📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  SEH and DLL tracing.

Topic created on: April 5, 2009 19:04 CDT by methodman .

I'm new to the reverse engineering community, so this may be a simple question, but I am not sure how to go about doing this:

I have an EXE that loads a number of DLL's, and in the EXE and the DLL's it loads, there are a number of SEH overwrites taking place.  I've found tutorials on dealing with SEH overwrites and DLL's (Korupt's blog and Ollydbg tutorial), but I don't know how to deal with an EXE that seems to install custom SEH handlers in numerous places.

All I am looking to do is trigger an INT3 in one particular DLL so I can single step the binary to see what it does (which I can do but its being caught by the application's custom handler).  I can't do that, however, since there are multiple SEH overwrites in numerous places and I don't know where or how I would hook in to install the default handler.

This may be a simple question, but I'm not having much luck figuring how to address this. Any help is most appreciated, thank you in advance.

  neoxfx     April 6, 2009 02:23.27 CDT
use a breakpoint on LoadLibrary and run until the dll of interest gets called, once it gets loaded, place a hardware breakpoint on the address of interest (the place where you wanted to put int3) and proceed, makes sense?

  methodman     April 6, 2009 20:32.38 CDT
Thanks for the reply, neoxfx --

Good idea -- I wasn't thinking about how I could keep track of what DLL got loaded in what order, LoadLibrary should do the trick.

If I have any issues I will post back, thanks again,

MM

  apollo   April 7, 2009 06:57.47 CDT
ntsd has a neat little command where you can enable and disable events. sxe ld will enable the breakpoint on module load. For a complete list just type 'sx'.

  methodman     April 7, 2009 22:30.37 CDT
> neoxfx: use a breakpoint on LoadLibrary and run until the dll of interest gets called, once it gets loaded, place a hardware breakpoint on the address of interest (the place where you wanted to put int3) and proceed, makes sense?

Guys;

Thanks for the help and tips - I was able to accomplish what I wanted with your input, so thanks for taking the time to answer a newbie question.

-MM

  deLight     April 26, 2009 11:10.11 CDT
> neoxfx: use a breakpoint on LoadLibrary ...
bp on LdrLoadDll is better

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit