DbgValFromString&DbgEval

[Paliha]

Hi!
What method can I get data from a variable in a script?
Example from the script:
FindPointer mytable, pattern, 4
The method that I use:
bool cbFunctionFindPointer(int argc, char* argv[3])
{
char buffer[MAX_MNEMONIC_SIZE];
bool success;
duint index = DbgEval(argv[1], &success);
duint Size = Memory::GetSize(DbgValFromString(argv[1]), false, true);
.....
}
Unfortunately, there are no data in the variables. As a result, the functions (DbgValFromString&DbgEval) simply convert the variable name to unsigned __int64:
0x0000020db33b9720 {0x0000020db33b72f0 "FindPointer mytable, pattern, 4"}
index = 5557833728 //unsigned __int64
Size = 1077248 //unsigned __int64

[mrexodia]

Hi, can't you just use findallmem from your script? findallmem 0, "{bswap@mytable}" should work. Otherwise could you paste the full code because right now it does not make any sense to me.

[Paliha]

if my memory serves me, this command displays the search result in the ref window. This is not convenient. To search for va / rva pointers, I wrote my command and everything was in order. With the transition to a fresh OS (vin10.1809) in place of the arguments, I get a line with the command and variables.

[mrexodia]

Can you post your whole code so I can take a look?

…

On Sun, 13 Oct 2019 at 05:36, Paliha ***@***.***> wrote: if my memory serves me, this command displays the search result in the ref window. This is not convenient. To search for va / rva pointers, I wrote my command and everything was in order. With the transition to a fresh OS (vin10.1809) in place of the arguments, I get a line with the command and variables. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2223?email_source=notifications&email_token=AASYFGMHZCDQYSBSXIUY5NLQOKJT3A5CNFSM4I62U5KKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEBCNPRA#issuecomment-541382596>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AASYFGIRYH5XXN47XSVB7SDQOKJT3ANCNFSM4I62U5KA> .

[mrexodia]

It might help to try

bool cbListArguments(int argc, char* argv[])
{
    for(int i = 0; i < argc; i++) dprintf("%d:%s\n", i, argv[i]);
    return true;
}

And see what is the output.

[Paliha]

for(int i = 0; i < argc; i++) dprintf("%d:%s\n", i, argv[i]);
the output is the same variables.

---

updated sdk, added to method:
sprintf(buffer, "%p", DbgValFromString(argv[2]));
strncpy_s(buffer, buffer, len);
now everything is great..))

[mrexodia]

I have no idea what the issue was. The code you sent earlier looked fine 🤷‍♂ but glad you fixed it :) Feel free to close the issue if it’s solved.