In my system don't works.. I can't see attach, and re-write code:
Code:
call GetCommandLineA
mov ebx,eax ;save ptr cmdline
xor ecx,ecx
push ecx ;hTemplateFile
push ecx ;dwFlagsAndAttributes
push OPEN_EXISTING ;dwCreationDisposition
push ecx
push FILE_SHARE_READ + FILE_SHARE_WRITE
push GENERIC_READ
push ebx
call CreateFileA
Always return -1
But - if I remove quotes (insert after getcommandline call)
Code:
mov ebx,eax ;save ptr cmdline
push eax
call lstrlenA
dec eax ;sub quote
mov byte ptr [ebx + eax],0 ;remove end quote
inc ebx ;remove start quote
it open file success under debuger.
x64dbg, win10.