OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Sunday, April 8 2007 12:28.10 CDT

Printer Friendly ...

Experiences with the debugger

Author: dhruvakm

# Views: 1507

It has been a while since I felt really challenged in the debugging area. Well, not that I am a geek or an expert in the finer art of programming or debugging, I was just confident enough as I had not encountered a situation where I was not in control.
I recently had to find a performance hole in one of our products which partly runs in a 3rd party process. So, I am at a disadvantage in not having the source code, debug symbols and the executable! I just have a process dump taken when the system was experiencing unexpected high CPU usage.
DebugDiag came to my rescue, I was able to identify the threads that were consuming higher CPU usage. Armed with the call stack of limited depth, I could not make further progress. I was aware of the capabilities of WINDBG, I decided to analyze the process dump using WINDBG but found myself lost in the maze of cryptic commands and their most unfriendly syntax.
I had just started toying around with OllyDbg. I kept my fingers crossed and hoping it would help me analyze the dump file, opend the process dump file. I was not lucky enough and could not use OllyDbg to analyze a dump file (Is there a method using OllyDbg to analyze a dump file I am not aware of?).
I am not back to learning WINDBG as I know I will need it till I find a tool as flexible and convinient as OllyDbg with support to analyze windows process dump files.
I have had a decent experience in debugging applications and dump files on UNIX using the truly great GDB (GNU) which has the tab completion feature. That is one single feature with which I have convinced a whole lot of developers to start using command line debugger rather that limiting themselves to the GUI based interface. I hope GDB will one day have WINDBG/CDB as a backend with the GDB front end. I do not have to unlearn the few things I have learnt in GDB and can put the same to use.
A question to the gurus, is a windows dump close enough to a UNIX core file? Does GDB on windows handle windows dumps or is there a work around to make GDB understand the windows dump format?
If I do get answers, I will post them here...

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit