Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  pydbg, memory breakpoints problem

Topic created on: August 10, 2010 21:19 CDT by yans .

Hi,

I'm using pydbg for one of my projects.
I have many troubles in dealing with memory breakpoints.
It seems that pydbg has problems in remove memory breakpoints.
As a small example, I set a memory bp on kernel32.dll, specifying a custom handler that simply deletes the memory breakpoint and continue the execution of the program. Then I run the program. Thanks to the memory bp, the program is stopped when the execution reaches the kernel32.dll, but when the handler code is executed, the original program frozes, and the debugger doesn't output anything neither raises an exception.

Did anyone have had a similar experience?

thanks in advance,
cheers

  yans   August 11, 2010 12:24.50 CDT
Hi,

I've done a simpler test. Here I will describe this test in order to give you more details.
I have written a test program (test.exe), that simply call the printf function.
The tool I've written by using pydbg does the following things: it loads test.exe; it sets a software breakpoint on the entry point: the handler of this software breakpoint simply sets a memory breakpoint on the msvcrt.dll. The handler of the memory breakpoint simply prints "mem bp hit"
If I try to run the debugger, the program crashes (i.e. the program exits by executing only few instructions and it doesn't print anything).
If I don't use the memory breakpoints and I use only software breakpoints, all works well (also with many soft breakpoints).

I hope that now my problem is clearer.
cheers

  ResearchAviator     September 2, 2010 00:22.37 CDT
If I understand your scenario correctly, the following code works fine for me.

from pydbg.defines import *
from pydbg import *

def membp_handler(dbg):
    print "Inside Memory Breakpoint handler"
    print hex(dbg.exception_address);
    print dbg.disasm(dbg.exception_address)
    dbg.bp_del_mem(0x10073A4);
    return DBG_CONTINUE;

dbg=pydbg();
dbg.set_callback(EXCEPTION_GUARD_PAGE,membp_handler);
dbg.load("C:\\Windows\\Notepad.exe");
dbg.bp_set_mem(0x10073A4,2);
dbg.run()

  yans   October 11, 2010 18:59.40 CDT
ResearchAviator, thanks for your answer and sorry for my big delay in re-answering you.

Some problems raise when you set and unset a memory breakpoint by specifying a 'big size'. With 'big size' I mean a size that is bigger that one single page.

Indeed, I probably found a bug in the source of pydbg.py in the method that removes the memory breakpoints from the internal structure.
I have opened an issue (http://code.google.com/p/paimei/issues/detail?id=13) where I describe the problem (that is still not corrected)

But also after fixing that bug, something still goes wrong. Unfortunately, I'm very busy in this period and I didn't try anymore. If I have some news, I will update you.

Anyway, thanks again.

Note: Registration is required to post to the forums.

There are 28,224 total registered users.


Recently Created Topics
Reverse Engineering ...
Jan/23
Career: DoD Agency I...
Jan/22
"Disappearing&q...
Jan/17
Career: Software Sec...
Jan/11
Where is the call st...
Jan/07
IDA Pro 6.1 Breakpoi...
Jan/01
How to create data s...
Dec/30
can i search all mod...
Dec/23
IDA symbol table exp...
Dec/20
An anti-attach trick
Dec/17


Recent Forum Posts
Reverse Engineering ...
NirIzr
"Disappearing&q...
NirIzr
Reverse Engineering ...
charlie
"Disappearing&q...
charlie
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
An anti-attach trick
waleeda...
An anti-attach trick
Bass
Looking for value in...
NirIzr


Recent Blog Entries
cmathieu
Feb/07
Hacker Carnival

waleedassar
Feb/06
OllyDbg v1.10 And Hardware ...

waleedassar
Jan/31
Yet Another Anti-Debug Trick

RolfRolles
Jan/22
Finding Bugs in VMs with a ...

waleedassar
Jan/13
An OllyDbg Bug Disables Sof...

More ...


Recent Blog Comments
waleedassar on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/07
OllyDbg v1.10 And Hardware ...

NirIzr on:
Feb/05
Yet Another Anti-Debug Trick

trolotou on:
Feb/05
Doudoune Moncler -Pennies F...

waleedassar on:
Feb/01
Yet Another Anti-Debug Trick

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit