Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   IDA debugging sub processes (https://forum.exetools.com/showthread.php?t=4100)

Bram Kate 04-25-2004 15:00

IDA debugging sub processes
 
Is it possible to load a sub processes symbols. I want to debug an application which spawns command line applications by CreateProcess system call. I want to break at certain functions on the sub process. Any advice/pointers to resources will be helpful.

Thanks

redbull 04-28-2004 21:31

The easiest way I can think of is
1. Run a Standard API spy utility...
2. Capture the parameters of the CreateProcess API call (eg exename and command line paramters)
3. Manually run that command line EXE with the command line paramters in your debugger and debug that application seperately.

Alternatively you can wait for the spawned application to run and then sue the "Attach to process" feature in Ollydebug
This attaches the debugger to a currently active process in memory. Here you can view the command line paramters and debug as normal.

Im sure IDA natively supports debugging a spawned process and will be interested to find out how.

Bram Kate 05-03-2004 18:28

Thanks for your suggestions. Actually a lot of applications are spawned from the main application. And the arguments seems to change on every invokation. This precludes me from replicating the actual environment reliably. I wanted the full featured dissamble feature of IDA while debugging. As I am relaively new to RE, any pointers to use IDA symbols while debugging will be useful.


All times are GMT +8. The time now is 11:17.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2022, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX