📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Problem Selecting Newly Created Thread in IDA Plug-in

Topic created on: August 21, 2007 01:03 CDT by voyager1993 .

First of all I must say that I am new to this area and I am sure that for a lot of people my questions will look too naive. I apologize for that.
In IDA plug-in I am getting an event notification that new thread started but for some reason I can't select it for debugging. Actually the real problem could be that �suspend_process� is not getting fully executed.
I am calling "suspend_process" before calling "select_thread" and although I am not getting any errors returned from either of the calls I think "suspend_process" is not getting properly executed.
The reasons for this are the following:
1. I am not getting "dbg_suspend_process" event.
2. The execution of the process stops and can't be resumed by "continue_process" call.
3. If I don't put "continue_process" at the end I can resume execution manualy from "Debugger" menu by selecting "Continue Process". If I do have call "continue_process" in my code then manual attempt fails.
4. Even if I do manage to resume the process manually I see that I still debugging the same thread as before, not the new one I am trying to select.

Greatly appreciate everybody's help

  jms     August 21, 2007 11:12.56 CDT
Hmmm...so you are writing this plugin in C/C++ right? I mean, IDA is great for a lot of things, but it's not so great for debugging. I would take a look at ImmDBG

http://debugger.immunityinc.com/

(or Olly but ImmDBG has a Python interface) or you can most definitely use PyDBG/PaiMei to handle it.

  voyager1993   August 21, 2007 14:59.13 CDT
I have to use IDA Pro.
And one more thing - calling "suspend_process" in the plug-in does not generate dbg_suspend_process event.

  cyberax   April 28, 2008 03:35.31 CDT
I have the same problem using the IDApython plugin.
get_process_state() still returns DSTATE_RUN, even
after calling the suspend_process() procedure. Really
don't understand what happens.

Help would be appreciated. Thanks a lot.

  nezumi     April 28, 2008 04:41.23 CDT
maybe, coz it's an asynchronous function. did you call it in the way described in dbg.hpp? show me your code.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit