Log in

View Full Version : Alright, what is DbgBreakPoint()?

qwerty
July 19th, 2006, 11:53
So I run calc.exe and attach to thise process with OllyDBG.

When I do, I find myself in ntdll's DbgBreakPoint() at a RETN instruction.

Continuing, I find myself still in ntdll at a JUMP Short. Then there's an or instruction, a push instruction, and a call to RtlExitUserThread(). Game over, wtf?

The most detail I could find about DbgBreakPoint() is "This routine raises an exception that is handled by the kernel debugger if one is installed; otherwise it is handled by the debug system. If no debugger is connected to the system, the exception can be handled in the standard way."

I've read and understand all the basic debugging concepts out there, but I'm having a hard time finding hard tech details about how debug registers and interrupts are used when:

1) attaching to a process
2) running the process from the debugger
3) user mode vs. kernel mode debugging
4) DbgBreakPoint()

Any advice appreciated, thanks!
JMI
July 19th, 2006, 12:14
So broaden your search criteria and try the following:

DbgBreakPoint() microsoft

DbgBreakPoint attach to process

debug registers and interrupts attach to process

debug registers and interrupts running the process from the debugger

debug registers and interrupts user mode vs. kernel mode debugging

debug registers and interrupts DbgBreakPoint()

There certainly appear to be some "hard technical detail" among the many hits each of those search criteria produce.

You might also find something useful in this Thread HERE:

http://www.woodmann.com/forum/showthread.php?p=40349#.

And, of course, there are several debugging books available on the web.

Regards,
naides
July 19th, 2006, 12:22
Disclaimer: I do not have the foggiest idea what is going on, but

I reproduced what you say in my system: The problem occurs when you ATTACH calc.exe, notepad.exe, wordpad.exe . . . if you OPEN the process with olly, things go smooth.

The calc.exe (or notepad.exe, worrpad.exe) process continues to be present in memory, but its thread is suspended.

This does not happen in regular apps that load at RVA 400000 All these accessory progs share the feature of loading at the 10000000 memory block.

??
blabberer
July 19th, 2006, 13:56
start -> run -> calc.exe
cd "ollydbg path" ollydbg.exe
file attach calc.exe
f9

seems to work without problems here
Code:


Call stack of main thread

Address    Stack      Procedure / arguments                 Called from                   Frame

0007FDE0   77D491BE   Includes ntdll.KiFastSystemCallRet    USER32.77D491BC               0007FDFC

0007FDE4   77D491F1   USER32.77D491B2                       USER32.77D491EC               0007FDFC

0007FE00   010021B0   Includes USER32.77D491F1              calc.010021AE                 0007FDFC

0007FF20   010125E9   calc.01001F51                         calc.010125E4                 0007FF1C
deroko
July 19th, 2006, 15:53
Quote:
[Originally Posted by naides]
I reproduced what you say in my system: The problem occurs when you ATTACH calc.exe, notepad.exe, wordpad.exe . . . if you OPEN the process with olly, things go smooth.


isn't problem, 1st break in debugged process is DbgBreakPoint, to cehck this you may go to "Options -> Event -> System Break" in olly, run app and you will break at DbgBreakPoint when you open process in olly
naides
July 19th, 2006, 16:11
OK. All attached processes pause at DbgBreakPoint in NtDll. . .
that is not the issue.

But all other attached applications (Hiew.exe for instance) will continue to run, seamlessly, if you press F9.
Calc, notepad and Worpad hang, remain suspended even after go push run(F9), or trace until exit process .

That is what I find unusual.
goggles99
July 19th, 2006, 17:07
That does not happen for me (tried several times)
I have occasionally seen this happen when attaching to newer high memory/CPU intensive FPS games.

Can you resume the calc thread in the threads window? (I don't believe I was able to when this has happened to me)

Perhaps just an Olly bug? Interesting that it is consistent for you. Try renaming your plugins folder so that none are loaded. I find most problems with Olly come from Plug-Ins that I have loaded.
naides
July 19th, 2006, 17:24
Add On:

I am at my home computer right now, A differerent CPU (AMD64) different OS, and the described problem does not happen when I try to attach the processes. The calc.exe and other Accessories do run fine after attachment.

So, I dunno.
SiGiNT
July 20th, 2006, 01:32
uh huh, but if you pause the program and step thru the code - what is occuring is an invalid address is loaded into EDX at 77D491B7 in user32.dll - game over when that illegal address is read a line or 2 later.

SiGiNT
LLXX
July 20th, 2006, 02:59
Quote:
[Originally Posted by blabberer]start -> run -> calc.exe
cd "ollydbg path" ollydbg.exe
file attach calc.exe
...and then OllyDbg just hangs after attaching, on my system. I have to kill it from the taskmgr.

Windows XP 5.1.2600
OllyDbg 1.10
Intel Pentium IV HT 4.17GHz
Ricardo Narvaja
July 20th, 2006, 03:41
When you attach with ollydbg you need use a new opened ollydbg (fresh), not a olly used in other session of debugging and restarted, i donīt know why,but with an used ollydbg there are random problems while attaching a program.
There are antiattack code too you can check the tool POKEMON, for quit the antiattach protections.
Ricardo Narvaja
blabberer
July 20th, 2006, 04:09
i dont know why i cant get all these nifty problems to poke around i tried on a different computer xp-sp2 and it runs as if it never had any problems in its life

Code:




New session

          File 'C:\WINDOWS\System32\calc.exe'

          New process with ID 000005E0 created

          Main thread with ID 00000730 created

77F97077  New thread with ID 0000039C created

01000000  Module C:\WINDOWS\System32\calc.exe

5AD70000  Module C:\WINDOWS\System32\UxTheme.dll

71950000  Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

772D0000  Module C:\WINDOWS\system32\SHLWAPI.dll

773D0000  Module C:\WINDOWS\system32\SHELL32.dll

77C10000  Module C:\WINDOWS\system32\msvcrt.dll

77C70000  Module C:\WINDOWS\system32\GDI32.dll

77CC0000  Module C:\WINDOWS\system32\RPCRT4.dll

77D40000  Module C:\WINDOWS\system32\USER32.dll

77DD0000  Module C:\WINDOWS\system32\ADVAPI32.dll

77E60000  Module C:\WINDOWS\system32\kernel32.dll

77F50000  Module C:\WINDOWS\System32\ntdll.dll

77F7F570  Attached process paused at ntdll.DbgBreakPoint

          Thread 0000039C terminated, exit code 0

          Analysing calc

            158 heuristical procedures

            273 calls to known, 167 calls to guessed functions

            91 loops, 22 switches

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = MENU/BN_CLICKED... ID = 127.

            hControl = 002501EE ('3',class='Button',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

77E802F4  New thread with ID 000004A0 created

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_SETFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_KILLFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = MENU/BN_CLICKED... ID = 92.

            hControl = 002601BA ('+',class='Button',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_SETFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_KILLFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = MENU/BN_CLICKED... ID = 127.

            hControl = 002501EE ('3',class='Button',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_SETFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_KILLFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = MENU/BN_CLICKED... ID = 112.

            hControl = 003901AE ('=',class='Button',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_SETFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_KILLFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = MENU/BN_CLICKED... ID = 81.

            hControl = 001E0182 ('C',class='Button',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_SETFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = BN_PAINT/LBN_SELCHANGE/CBN_SELCHANGE/ACCELERATOR... ID = 129.

            hControl = NULL

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = BN_PAINT/LBN_SELCHANGE/CBN_SELCHANGE/ACCELERATOR... ID = 92.

            hControl = NULL

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = BN_PAINT/LBN_SELCHANGE/CBN_SELCHANGE/ACCELERATOR... ID = 130.

            hControl = NULL

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = BN_PAINT/LBN_SELCHANGE/CBN_SELCHANGE/ACCELERATOR... ID = 112.

            hControl = NULL

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_UPDATE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_CHANGE... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

01006118  CALL to Assumed WinProc from USER32.77D43A5C

            hWnd = 0012026C ('Calculator',class='SciCalc')

            Message = WM_COMMAND

            Notify = EN_KILLFOCUS... ID = 403.

            hControl = 00300250 (class='Edit',parent=0012026C)

          Thread 000004A0 terminated, exit code 2A (42.)

          Process terminated, exit code 0

01000000  Unload C:\WINDOWS\System32\calc.exe

5AD70000  Unload C:\WINDOWS\System32\UxTheme.dll

71950000  Unload C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll

772D0000  Unload C:\WINDOWS\system32\SHLWAPI.dll

773D0000  Unload C:\WINDOWS\system32\SHELL32.dll

77C10000  Unload C:\WINDOWS\system32\msvcrt.dll

77C70000  Unload C:\WINDOWS\system32\GDI32.dll

77CC0000  Unload C:\WINDOWS\system32\RPCRT4.dll

77D40000  Unload C:\WINDOWS\system32\USER32.dll

77DD0000  Unload C:\WINDOWS\system32\ADVAPI32.dll

77E60000  Unload C:\WINDOWS\system32\kernel32.dll

77F50000  Unload C:\WINDOWS\System32\ntdll.dll

End of session
SiGiNT
July 20th, 2006, 09:14
I suspect, (just a gut feeling), that a recent M$ XP patch may be dicking around with olly, I've noticed during the past 2-4 wks. all of a sudden every time I try to use run trace every target I've tried it on terminates, I'll have to dig out an old target where Im sure it works and see what happens.

SiGiNT
LLXX
July 20th, 2006, 15:06
Quote:
[Originally Posted by Ricardo Narvaja]When you attach with ollydbg you need use a new opened ollydbg (fresh), not a olly used in other session of debugging and restarted, i donīt know why,but with an used ollydbg there are random problems while attaching a program.
There are antiattack code too you can check the tool POKEMON, for quit the antiattach protections.
Ricardo Narvaja
Yes, fresh olly. I did the test above immediately after rebooting the system.
Ricardo Narvaja
July 20th, 2006, 16:39
try pokemon anti-attach. Before attach, open pokemon, search for the process to attach and clean protections anti-attach

http://storage.ricardonarvaja.com.ar/web/OTROS/HERRAMIENTAS/L-M-N-O-P/POKEMON%20AntiAttach.exe

Ricardo Narvaja
qwerty
July 25th, 2006, 13:10
Quote:
[Originally Posted by Ricardo Narvaja]try pokemon anti-attach. Before attach, open pokemon, search for the process to attach and clean protections anti-attach

http://storage.ricardonarvaja.com.ar/web/OTROS/HERRAMIENTAS/L-M-N-O-P/POKEMON%20AntiAttach.exe

Ricardo Narvaja


Nobody wants to download and run a binary, source available?
JMI
July 25th, 2006, 13:20
You, of course, are free to do as you wish, but if you do not wish to trust Ricardo, you probably are on the wrong site and should go code your own resources.

Regards,
Ricardo Narvaja
July 25th, 2006, 17:10
You or nodody?

talk for you, i download hundred of binaries from here or exetools without problem, and if i want, i run in vmware, but pokemon is a good tool made for a crackslatinos member, and is very good against antiattach protections.

you are free to download or not, i publish for all RCE members not only for you.

Ricardo
JMI
July 25th, 2006, 17:12
It's OK Ricardo. I already slapped him.

Regards,