Official Blog for OBE Messages
 

Older Post

Home

Newer Post
Tuesday, 24 July 2012
libevent - evbuffer_add_file
this function is a little bit tricky from assembly programming point of view, unless you dig into the source or see the ollydbg output,

buffer.h
========
int evbuffer_add_file(
struct evbuffer *outbuf,
int fd,
ev_off_t offset,
ev_off_t length);

usually we assume 4 arguments = 4 DWORD but not in this case.

util.h
======
#ifdef WIN32
#define ev_off_t ev_int64_t
#else

#define ev_int64_t signed __int64

see that, these ev_off_t is 64 bits (QUADWORD), damn it,

so, the proper way to call this function would be
mov eax,[efilelen]
cdq
push edx eax
push 0 0
cinvoke evbuffer_add_file,[ebuffer],[efileh]

Labels: , ,

Post a Comment


Older Post

Home

Newer Post