Son of Strike (SOS)

SOS Walkthrough Part II

Now that a few more commands have been introduced, an additional walkthrough is helpful. The following walkthrough dumps the source code, MSIL, and assembly code of the btnTransaction_Click button handler, which is informative.

1. Start the walkthrough by running the Store application and attach WinDbg to the application.

2. Dump information about the btnTransaction_Click method with the !name2ee command. Notice that the method has not been jitted yet, which means that the method has not been invoked before. A function is jitted when it is first invoked.

   0:004> !name2ee store.exe Store.Form1.btnTransaction_Click
   Module: 00d40c14 (Store.exe)
   Token: 0x06000004
   MethodDesc: 00d43968
   Name: Store.Form1.btnTransaction_Click(System.Object, System.EventArgs)
   Not JITTED yet. Use !bpmd -md 00d43968 to break on run.
   0:004> !u 00d43968
   Not jitted yet
   

3. Continue the Store application using the g(o) command and click the Add Transactions button. Interrupt the program in the debugger with Ctrl+Break. Dump information on Store.Form1.btnTransaction_Click again. This time, the method is shown as jitted, and the virtual address of the cached native binary is displayed:

   0:004> !name2ee store.exe Store.Form1.btnTransaction_Click
   Module: 00d40c14 (Store.exe)
   Token: 0x06000004
   MethodDesc: 00d43968
   Name: Store.Form1.btnTransaction_Click(System.Object, System.EventArgs)
   JITTED Code Address: 00de07c0
   
   

4. The !u command displays the assembly code of a jitted method. Use this command for the btnTransaction_Click method:

   0:004> !u 00d43968
   Normal JIT generated code
   Store.Form1.btnTransaction_Click(System.Object, System.EventArgs)
   Begin 00de07c0, size 3e9
   00de07c0 55               push    ebp
   00de07c1 8bec             mov     ebp,esp
   00de07c3 57               push    edi
   00de07c4 56               push    esi
   00de07c5 53               push    ebx
   00de07c6 83ec50           sub     esp,0x50
   00de07c9 33c0             xor     eax,eax
   00de07cb 8945d0           mov     [ebp-0x30],eax
   00de07ce 8945c4           mov     [ebp-0x3c],eax
   00de07d1 33c0             xor     eax,eax
   00de07d3 8945e8           mov     [ebp-0x18],eax
   00de07d6 894dc0           mov     [ebp-0x40],ecx
   00de07d9 8955dc           mov     [ebp-0x24],edx
   00de07dc 833dc80dd40000   cmp     dword ptr [00d40dc8],0x0
   

5. Challenge two is to list the MSIL code for the btnTransaction_Click method. The dumpil command shows the MSIL code of the method:

   0:004> !dumpil 00d43968
   ilAddr = 0040247c
   IL_0000: nop
   .try
   {
     IL_0001: nop
     IL_0002: ldarg.0
     IL_0003: ldfld Store.Form1::txtNumber
     IL_0008: callvirt System.Windows.Forms.Control::get_Text
     IL_000d: call System.Int32::Parse
     IL_0012: stloc.0
     IL_0013: nop
     IL_0014: leave.s IL_001d
   } // end .try
   .catch
   {
     IL_0016: pop
     IL_0017: nop
     IL_0018: ldc.i4.1
     IL_0019: stloc.0
     IL_001a: nop
     IL_001b: leave.s IL_001d
   } // end .catch
   

6. The final task is to display the source code. Set the source code path in WinDbg. From the File menu, choose the Source File Path command and then enter the source code path. Enter the lsf command to set form1.cs as the source code file. List the source with the ls command. For the walkthrough, lines 10 to 50 are displayed:

   0:004> lsf form1.cs
   0:004> ls 10, 40
       22:
       23:         private void btnTransaction_Click(object sender, EventArgs e)
   
       24:         {
       25:              int numofTransactions;
       26:              try
       27:              {
       28:                  numofTransactions= int.Parse(txtNumber.Text);
       29:              }
       30:              catch
       31:              {
       32:                  numofTransactions = 1;
       33:              }
       34:              for (int count = 0; count < numofTransactions; ++count)
       35:              {
       36:                  int itemTotal=0;