pause the debugger conditionally
An example of pausing system while a special path is passed to the NtCreateFile
Last updated
An example of pausing system while a special path is passed to the NtCreateFile
Last updated
In the , we saw how to create logs from function. Now, we want to explore .
From the , NtCreateFile is defined like this:
There is no pointer to the file name in the above prototype. The file name is embedded into the ObjectAttributes parameter to this function.
If you want to see how OBJECT_ATTRIBUTES structure is defined, you can see link from MSDN.
From the relative-address point of view, this function is stored in the memory like this:
If we look at the UNICODE_STRING structure. It's defined like this:
And the compiler saves it like this:
Now, we have all the offsets that we want to observe the file names.
First, the ObjectAttributes parameter is passed as the 3rd parameter to the function, and as the calling convention is Windows fastcall (rcx, rdx, r8, r9, stack), our target parameter is located at the r8 register.
In our case, r8 is a pointer to the OBJECT_ATTRIBUTES, and if we add 0x10 to it, we'll reach the ObjectName field of this structure.
ObjectName is a pointer to the UNICODE_STRING, so we'll dereference this pointer using the poi operator to reach the top of the UNICODE_STRING.
The final script is like this:
To test it, you need to open a notepad and save the file at the target location (C:\folder\test.txt), and you'll see the debugger is paused.
We can see that there is a field named ObjectName. This is the name of the object that we're trying to open using NtCreateFile.
In the UNICODE_STRING, we'll add 0x8 to get the Buffer filed of this structure, and now we dereference it again to get the pointer where the file name string is located. The string is in wide-character format, so for the comparison, we need to use the function.
At this point, we want to pause the debugger (halt the system) while Windows passes the C:\folder\test.txt file to the NtCreateFile in the kernel. We'll use the '' command to execute a script on each execution of the NtCreateFile function, and then compare the file name with \\??\\C:\\folder\\test.txt and if it's equal to this file, then we the debugger. Note that, \\?? is added to the start of the file.