it works some thing like this (it has been once and some time has
passed since i used it so i now dont remember exactly but the
following are about 85 % right as far as concept goes)
$spat(“some crap string”, rap) will return back true or false
you can set up an alias for the expression
in usermode CreateFileA api the file path is at [esp+4] when you broke
on kernel32.dll CreateFileA first executable instruction
On 3/16/08, Martin O’Brien wrote: > I get where you’re headed, and it’s a good idea, but you lost me with > “$spat?” What is that?
you cant find it in index of help file isnt it welcome to arcane pseudo whatever and even more arcane documentation
here it is quoted verbatim from help file doing a raw search
$spat(“String”, “Pattern”) Evaluates to TRUE or FALSE depending on whether String matches Pattern. Pattern can contain a variety of wildcard characters and specifiers. For more information about the syntax, see String Wildcard Syntax.
here is the url for the page in windbg version 6.8.4.0 mk:@MSITStore:F:\misc\debugger.chm::/hh/Debugger/r13_syntax_eac65e6b-f13f-4fcb-8973-e64ba0ac8865.xml.htm
one more occurance can be located here
The $scmp, $sicmp, and $spat string operators in MASM syntax are particularly useful. For more information about these operators, see MASM Numbers and Operators.
whose url is mk:@MSITStore:F:\misc\debugger.chm::/hh/Debugger/r05_use_start_262edb22-df18-4102-a408-04f482aaac86.xml.htm
anyway this is how it is supposed to work
create a text file arbitrarily named spat.txt and put the following contents in that file
0:002> .shell type spat.txt
==============================================
as /ma ${/v:foo} poi(esp+4); j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4)
=============================================
.shell: Process exited
run calc.exe in windbg
set a bp on kernel32!CreateFileA like this
0:006> bl 0 e 77e7b476 0001 (0001) 0: **** kernel32!CreateFileA "$<spat.txt> and run the debugee with g
when its runnnig open help->help topics
and you will see windbg stopping on all chm file loads like below
Microsoft (R) Windows Debugger Version 6.8.0004.0 X86 Copyright (c) Microsoft Corporation. All rights reserved.
CommandLine: c:\windows\system32\calc.exe Symbol search path is: SRVF:\misc\symbolshttp://msdl.microsoft.com/download/symbols Executable search path is: ModLoad: 01000000 0101f000 calc.exe ModLoad: 77f50000 77ff7000 ntdll.dll ----------------snipped further modloads for brevity----------------------
(2ac.474): Break instruction exception - code 80000003 (first chance) eax=00191eb4 ebx=7ffdf000 ecx=00000002 edx=77f6eb04 esi=00191eb4 edi=00191f48 eip=77f767cd esp=0006fb38 ebp=0006fc2c iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 ntdll!DbgBreakPoint: 77f767cd cc int 3 0:000> rm 0 0:000> bp kernel32!CreateFileA "$<spat.txt>0:000> g ModLoad: 71950000 71a34000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.10.0_x-ww_f7fb5805\comctl32.dll ----------------snipped further modloads for brevity----------------------
0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4)
0090ecd0 “C:\WINDOWS\Help\calc.chm” 0:002> 0090ecd0 “C:\WINDOWS\Help\calc.chm” <– true for the pattern broke here kernel32!CreateFileA: 77e7b476 55 push ebp 0:002> g 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) ModLoad: 769c0000 76b0a000 C:\WINDOWS\System32\shdocvw.dll ----------------snipped further modloads for brevity---------------------- 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4) ModLoad: 75e90000 75f37000 c:\windows\system32\SXS.DLL ----------------snipped further modloads for brevity---------------------- Moniker.cpp Find This File ntshared.chm 0:002> as /ma ${/v:foo} poi(esp+4); 0:002> j ( $spat( “${foo}”, “chm” ) == 0 ) gc ; da poi(esp+4)
0090dcf8 “C:\WINDOWS\Help\ntshared.chm” 0:002> 0090dcf8 “C:\WINDOWS\Help\ntshared.chm” <– true for the pattern broke here kernel32!CreateFileA: 77e7b476 55 push ebp
if some one from windbg team is reading this they could tell why this error msg pops up on all gc executions though it doesnt hamper the functionality and how to mask it if i dont care