Windbg下查看QT字符串对象数据

逆向工程 qt
2021-07-01 14:43:54

我正在调试 Qt 应用程序并尝试在调试器中查看 QT 字符串对象数据。我指的是这个博客,它展示了如何做到这一点,但是,我无法访问源代码。windbg 缺乏显示基本 QT 数据的能力。在windbg 中,我想查看所有QtStrings 被传递给任何Qt-API 的内容。

在以下由 toString() 返回的反汇编字符串对象被传递给 setHttpUserAgent API 时,参数被放置在 rcx 和 rdx 寄存器上。我想在windbg/任何调试器中查看这些字符串。

.text:00000001400424CC                 lea     rdx, [rbp+57h+var_90]
.text:00000001400424D0                 mov     rcx, rax
.text:00000001400424D3                 call    cs:?toString@QVariant@@QEBA?AVQString@@XZ ; QVariant::toString(void)
.text:00000001400424D9                 nop
.text:00000001400424D9 ;   } 
.text:00000001400424DA                 mov     rdx, rax
.text:00000001400424DD                 mov     rcx, r14
.text:00000001400424E0                 call    cs:?setHttpUserAgent@QWebEngineProfile@@QEAAXAEBVQString@@@Z ; QWebEngineProfile::setHttpUserAgent(QString const &)
.text:00000001400424E6                 nop
.text:00000001400424E6 ;   }

为此,我相信我需要更好地了解 Qt 字符串的内存布局。如果有任何文件可以帮助我弄清楚,请告诉我。

提前致谢。

1个回答

函数 toString 在 rax 中返回一个 Qstring
执行 db poi(@rax) 应该在您跳过该函数后显示该字符串

一个小的自动断点

设置一个条件断点,在返回地址上设置另一个单次断点并打印 rax 的内容并继续

0:006> bl (should be in one line )
     0 e Disable Clear  00000000`5ffd7220     0001 (0001)  0:**** 
Qt5Core!QT::QVariant::toString "bp /1 @$ra \"db poi(@rax) l30;.echo ========;gc\";gc"
0:006> g
0000027c`ca346580  02 00 00 00 05 00 00 00-06 00 00 00 00 00 00 00  ................
0000027c`ca346590  18 00 00 00 00 00 00 00-73 00 74 00 61 00 72 00  ........s.t.a.r.
0000027c`ca3465a0  74 00 00 00 00 00 00 00-d8 be 55 86 00 45 02 80  t.........U..E..
========
0000027c`d0feb620  02 00 00 00 10 00 00 00-11 00 00 00 00 00 00 00  ................
0000027c`d0feb630  18 00 00 00 00 00 00 00-30 00 30 00 30 00 30 00  ........0.0.0.0.
0000027c`d0feb640  30 00 30 00 30 00 30 00-30 00 30 00 34 00 30 00  0.0.0.0.0.0.4.0.
========
0000027c`ca45a750  02 00 00 00 0c 00 00 00-0d 00 00 00 00 00 00 00  ................
0000027c`ca45a760  18 00 00 00 00 00 00 00-5b 00 6d 00 61 00 69 00  ........[.m.a.i.
0000027c`ca45a770  6e 00 20 00 65 00 6e 00-74 00 72 00 79 00 5d 00  n. .e.n.t.r.y.].
========
00000000`60093038  ff ff ff ff 00 00 00 00-00 00 00 00 00 00 00 00  ................
00000000`60093048  18 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
00000000`60093058  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
========
0000027c`ca343040  02 00 00 00 04 00 00 00-05 00 00 00 01 00 00 00  ................
0000027c`ca343050  18 00 00 00 00 00 00 00-4e 00 61 00 6d 00 65 00  ........N.a.m.e.
0000027c`ca343060  00 00 61 74 69 6f 6e 00-84 bb 01 83 00 29 01 90  ..ation......)..
========
0000027c`ca3433d0  02 00 00 00 07 00 00 00-08 00 00 00 01 00 00 00  ................
0000027c`ca3433e0  18 00 00 00 00 00 00 00-41 00 64 00 64 00 72 00  ........A.d.d.r.
0000027c`ca3433f0  65 00 73 00 73 00 00 00-bd bb 48 83 00 3c 01 95  e.s.s.....H..<..
========