I wrote my own debugger using mainly CreateProcess
and accessing the DEBUG_EVENT
structure accordingly to load the DLLs, exceptions, threads etc setting the breakpoints (from the source code)
So far, the debugger is ok. When I set a breakpoint on a .EXE file, and also when I debug a DLL calling the host as the target for the process (similar of what IDAPro does) everything works well.
For example: the DLL contains an export called "random" with a pseudo-code like:
DLL Name: RND.dll
:
Proc random::
mov eax 1 ; (return 1) <---- I set a breakpoint here on the dll.
EndP
The problem is with a DLL being called from LoadLibrary
.
For example:
Case 1)
the debugger is Ok:
The host (EXE) has this pseudo code.
EXE name: test.exe
Main:
call 'RND.Random' ; On a regular call to IAT the debug stops nicelly, since RND dll is part of the IAT table on the executable.
call 'KERNEL32.FreeLibrary' D$hLib
call 'Kernel32.ExitProcess' 0
So, when loading RND.dll
and activating the debugger, an OpenDialog
is opened telling the user to choose the Host (EXE) to load it. In this case test.exe
.
So, when opening the DLL where I set a breakpoint on a "Random" export function, the debugger does correctly stop at the execution on the DLL.
But.....if my host contains the LoadLibrary
, the breakpoint on the debugger is not being activated.
Like this:
Case 2)
Not working.
The EXE (host) now has this pseudo-code.
For example: test2.exe
Main:
call 'KERNEL32.LoadLibraryA' {'RND.DLL',0} | mov D$hLib eax
call 'kernel32.GetProcAddress' eax, { B$ "Random", 0}
call eax
call 'KERNEL32.FreeLibrary' D$hLib
call 'Kernel32.ExitProcess' 0
And when I open the DLL and set the breakpoint at a "random" function, the debugger is not working, since the exported function is not part of the IAT of the host.
How to attach the DLL to the host in a way that the debugger can "see" the breakpoint on the DLL function that is being called indirectly?
I tried to inject the DLL into the process, but without success.
The main function that creates the process has these settings:
call 'KERNEL32.CreateProcessA' DebuggeeExe,
CommandLineString, &NULL, &NULL, &FALSE,
&CREATE_DEFAULT_ERROR_MODE+&NORMAL_PRIORITY_CLASS+&DEBUG_PROCESS+&DEBUG_ONLY_THIS_PROCESS,
&NULL, DebuggeePath, STARTUPINFO, PROCESS_INFORMATION
How to fix that?
On IDAPro, it has the same functionality. I mean that I can open a DLL, set a breakpoint on an address and debug it.
But in this case, a dialog opens telling me to choose the host (EXE).
IDAPro works fine in both cases.
- When the host (EXE) have a direct call to the DLL, meaning it is part of the IAT
- When the host have an indirect call to the DLL that is accessed through
LoadLibrary
.
My debugger is only being able to do the first case above.
How can this be fixed?
Note: I´m used to code in assembly and this part of the code is from my assembler called RosAsm
which I´m developing. But I´m unable to make the debugger works on those cases.
If someone can provide an example of such functionality in C using WinAPI, it would be appreciated. (Not in C++ or .Net, please, because I can read C, but I couldn´t be able to reproduce it using .Net or C++, since I can´t read it)
Many thank, in advance.
int 3
, are you doing something different? – Harry Johnston Mar 6 '17 at 23:50