Debugging an application's use of msvcrt!_read. Found a nifty Windbg script online Reversing on Windows: intercepting ReadFile that I lightly edited:$$ Windbg script to intercept when a file is being read.bp msvcrt!_read.while(1){  g  $$ Get parameters of _read()  r $t0 = dwo(esp+4)  r $t1 = dwo(esp+8)  r $t2 = dwo(esp+0x0c)  $$ Execute until return is reached  pt  $$ Read magic value in the buffer  $$ CHANGE position in buffer here  r $t5 = dwo(@$t1+0x00)  r  .printf hFile=%p buffer=%p count=%p\n, @$t0, @$t1, @$t2  $$ Check if magic value matches  $$ CHANGE constant here  db @$t1 $$ had to put this here b/c .if never executed 'clause'  .if(@$t5 == 0x00000000) $$magic string  {    db @$t1    $$ UNCOMMENT below to break in the debugger    .break  }}$$ Clear BP for ReadFile (assume it is the 0th one)bc 0I tried using the following 'magic string' of bytes:77 30 30 66in:.if(@$t5 == 0x77303066) $$magic stringHowever, it never meets that condition. Most frustrating part is that I see the magic string when the script runs the 'db@$t1' eax=00000400 ebx=02895cc4 ecx=75b7c2d6 edx=771f70f4 esi=017d0ab8 edi=028b2534eip=75b7c2d6 esp=03d2fbec ebp=00000003 iopl=0         nv up ei pl zr na pe nccs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246msvcrt!_read+0xd1:75b7c2d6 c3              rethFile=00000003 lpBuffer=05f30020 nNumberOfBytesToRead=0000040005f30020  77 30 30 66 00 00 00 2e-00 00 00 00 00 00 00 00  w00f............05f30030  00 2e 2e 2e 2e 2e 00 00-00 2e 00 00 00 2e 2e 00  ................05f30040  00 2e 2e 00 00 00 04 00-00 00 2e 2e 00 00 2e 2e  ................05f30050  00 00 2e 2e 00 00 00 00-00 00 00 00 00 00 01 2e  ................05f30060  00 2e 00 2e 2e 2e 2e 2e-00 00 00 2e 00 00 00 2e  ................I've also tried changing the magic string in the wds script to little endian, still doesnt work though.How may I format the if statement to trigger in the above script using the magic string 'w00f?' 
Windbg Scripting Issue
windows;windbg
The first four bytes of the file (77 30 30 66) will be read into @$t5 in little-endian format.So .if(@$t5 == 0x77303066) should be .if(@$t5 == 0x66303077).