Notepad as a debug console

Index > Windows > Notepad as a debug console

Author

Thread

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8353
Location: Kraków, Poland

Tomasz Grysztar 22 May 2020, 10:27

I think this actually a brilliant idea:
https://www.reddit.com/r/programming/comments/gnazif/ray_tracing_in_notepadexe_at_30_fps/fr8uy2l?utm_source=share&utm_medium=web2x

A simple trick that gives an ability to annotate/redact the debug output in real time. Wink

To play with the idea I made it into a fasm's macro:

Code:

macro log fmtstr, params:0 & {
        cinvoke wsprintf, buffer, <fmtstr,13,10>, params
        invoke  FindWindow, NULL, "Untitled - Notepad"
        invoke  FindWindowEx, eax, NULL, "EDIT", NULL
        invoke  SendMessage, eax, EM_REPLACESEL, TRUE, buffer
}

Use it like:

Code:

        log  "EAX: %08x, EBX: %08x, ECX: %08x, EDX: %08x", eax, ebx, ecx, edx

(You need to have a sufficiently large buffer declared somewhere, under "buffer" label.)

Unfortunately, the title of the window changes on manual editing. But you could also search by class:

Code:

        invoke  FindWindow, "Notepad", NULL

22 May 2020, 10:27

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20339
Location: In your JS exploiting you and your system

revolution 22 May 2020, 12:36

I guess any window that has a standard EDIT class subwindow could also be used. Or even the fasmw window and its ASMEDIT/FEDIT class.

The log macro will corrupt EFLAGS, EAX, ECX and EDX though.

22 May 2020, 12:36

Ali.Z

Joined: 08 Jan 2018
Posts: 718

Ali.Z 22 May 2020, 21:30

@Tomasz, you to keep in-mind notepad would not allocate more than 65535 bytes (64KB), unless you change that explicitly.

@rev, yes any standard EDIT control class can be used or custom class only if you know what message number to send.

as for the idea of logging, i have implemented similar concept long time ago. i did not choose notepad nor EDIT class for real time debug output, however i made my own notepad program that open X file for read/share access and constantly reading the file and updating the edit control output.

from another program (that program that wants to log stuff) open the same file for write/share access, and write values in it basically append to end of file.

also from my notepad i save a pointer to last character on the file, and when i read again i only read from last position and if its end of line then it means no content was altered.

_________________
Asm For Wise Humans

22 May 2020, 21:30

DimonSoft

Joined: 03 Mar 2010
Posts: 1228
Location: Belarus

DimonSoft 23 May 2020, 13:25

What’s wrong with OutputDebugString?

23 May 2020, 13:25

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8353
Location: Kraków, Poland

Tomasz Grysztar 23 May 2020, 14:03

Oh, you all being serious while I'm just having fun. Very Happy

23 May 2020, 14:03

AsmGuru62

Joined: 28 Jan 2004
Posts: 1625
Location: Toronto, Canada

AsmGuru62 23 May 2020, 19:02

Did anyone actually tried this?
I think it was possible in Windows XP, but today I am not sure.
You see, I had to make something like this on the job and it did not work.
I think I got an error code 5 - Access denied.

23 May 2020, 19:02

bitRAKE

Joined: 21 Jul 2003
Posts: 4042
Location: vpcmpistri

bitRAKE 24 May 2020, 04:48

This "work" thing you talk about - what is that? Rolling Eyes

fasmg amd64 implementation runnning on Win10

Description:	Open up Notepad and make sure to enter at least one key into the edit control.	Download
Filename:	d_noter.zip
Filesize:	2.65 KB
Downloaded:	512 Time(s)

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup

24 May 2020, 04:48

Roman

Joined: 21 Apr 2012
Posts: 1792

Roman 24 May 2020, 07:06

Iterate
What this mean and do ? And what analog iterate in Fasm 1.73 ?

iterate p,RAX,P
mov rax,p
mov [rsp+24+8*%],rax
end iterate

From macro

Code:

macro TLOG fmt,P&
        local _
        push _
        enter 2024,0
        and rsp,-16
        Get100ns
        push rax
        sub rax,[_timelast]
        pop [_timelast]
        iterate p,RAX,P
                mov rax,p
                mov [rsp+24+8*%],rax
        end iterate
        call __DEBUG__
        db "0x%IX: ",fmt,13,10,0
        label _:8                          ;what this line do ?!
end macro

24 May 2020, 07:06

bitRAKE

Joined: 21 Jul 2003
Posts: 4042
Location: vpcmpistri

bitRAKE 24 May 2020, 07:28

iterate is irps in fasm 1, iirc. Think irps works in fasmg, too. (Just ends with end irps in this later case.)

P can be a list of parameters which are iterated through, and % gets updated with the index of the item in the list. label just creates a label - like "_:" in this case would be the same as "label _". The ":8" is leftover from copy-paste and doesn't need to be there. Embarassed

Could get a little protection by doing " label _:-1" Very Happy

Can't move data from the location without explicit size override.

Try:

Code:

label _
mov eax,[_] ; good
jmp _ ; good

Verses:

Code:

label _:-1
mov eax,[_] ; bad
jmp _ ; good

mov eax, dword [_] ; good, we know what we're doing

Another pattern I use regarding label is:

Code:

align 64
label Buffer: 1 shl 16
rb sizeof Buffer

...defining the data size in one place and using sizeof Buffer everywhere else, in order that changes can be made easier. No need for defining another symbol to reflect the size, etc.

Code:

ToggleMenuItemCheck:
        enter 32,0
        label .hMenu:8 at FRAME.RCX
        label .nCmdId:4 at FRAME.RDX

        mov [.nCmdId],ecx

        xor r9,r9
        mov r8d,NPPPLUGINMENU
        mov edx,NPPM_GETMENUHANDLE
        mov rcx,[nppHandle]
        call [SendMessageW]
        mov [.hMenu],rax

        xor r8,r8 ; MF_BYCOMMAND or MF_UNCHECKED
        mov edx,[.nCmdId]
        mov rcx,[.hMenu]
        call [CheckMenuItem]

        test eax,MF_CHECKED ; was it MF_UNCHECKED already?
        jnz .unchecked

        mov r8d,MF_CHECKED ; or MF_BYCOMMAND
        mov edx,[.nCmdId]
        mov rcx,[.hMenu]
        call [CheckMenuItem]
.unchecked:
        ; eax is previous state
        leave
        retn

Here I use label to rename a local space to increase readablity.

Code:

; tail of stack frame is almost always the same, name the parts to simplify use
iterate X, RBP,return_addr,RCX,RDX,R8,R9
        define FRAME.#X rbp+8*%
end iterate

This understanding of the stack is used globally.

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup

Last edited by bitRAKE on 29 May 2020, 23:50; edited 1 time in total

24 May 2020, 07:28

AsmGuru62

Joined: 28 Jan 2004
Posts: 1625
Location: Toronto, Canada

AsmGuru62 28 May 2020, 11:37

bitRAKE:
That's great!
I guess my "Access denied" was connected to some other thing -- my guess would be VC++ 6.0 I was using -- old libraries maybe, I dunno.
"Work" is when you get paid for writing awesome code.
I changed jobs in 2019, so now I just use C++, no Assembler allowed.

28 May 2020, 11:37

bitRAKE

Joined: 21 Jul 2003
Posts: 4042
Location: vpcmpistri

bitRAKE 28 May 2020, 18:17

Someone tipped me $20 for coding in a coffee shop about 30 years ago. Also, I had a job that I taught myself Excel VBA to automate. So, technically, I was paid to program, but they fired me once it was automated.

It's good to see you around these parts - hopefully, it will be useful to your work.

_________________
¯\(°_o)/¯ “languages are not safe - uses can be” Bjarne Stroustrup

28 May 2020, 18:17

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum