4

I'm new to reverse engineering.

I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS

(It's a c++ program, and is VERY simple; it just prints a string, and two memory addresses of two other strings.)

I've tried using the documentation on string formating (on the help page of x64dbg's website), but that didn't help me.

The assembly dialog says: "Instruction encoding error: invaild state" on the code lea rdx, {s:whatever}

If you know a basic, one line way to print a string like std::cout << string; in c++, please tell me.

Thanks in advance.

clouded.
  • 41
  • 2
  • I'm confused. Are you trying to use x64dbg's assembler to patch an instruction to reference a new string, which you are trying to creating using x64dbg's string formatting functionality when specifying the new assembly instruction? That does not seem legit to me. – Rolf Rolles Apr 09 '23 at 15:38
  • 1
    Iinw he is trying to log a std::string using x64dbg builtin scripting the curly brackets iirc is from builtin scripting syntax. If windbg i would say .printf %ma , either sso buffer or pointer to new() – blabb Apr 10 '23 at 06:21
  • I have found a way to do it. If you follow the code lea rdx, ds:[memory addr] in dump with the constant, then go up a bit, you will see the string. Then it's just a matter of changing the hex values. – clouded. Apr 18 '23 at 22:14

1 Answers1

2

not sure what your intent is
i think you want to log a std::string that is being output by std::cout
to the log window of x64dbg based on the use of {s:whatever} syntax in your query.

if that is the case i hope you know std::string is a structure
and it may either contain the string if it is less than an implementation threshold limit
or a pointer if the string is long enough to cross the limit . since your query also use rdx i assume you can see the string that would be printed in the registers window of x64dbg and you would want to print that string to log window of x64dbg

if that is the case

try using log {s:rdx} or log "{s:rdx}" in the script input command window you can see the string in status bar as well as log window

if you were on windbg i could show you how the string is part of a structure as below

0:000> lsa .
     4: int main (void) 
     5: {
     6:     cout << "hello cout" << endl;
     7:     string longstr = "this is a very very loooooooooooooooooooooooooong stringgggggg";
>    8:     cout << longstr << endl;
     9:     return 0;
    10: }
    11:

0:000> ? @rdx
Evaluate expression: 215422596808 = 00000032`282ff6c8


0:000> ?? ((cout!std::string )@rdx)->_Mypair._Myval2._Bx._Ptr
char  0x000001a1`86eadb40
 "this is a very very loooooooooooooooooooooooooong stringgggggg"


0:000> .printf "%ma\n" , @@c++(((cout!std::string *)@rdx)->_Mypair._Myval2._Bx._Ptr)
this is a very very loooooooooooooooooooooooooong stringgggggg

i just flipped out an old version of x64dbg and gave it a whirl

if you want to log what i wrote above holds
if you wanted to alter the string (why bother with scripting when you can edit memory is beyond me ) but if you persist
you can use [rdx]?=hexencoded string like [rdx]?=0x41414141414141

enter image description here

blabb
  • 16,376
  • 1
  • 15
  • 30
  • So do I change lea rdx, ds:[memory addr] to [rdx]?=hexencodedstring or do I change it to lea rdx, [rdx]?=hexencodedstring? – clouded. May 10 '23 at 00:05
  • I would like to do it like to do it like this because when you edit the dump (in x64dbg) you can only change the string to a string of a same size or less. – clouded. May 10 '23 at 00:06
  • Neither your question nor the logic you offer in your second comment makes any sense. You do not change the instruction to alter memory it doesn't work that way. And neither you can alter a fixed size string to a larger string either via memory edit or by scripts – blabb May 10 '23 at 02:39