📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Breakpoint Not Hitting.. (Share- a P2P Application)

Topic created on: August 16, 2007 04:50 CDT by jaffersathik2010 .

Hi there,

I put a breakpoint at the below mentioned instruction.

   JMP ds:recv
and executed it. When I pass the traffic to this the recv() function, it is not hitting the breakpoint.

where am I wrong?. If you need more details, let me know.

Thanks in advance.

--Jaffer

  jaffersathik2010     August 16, 2007 04:52.42 CDT
Hi Guys,

I want to add a point here. The breakpoint was a hardware breakpoint. Was that the problem?. I can't go for software breakpoint because it gives CRC error.

Thanks,
Jaffer.

  Soul12     August 16, 2007 06:26.56 CDT
are you sure the function gets executed ? try to remove the CRC and add a EBFE bp instead or something

  jaffersathik2010     August 16, 2007 07:35.46 CDT
Hi Soul12,

Thanks for your reply.

The instruction 'JMP ds:recv' was there in the application for nothing but just fool me. Actually that instruction did not point to the correct address of the recv fucntion.

Later, I found that some other instruction 'call 145629' which was originally calling the recv function.

By the way, What do you mean by 'EBFE bp'?

--Jaffer.

  jms     August 16, 2007 11:20.21 CDT
What I would try is doing a CTRL+G in ImmuDBG and enter:

recv (F2 to set bp)
ws2_32.wsarecv (F2)
wsock32.recv (F2)

Then run it, you should hit the BP. Google up the EBFE breakpoint idea, from what I understand people use the JMP instruction as a way to redirect to a handler, instead of using the recognizable 0xCC byte.

  RolfRolles     August 16, 2007 14:35.13 CDT
The two-byte short unconditional jump instruction (EBXX) jumps to the current address + 2 (the size of the jump instruction) + (signed byte) XX.  EB00 = 2-byte NOP, EBFE = jump backwards -2 + 2 bytes, i.e. to the EBFE instruction, an infinite loop.  

This idea is used in loaders, and also by people manually unpacking binaries with a kernel debugger.  In the former case, you set an EBFE somewhere, monitor EIP, and wait for it to fall into the EBFE infinite loop.  In the latter case, you set an EBFE at the program's OEP once you've reached it, take note of the original two bytes, exit the debugger, dump the process, and restore the bytes.  This keeps the program from executing and trashing its data section.

Of course, the former case will still result in CRC check failures, as will any modification to the code (unless you're using something like Tron).

  jms     August 16, 2007 19:35.50 CDT
Thanks for fixing that posting, I was totally wrong. jms == newb.

  RolfRolles     August 16, 2007 19:57.06 CDT
Incidentally, check out the name of the last section in the unpacked executable included with my HyperUnpackMe2 solution :-)

Anyway, to respond to the specific problem here:  if you're going to use software breakpoints, put them somewhere where the application isn't going to look for them, such as at the end of an API function.  Otherwise, use hardware breakpoints inside of the checksummed region.  Be aware of anti-hardware breakpoint techniques.

  Soul12     August 17, 2007 03:15.48 CDT
indeed hardware bp's would be the bedst sollution in this case .. but doesent help much if you aint putting it the correct place :) as was the case here

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit