
85-
<P class=rvps3><SPAN class=rvts9><U>labels/symbols</U>
86-
: user-defined labels
87-
88-
and symbols&nbsp;are a valid
89-
expressions.</SPAN></P>
90-
<P class=rvps3><SPAN class=rvts9><STRONG>Input for arguments can always be done in any of
91-
the above forms, except if stated otherwise.</STRONG>
92-
93-
94-
95-
96-
</SPAN></P></BODY></HTML>
42+
@(addr+1), @addr+1 will read: [addr]+1.</P>
43+
<P class=rvps3><U>flags</U>: Debug
44+
flags (interpreted as integer) can be used as input. Flags are prefixed with a
45+
'!' following the flag name. Valid flags are: !cf, !pf, !af, !zf, !sf, !tf, !if,
46+
!df, !of, !rf, !vm, !ac, !vif, !vip and !id.</P>
47+
<P class=rvps3><U>numbers</U>: All
48+
numbers are interpreted as hex by default. If you want to be sure, you can use
49+
the "x" prefix or the "0x" prefix. Decimal numbers can be used by prefixing the
50+
number with a "." (.123=7B).</P>
51+
<P class=rvps3><U>basic calculations</U>: See "Calculations" for more information.</P>
52+
<P class=rvps3><U>DLL exports</U>: Type
53+
'GetProcAddress' and it will automatically be resolved to the actual address of
54+
the function. To explicitly define from which module
55+
to load the API, use: "[module].dll:[api]" or "[module]:[api]". In a similar
56+
way you can resolve ordinals, try "[module]:[ordinal]". Another macro allows you to get the
57+
loaded base of a module. Try "[module]:0",
58+
"[module]:base", "[module]:imagebase" or "[module]:header". When "[module]" is an empty string (":0" for example), the
59+
module that is currently selected in the CPU will be
60+
used.</P>
61+
<P class=rvps3><U>RVA/File Offset</U>:
62+
If you want to access a module RVA you can either write "[module]:0+[rva]" or
63+
you can write "[module]:$[rva]". If you want
64+
to convert a file offset to a VA you can use "[module]:#[offset]". When "[module]" is
65+
an empty string (":0" for example), the module that is currently selected in the CPU will
66+
be used.</P>
67+
<P class=rvps3><U>labels/symbols</U>:
68+
user-defined labels and symbols&nbsp;are a valid expressions.</P>
69+
<P class=rvps3><STRONG>Input for arguments can always be done in any of
70+
the above forms, except if stated otherwise.</STRONG></P></body></HTML>

‎x64_dbg_dbg/value.cpp

Lines changed: 25 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1173,8 +1173,19 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print
11731173
if(apiname)
11741174
{
11751175
char modname[MAX_MODULE_SIZE] = "";
1176-
strcpy_s(modname, name);
1177-
modname[apiname - name] = 0;
1176+
if(name == apiname) //:[expression] <= currently selected module
1177+
{
1178+
SELECTIONDATA seldata;
1179+
memset(&seldata, 0, sizeof(seldata));
1180+
GuiSelectionGet(GUI_DISASSEMBLY, &seldata);
1181+
if(!modnamefromaddr(seldata.start, modname, true))
1182+
return false;
1183+
}
1184+
else
1185+
{
1186+
strcpy_s(modname, name);
1187+
modname[apiname - name] = 0;
1188+
}
11781189
apiname++;
11791190
if(!strlen(apiname))
11801191
return false;
@@ -1204,6 +1215,18 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print
12041215
{
12051216
if(!_stricmp(apiname, "base") or !_stricmp(apiname, "imagebase") or !_stricmp(apiname, "header"))
12061217
addr = modbase;
1218+
else if(*apiname == '$') //RVA
1219+
{
1220+
uint rva;
1221+
if(valfromstring(apiname + 1, &rva))
1222+
addr = modbase + rva;
1223+
}
1224+
else if(*apiname == '#') //File Offset
1225+
{
1226+
uint offset;
1227+
if(valfromstring(apiname + 1, &offset))
1228+
addr = valfileoffsettova(modname, offset);
1229+
}
12071230
else
12081231
{
12091232
uint ordinal;

0 commit comments

Comments
 (0)