c++ - Create std::string inside debugger -


i'm debugging x86 program (written in c++ / vs2012 / statically linked) in windbg , have object files. point of interest function:

static bool isvalidtoken(const std::string& token) 

this function receives string token validate client.

i want able test inside debugger, have create std::string command: .call isvalidtoken(<addr_of_string>).

dumping , manipulating std::string inside windbg relatively easy, possible create it?

i'm able hijack other strings , change can test, crashes program sometimes. i'm trying find static constructor class it's hard because it's heavily based on templates.

by debugging test program in visual studio (suggested @cdonts in comments) find constructor prototype std::string. shown in command follows.

back windbg issued following command find symbols signature (note * used wildcard replace spaces):

0:047> x manager!std::basic_string<char,std::char_traits<char>,std::allocator<char>*>::basic_string<char,std::char_traits<char>,std::allocator<char>*> 

found following constructors:

6e36bf96 manager!std::basic_string<...prototype...> (char *, char *) 6e67fa65 manager!std::basic_string<...prototype...> (class std::basic_string<...prototype...> *, int, int) 6d519218 manager!std::basic_string<...prototype...> (class std::_string_const_iterator<...prototype...>) 6d54c745 manager!std::basic_string<...prototype...> (char *, unsigned int) 6d0c2666 manager!std::basic_string<...prototype...> (char *) 6d1f2a43 manager!std::basic_string<...prototype...> (class std::basic_string<...prototype...> *) 6d151eb8 manager!std::basic_string<...prototype...> (class std::basic_string<...prototype...> *) 

i ommited parts of prototypes, 1 interests is:

6d0c2666 manager!std::basic_string<...prototype...> (char *) 

this 1 takes char * argument. used initialize newly created string, , it's easy provide. so, steps job are:

  1. allocate memory object ( std::string ). use 1000 because it's minimum allocation size:

    0:047> .dvalloc 1000 allocated 1000 bytes starting @ 03fe0000 
  2. allocate buffer char * parameter:

    0:047> .dvalloc 1000 allocated 1000 bytes starting @ 03ff0000 

    we can initialize buffer with:

    0:047> ea 0x03ff0000 "my string here" 
  3. place .call command passing 2 parameters: first 1 address of memory allocated object itself, happens this argument, because funcion uses thiscall calling convention (windbg knows , places in ecx). second 1 char * parameter constructor:

    0:048> .call 6d0c2666(0x03fe0000, 0x03ff0000) thread set call, 'g' execute. warning: can have serious side-effects, including deadlocks , corruption of debuggee.  0:048> g 

after have std::string object (at 0x03fe0000) work with, containing text "my string here".


Comments

Popular posts from this blog

java - pagination of xlsx file to XSSFworkbook using apache POI -

Unlimited choices in BASH case statement -

apache - How do I stop my index.php being run twice for every user -