Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doesnt work as expected #2

Open
Arryboom opened this issue Jul 27, 2021 · 2 comments
Open

Doesnt work as expected #2

Arryboom opened this issue Jul 27, 2021 · 2 comments

Comments

@Arryboom
Copy link

Arryboom commented Jul 27, 2021

image

memory addr 0x00007FF70C97EB30 has UTF8 string"PAUSE_MENU_HEADERNTAL_BUTTONS" in it,which in bytes copy

50 41 55 53 45 5F 4D 45 4E 55 5F 48 45 41 44 45 52 00 00 4E 54 00 41 4C 5F 42 55 54 54 4F 4E 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

and run these command from console,got 0 return

strmatch_set 177,"PAUSE_MENU"
stristr_utf8(00007FF70C97EB30,177)

image

@Arryboom
Copy link
Author

Arryboom commented Jul 27, 2021

and further,if we use stristr_local,no matter how it will consistently return 1

at this time addr 0x00007FF70C97EB30 still was "PAUSE_MENU_HEADERNTAL_BUTTONS",and this addr never use "test" string in it.

image

the x64dbg version used is May 8,2021 and I was debugging a x64 program on win10

@hackoflpf
Copy link

this is because x64dbg has modify the implements of pluginexprfuncregister function,the argv which program passed has been a vector data,so you should use a index for the count which expression hits,then you can get the real argv from the offset of argv program passed,this is really stupid ,i have met the same question and i find this problem...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants