I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = register } and saved the address in the pseudo register $t0. Later I copied the shellcode with eb @$t0 FC 48 83 E4...[REDACTED]. Then changed the rip value to point to the start address of the shellcode buffer by doing r @$ip=@$t0 and then simply resumed the program execution with g.

The problem is the shellcode gets hung up on the wininet!HttpSendRequestA API call everytime.

The stack trace after manually breaking from the execution:

00 000000e0f0efea28 00007ffc24811e93 ntdll!NtWaitForSingleObject+0x14
01 000000e0f0efea30 00007ffc11ba4f64 KERNELBASE!WaitForSingleObjectEx+0x93
02 000000e0f0efead0 00007ffc11b9fba7 wininet!CPendingSyncCall::HandlePendingSync_AppHangIsAppBugForCallingWinInetSyncOnUIThread+0xe0
03 000000e0f0efeb00 00007ffc11b47af6 wininet!INTERNET_HANDLE_OBJECT::HandlePendingSync+0x33
04 000000e0f0efeb30 00007ffc11b023a5 wininet!HttpWrapSendRequest+0x9a256
05 000000e0f0efecd0 00007ffc11b02318 wininet!InternalHttpSendRequestA+0x5d
06 000000e0f0efed40 000002a7d873018c wininet!HttpSendRequestA+0x58
07 000000e0f0efede0 000002a7d87301f9 0x000002a7d873018c
08 000000e0f0efede8 000002a7d873000a 0x000002a7d87301f9
09 000000e0f0efedf0 0000000000cc000c 0x000002a7d873000a

NOTE: The weird part is the shellcode actually works as it supposed to whenever I debug it in the windbg plugin in IDA PRO 7.5 (I do everything exactly the same in the plugin console as I did in the windbg binary console).

As for the shellcode it's a simple off-the-shelf cobaltstrike http beacon (The same error occurs with any type of reverse shell shellcodes).

It traverses InMemoryOrderModuleList structure from PEB, resolves the api names from hashes and simply executes them in order.

I've never debugged a cobaltstrike beacon directly in windbg before.

NOTE: I don't get any hangs or errors whenever I try to debug a simply x64 calculator shellcode

I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = register } and saved the address in the pseudo register $t0. Later I copied the shellcode with eb @$t0 FC 48 83 E4...[REDACTED]. Then changed the rip value to point to the start address of the shellcode buffer by doing r @$ip=@$t0 and then simply resumed the program execution with g.

The problem is the shellcode gets hung up on the wininet!HttpSendRequestA API call everytime.

The stack trace after manually breaking from the execution:

00 000000e0f0efea28 00007ffc24811e93 ntdll!NtWaitForSingleObject+0x14
01 000000e0f0efea30 00007ffc11ba4f64 KERNELBASE!WaitForSingleObjectEx+0x93
02 000000e0f0efead0 00007ffc11b9fba7 wininet!CPendingSyncCall::HandlePendingSync_AppHangIsAppBugForCallingWinInetSyncOnUIThread+0xe0
03 000000e0f0efeb00 00007ffc11b47af6 wininet!INTERNET_HANDLE_OBJECT::HandlePendingSync+0x33
04 000000e0f0efeb30 00007ffc11b023a5 wininet!HttpWrapSendRequest+0x9a256
05 000000e0f0efecd0 00007ffc11b02318 wininet!InternalHttpSendRequestA+0x5d
06 000000e0f0efed40 000002a7d873018c wininet!HttpSendRequestA+0x58
07 000000e0f0efede0 000002a7d87301f9 0x000002a7d873018c
08 000000e0f0efede8 000002a7d873000a 0x000002a7d87301f9
09 000000e0f0efedf0 0000000000cc000c 0x000002a7d873000a

NOTE: The weird part is the shellcode actually works as it supposed to whenever I debug it in the windbg plugin in IDA PRO 7.5 (I do everything exactly the same in the plugin console as I did in the windbg binary console).

As for the shellcode it's a simple off-the-shelf cobaltstrike http beacon (The same error occurs with any type of reverse shell shellcodes).

It traverses InMemoryOrderModuleList structure from PEB, resolves the api names from hashes and simply executes them in order.

I've never debugged a cobaltstrike beacon directly in windbg before.

NOTE: I don't get any hangs or errors when I try to debug a simple x64 calculator shellcode the same way