Skip to content

Commit 7deb139

Browse files
committed
DBG: added possibility for '?' as delimiter. this ignores exports (useful if there are exports called "entry" or "imagebase")
1 parent ed5fbad commit 7deb139

File tree

2 files changed

+32
-15
lines changed

2 files changed

+32
-15
lines changed

help/Input.htm

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -49,27 +49,38 @@
4949
the "x" prefix or the "0x" prefix. Decimal numbers can be used by prefixing the
5050
number with a "." (.123=7B).</P>
5151
<P class=rvps3><U>basic calculations</U>: See "Calculations" for more information.</P>
52-
<P class=rvps3><U>DLL exports</U>: Type
53-
'GetProcAddress' and it will automatically be resolved to the actual address of
54-
the function. To explicitly define from which module
55-
to load the API, use: "[module].dll:[api]" or "[module]:[api]". In a similar
56-
way you can resolve ordinals, try "[module]:[ordinal]". Another macro allows you to get the
57-
loaded base of a module. Try "[module]:0",
58-
"[module]:base", "[module]:imagebase" or "[module]:header". When "[module]" is an empty string (":0" for example), the
52+
<P class=rvps3><U>DLL exports</U>
53+
: Type 'GetProcAddress' and it will automatically be
54+
resolved to the actual address of the function.
55+
To explicitly define from which module to load the API, use:
56+
"[module].dll:[api]" or "[module]:[api]". In a similar way you can resolve ordinals, try "[module]:[ordinal]". Another
57+
macro allows you to get the loaded
58+
base of a module. When "[module]" is an empty string (":GetProcAddress" for example), the
5959
module that is currently selected in the CPU will be
6060
used.</P>
61+
<P class=rvps3><U>Loaded Module&nbsp;Bases</U>
62+
63+
64+
65+
: If you want to access the loaded module base,
66+
you can write: "[module]:0", "[module]:base", "[module]:imagebase" or
67+
"[module]:header". You can also use '?' as a delimiter instead of ':'. This is
68+
useful if the module contains an export called "imagebase" for
69+
example.</P>
6170
<P class=rvps3><U>RVA/File Offset</U>:
6271
If you want to access a module RVA you can either write "[module]:0+[rva]" or
6372
you can write "[module]:$[rva]". If you want
6473
to convert a file offset to a VA you can use "[module]:#[offset]". When "[module]" is
6574
an empty string (":0" for example), the module that is currently selected in the CPU will
6675
be used.</P>
67-
<P class=rvps3><U>Module Entry Points</U>
76+
<P class=rvps3><U>Module Entry Points</U> : To access a module entry point you can write "[module]:entry",
77+
"[module]:oep" or "[module]:ep". Notice that when there are exports with the
78+
names "entry",
6879

69-
: To
70-
access a module entry point you can write "[module]:entry", "[module]:oep" or "[module]:ep". Notice that when
71-
there are exports with the names "entry", "oep" or "ep" the address of these will be
72-
returned instead.</P>
80+
"oep" or
81+
"ep" the address of these will be returned instead. You can also use '?' as
82+
a delimiter instead of ':'. This is useful if the module contains an export called "entry"
83+
for example.</P>
7384
<P class=rvps3><U>labels/symbols</U>:
7485
user-defined labels and symbols&nbsp;are a valid expressions.</P>
7586
<P class=rvps3><STRONG>Input for arguments can always be done in any of

x64_dbg_dbg/value.cpp

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1169,7 +1169,13 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print
11691169
if(!value or !DbgIsDebugging())
11701170
return false;
11711171
//explicit API handling
1172-
const char* apiname = strstr(name, ":");
1172+
const char* apiname = strstr(name, ":"); //the ':' character cannot be in a path: http://msdn.microsoft.com/en-us/library/windows/desktop/aa365247(v=vs.85).aspx#naming_conventions
1173+
bool noexports = false;
1174+
if(!apiname)
1175+
{
1176+
apiname = strstr(name, "?"); //the '?' character cannot be in a path either
1177+
noexports = true;
1178+
}
11731179
if(apiname)
11741180
{
11751181
char modname[MAX_MODULE_SIZE] = "";
@@ -1210,7 +1216,7 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print
12101216
}
12111217
else
12121218
{
1213-
uint addr = (uint)GetProcAddress(mod, apiname);
1219+
uint addr = noexports ? 0 : (uint)GetProcAddress(mod, apiname);
12141220
if(!addr) //not found
12151221
{
12161222
if(scmp(apiname, "base") or scmp(apiname, "imagebase") or scmp(apiname, "header")) //get loaded base
@@ -1234,7 +1240,7 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print
12341240
uint ordinal;
12351241
if(valfromstring(apiname, &ordinal))
12361242
{
1237-
addr = (uint)GetProcAddress(mod, (LPCSTR)(ordinal & 0xFFFF));
1243+
addr = noexports ? 0 : (uint)GetProcAddress(mod, (LPCSTR)(ordinal & 0xFFFF));
12381244
if(!addr and !ordinal) //support for getting the image base using <modname>:0
12391245
addr = modbase;
12401246
}

0 commit comments

Comments
 (0)