Exetools  

Go Back   Exetools > General > Community Tools

Notices

Reply
 
Thread Tools Display Modes
  #16  
Old 05-12-2013, 02:10
Zer0Flag Zer0Flag is offline
Friend
 
Join Date: Oct 2010
Posts: 22
Rept. Given: 3
Rept. Rcvd 31 Times in 13 Posts
Thanks Given: 0
Thanks Rcvd at 8 Times in 8 Posts
Zer0Flag Reputation: 31
Hmm, could you send me this (chinese) fila via PM so I can take a look at it myself ?
Reply With Quote
  #17  
Old 06-09-2013, 07:29
Zer0Flag Zer0Flag is offline
Friend
 
Join Date: Oct 2010
Posts: 22
Rept. Given: 3
Rept. Rcvd 31 Times in 13 Posts
Thanks Given: 0
Thanks Rcvd at 8 Times in 8 Posts
Zer0Flag Reputation: 31
Code:
Version 0.1 beta 12

    fixed scrollbar in trace view
    fixed a possible crash in disassembler
    fixed a memory leak in the window settings
    fixed a memory leak in dll and process name receiving
    fixed a memory leak in trace view
    fixed display of ascii strings in ascii view
    fixed a bug which could cause wrong run to user code if debugging more than one process
    fixed a bug which lead to incorrect restarts on slow systems
    fixed a bug which caused double calling of some functions in context menus
    fixed a bug in hex view which may showed wrong data
    fixed a bug in heap view which caused a crash when copying the whole line to clipboard
    added PatchManager
    added process privilege view
    added commandline options
    added possibility to set process priorities
    added possibility to set memory protection
    added display of current priority in detail view - context menu
    added display of segment registers in reg view
    added background worker to string view, hex view and functions view
    removed processes we cant access from the attach dialog

Notes:

- Patches can be saved to file (only on the debugged one)
- In the memory view you can set the protection of a page using the context menu
- Commandline options
    - "-s": specifies a file
    - "-c": specifies the commandline for the target if not given you will be asked later
    - "-p": attachs to the given pid
If you find some bug, have some feature requests or something else please feel free to write me a pm!

Regards Zer0Flag
Reply With Quote
The Following 2 Users Gave Reputation+1 to Zer0Flag For This Useful Post:
Insid3Code (06-09-2013), uranus64 (06-10-2013)
  #18  
Old 06-10-2013, 02:42
Archer's Avatar
Archer Archer is offline
retired
 
Join Date: Aug 2005
Posts: 224
Rept. Given: 1
Rept. Rcvd 30 Times in 18 Posts
Thanks Given: 2
Thanks Rcvd at 343 Times in 49 Posts
Archer Reputation: 30
Some guys from exelab https://ssl.exelab.ru/f/index.php?action=vthread&forum=3&topic=20678#9 suspect EDI register is missing.
Reply With Quote
  #19  
Old 06-10-2013, 03:02
Zer0Flag Zer0Flag is offline
Friend
 
Join Date: Oct 2010
Posts: 22
Rept. Given: 3
Rept. Rcvd 31 Times in 13 Posts
Thanks Given: 0
Thanks Rcvd at 8 Times in 8 Posts
Zer0Flag Reputation: 31
uch, Seems I forgot that one :-/ . Thanks for reporting! Will be fixed in the next version.

Regards
Zer0Flag
Reply With Quote
  #20  
Old 07-11-2013, 03:27
Zer0Flag Zer0Flag is offline
Friend
 
Join Date: Oct 2010
Posts: 22
Rept. Given: 3
Rept. Rcvd 31 Times in 13 Posts
Thanks Given: 0
Thanks Rcvd at 8 Times in 8 Posts
Zer0Flag Reputation: 31
Code:
Version 0.1 beta 13

    fixed some crashs related to the qt /MT build, see note for more details
    fixed some bugs in the patch manager
    fixed the symbol display in the trace view
    fixed a bug which showed wrong trace data
    added Exception Assistant
    added colors to the state bar
    added missing edi/rdi register
    added option to break on tls callback
    added possibility to show registers of a thread in detailview
    added possibility to show TEB/TBI of a thread in detailview
    added possibility to show PEB/PBI of a process in detailview
    added possibility to set Nanomite as default just in time debugger
    added possibility in PEEditor to show exports of a loaded module in disassembler
    added updater (thanks to inisider for this contribution)
    updated beaengine to rev. 174
    updated PE-Editor layout
    updated DetailView layout
    updated Options to include more options, easier config

Notes:

- Needed to compile Qt with /MD because of issues with the cruntime. If you want to use the
  debugger you have to install the visual c++ runtime 2010. 
- You can save an exception to the list in the Options window. The debugger then knows how to handle it.
  Alternatively you can enable the Exception Assistant. This will show a dialog once a exception occures and
  offers different ways to handle it.
Reply With Quote
  #21  
Old 07-11-2013, 15:58
cxj98
 
Posts: n/a
very good, now can debug chinese softwares.
Reply With Quote
  #22  
Old 07-12-2013, 04:46
bedrock's Avatar
bedrock bedrock is offline
Friend
 
Join Date: May 2002
Posts: 91
Rept. Given: 8
Rept. Rcvd 5 Times in 2 Posts
Thanks Given: 4
Thanks Rcvd at 1 Time in 1 Post
bedrock Reputation: 5
Is there install available or have to download source from git and compile ourself?
Reply With Quote
  #23  
Old 07-12-2013, 12:41
deepzero's Avatar
deepzero deepzero is offline
VIP
 
Join Date: Mar 2010
Location: Europe
Posts: 218
Rept. Given: 99
Rept. Rcvd 60 Times in 38 Posts
Thanks Given: 83
Thanks Rcvd at 95 Times in 50 Posts
deepzero Reputation: 60
there are binaries available in the debug\ and release\ folder on github.
Reply With Quote
The Following User Gave Reputation+1 to deepzero For This Useful Post:
bedrock (07-18-2013)
  #24  
Old 07-12-2013, 12:41
Zer0Flag Zer0Flag is offline
Friend
 
Join Date: Oct 2010
Posts: 22
Rept. Given: 3
Rept. Rcvd 31 Times in 13 Posts
Thanks Given: 0
Thanks Rcvd at 8 Times in 8 Posts
Zer0Flag Reputation: 31
You can use the files from "build" or build it yourself if you like.

Regards Zer0Flag
Reply With Quote
The Following User Gave Reputation+1 to Zer0Flag For This Useful Post:
bedrock (07-18-2013)
  #25  
Old 08-07-2013, 08:52
shahril
 
Posts: n/a
hi Zer0Flag, thanks for great release.
I test it with some binary, however, some of them are ok, and some of them have problem and nanomite window show blank, here is screenshot

http://i.imgur.com/u5t9WHc.png

and here is binary -> http://www.uploadmb.com/dw.php?id=1375836485

virus total -> https://www.virustotal.com/en/file/be051b6498077ee0fbeca54417b41a98493ebde86b4f33754dc1512817025ab3/analysis/1375836673/

this binary is from lina151 rce toturial

and why i can't upload file into attachment ?
Reply With Quote
  #26  
Old 08-08-2013, 00:18
nikkapedd nikkapedd is offline
VIP
 
Join Date: Mar 2011
Location: Somewhere In Europe
Posts: 218
Rept. Given: 275
Rept. Rcvd 148 Times in 63 Posts
Thanks Given: 157
Thanks Rcvd at 182 Times in 81 Posts
nikkapedd Reputation: 100-199 nikkapedd Reputation: 100-199
Quote:
and why i can't upload file into attachment ?
shahril you are a new member and you can't download/upload anything until you reach 20/25 posts. Read the rules for the new members
Reply With Quote
  #27  
Old 08-08-2013, 03:11
Zer0Flag Zer0Flag is offline
Friend
 
Join Date: Oct 2010
Posts: 22
Rept. Given: 3
Rept. Rcvd 31 Times in 13 Posts
Thanks Given: 0
Thanks Rcvd at 8 Times in 8 Posts
Zer0Flag Reputation: 31
Thanks for the feed back!

@shahril
This is a known issue which is based on the disassembler. Sometimes it starts disassembling on the wrong offset ( neededoffset - 300 ) which is not always right. And then it doesn´t find the needed offset and stay empty.

The disassembler will probably be reworked on the beta15.

~Zer0Flag
Reply With Quote
  #28  
Old 08-08-2013, 05:59
mm10121991 mm10121991 is offline
VIP
 
Join Date: Feb 2011
Posts: 136
Rept. Given: 29
Rept. Rcvd 56 Times in 34 Posts
Thanks Given: 6
Thanks Rcvd at 21 Times in 13 Posts
mm10121991 Reputation: 58
@sharil
all binairies in lena151 tuts are 32 bits
Work with ollydbg
Reply With Quote
  #29  
Old 08-09-2013, 03:25
Zer0Flag Zer0Flag is offline
Friend
 
Join Date: Oct 2010
Posts: 22
Rept. Given: 3
Rept. Rcvd 31 Times in 13 Posts
Thanks Given: 0
Thanks Rcvd at 8 Times in 8 Posts
Zer0Flag Reputation: 31
I did a little update of the disassembler engine and it fixed the problem which lead to the missing disassembly in this and some other cases.

Will be release with B14 on this Sunday (11.08.2013)

http://i.imagebanana.com/img/nu9h6ohd/08082013193602.png

~Zer0Flag
Reply With Quote
The Following User Gave Reputation+1 to Zer0Flag For This Useful Post:
  #30  
Old 08-11-2013, 09:27
Zer0Flag Zer0Flag is offline
Friend
 
Join Date: Oct 2010
Posts: 22
Rept. Given: 3
Rept. Rcvd 31 Times in 13 Posts
Thanks Given: 0
Thanks Rcvd at 8 Times in 8 Posts
Zer0Flag Reputation: 31
Code:
beta 14
+ fixed a bug in the options not showing exception wich have been saved using the exception assistant
+ fixed a bug when stepping over a return
+ fixed a bug in breakpoint manager which deleted the wrong bp when removing a selected bp
+ fixed a bug in breakpoint manager which created unusable breakpoints
+ fixed a bug in breakpoint manager which may resolved ModuleName::APIName to wrong offset
+ fixed a bug in assembler which double loaded the gui
+ fixed a bug in hardware breakpoints which did not activate them in running processes
+ fixed a bug in hardware breakpoints which did not activate them on the current thread
+ fixed a bug where by detaching from a suspended process didn't resume the process
+ fixed a bug which did not handle hardware breakpoints for wow64 targets
+ fixed a bug which showed a wrong menu if child processes where present in the debugging session
+ fixed a bug which reloaded the disassembler to the wrong offset after adding a new patch
+ fixed a bug which caused wrong scrolling of disassembler and stack while the process is running
+ fixed paths in attach dialog with SystemRoot enviroment string
+ fixed handling of "call * ptr []" and "jmp * ptr []"
+ fixed some handle and memory leaks
+ added saving of input in goto dialog
+ added support of functions in goto dialog
+ added different hotkeys see hotkey list for all of them
+ added type column in attach dialog
+ added state update when doing a trace
+ added trace to selected disassembly line
+ added toggle breakpoint on selected disassembly line to context menu
+ added display of FPU, MMX and SSE register
+ updated to qt 4.8.5
+ updated nasm to 2.10.09
+ updated file open dialog to remove annoying messagebox for commandline
+ updated the internal pe handling
+ updated resize event of Disassembler and Stack
+ updated Stack scroll
+ updated PID dropdown to be only displayed if more then 1 process is running
+ updated disassembler logic

####Notes:
    - function in the goto dialog should look like this: "module::function"
      e.g KERNEL32::IsDebuggerPresent
~Zer0Flag
Reply With Quote
The Following 3 Users Gave Reputation+1 to Zer0Flag For This Useful Post:
mm10121991 (08-15-2013), nikre (08-11-2013), sendersu (08-11-2013)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Where are the Class methods? 5Alive General Discussion 0 07-28-2005 03:22
Calling function from a class AdamD General Discussion 0 02-17-2005 22:59


All times are GMT +8. The time now is 21:25.


��ICP��05004977��
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX