#1
|
|||
|
|||
Armadillo 3.76 - tips needed
Hello!
Got some problems with an Armadillo 3.76 target. I successfully detach the child process, attach a new OllyDbg to it and patch the EP bytes from JMP EIP to the original ones. But then I really don't know what to do. Breakpoint on CreateThread gets me nowhere. If I try the old method (setting a mem breakpoint on the code section and running) it breaks somewhere that is NOT OEP. When I don't do anything (just patch in the original bytes and run passing exceptions back to program) the program terminates! I guess it somehow detects it's not attached to the parent process anymore... (?) Can someone please give me some tips? PS Of course I've read the tuts (by ricardo and mephisto), but those are for older versions and doesn't seem to work anymore? |
#2
|
|||
|
|||
is your application coded in vb or delphi?
|
#3
|
|||
|
|||
does it make a difference ?
|
#4
|
|||
|
|||
Humm, I think its vc with mfc
Last edited by Crassy; 09-23-2004 at 20:24. |
#5
|
|||
|
|||
GetProcAddress
use Bp GetProcAddress on midle (after happen some exceptions), it will take a bit delay but you can place your self to oep, count how much api after your soft working, e.g after 50 break your soft running, restart and do same step until 49 ctrl-f9 and follow code ....
|
#6
|
|||
|
|||
here, maybe this can help you:
http://66.98.132.48/fravia/Armadillo_3.xx_tutorial-MEPHiST0.rar |
#7
|
|||
|
|||
xzz: thats actually the issue at question - when the child process is disconnected from the parent (DebugActiveProcessStop) the child process just terminates - it doesnt run as usual.
bEaST: thanks, but the techniques described there dont apply to dildo 3.76. =) |
#8
|
|||
|
|||
Quote:
|
#9
|
|||
|
|||
Crassy,
have you resolved the problem? why i have the same problem! I follow the good Mephisto tutorial at: http://www.absolutelock.de/construction/files/infobase/New/arma_debugblocker/tutorial.html But on CreateThread i have the same problem .. i also tried with break SetProcessWorkingSetSize .. but nope! Write if you have news. Bye |
#10
|
|||
|
|||
Quote:
On a similar target I landed on OEP by setting a memory access breakpoint on text section! Maybe it's the same? |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
IDA SDK C++ tricks and tips | chants | Developer Section | 4 | 08-16-2019 13:16 |
Need some tips on in memory patching of a .Net dll | Sailor_EDA | General Discussion | 4 | 05-30-2011 22:27 |
tips? | NE1 | General Discussion | 3 | 08-27-2002 03:45 |