Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 05-08-2005, 11:15
nikola nikola is offline
Friend
 
Join Date: Jan 2004
Location: Your head
Posts: 115
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
nikola Reputation: 0
Question Writing small debugger

I'm trying to write a small "debugger" for one specific app. For starters i want to get to EP but i dont know how to do that. Here is how i tried to do so, but when i sompare used memory of app how Olly loaded and how i loaded it, Ollys child process has occupied more memory.

Code:
  if DWORD(CreateProcess('1.exe',nil,nil,nil,FALSE,DEBUG_PROCESS or DEBUG_ONLY_THIS_PROCESS,nil,nil,si,pi)) = 0 then begin
    ShowLastError();
    ExitProcess(0);
  end;
  WaitForDebugEvent(dbevent, INFINITE);
  ContinueDebugEvent(pi.dwProcessId , pi.dwThreadId, DBG_EXCEPTION_NOT_HANDLED);
  if dbevent.dwDebugEventCode <> CREATE_PROCESS_DEBUG_EVENT then begin
    MessageBox(0, 'Couldnt get to EP !', 'Error !!!', MB_ICONERROR);
    Exit;
  end;
  if dbevent.dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT then MessageBox(0, 'Got to EP !', 'OK !!!', MB_ICONERROR);

  stop := False;
  while not stop do begin
    stop := True;
    if dbevent.dwDebugEventCode = LOAD_DLL_DEBUG_EVENT then Stop := False;
    if dbevent.dwDebugEventCode = CREATE_THREAD_DEBUG_EVENT then Stop := False;
    if dbevent.dwDebugEventCode = CREATE_PROCESS_DEBUG_EVENT then Stop := False;

    WaitForDebugEvent(dbevent, INFINITE);
 		dwStat := DBG_EXCEPTION_NOT_HANDLED;
    case dbevent.dwDebugEventCode of
      EXCEPTION_DEBUG_EVENT:  begin
                                case dbevent.Exception.ExceptionRecord.ExceptionCode of
                                  EXCEPTION_BREAKPOINT: dwStat := DBG_CONTINUE;
                                end;
                              end;
      EXIT_PROCESS_DEBUG_EVENT: begin
                                  MessageBoxA(0, 'Prog exited :/', 'Error', MB_ICONERROR);
                                  CloseHandle(hFile);
                                  ExitProcess(0);
                                end;
    end;
		ContinueDebugEvent(dbevent.dwProcessId,dbevent.dwThreadId,dwStat);
  end;
I've also tried to write $CC to EP and run until debug exception, but it doesnt break ir just runs. Like i wrote int3 to wrong process. But i didnt miss the handles for sure...
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Need help about IDA plugin writing softworm General Discussion 1 01-09-2006 08:55
[Q]:writing vBulletin via MacOSX smo General Discussion 4 09-06-2004 22:28
writing my own OS.....where to start from?? loman General Discussion 33 06-29-2004 18:09


All times are GMT +8. The time now is 06:50.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )