2

I want to debug an application which when opened, it will open a fork from it.

e.g. program.exe will run 2 program.exe in the task manager

the software is EMS SQL Management Studio for PostgreSQL

when I try to attach debugger to the first .exe file (trial Wizard) a Message Box shows as follows:

The debugger could not attach the selected process. This can perhaps indicate the process was just terminated, that you don't have the necessary privileges..

I can attach the debugeer to the second .exe (Main Program Window) file. But it is useless.

I think my problem is that one of them is the parent process and the other is the child process. Can I know how to open the child process alone (maybe inspect arguments) so I can attach debugger to it.

My Question: How can attach debugger to the application trial wizard??

In case of debugger protection, can I break it or skip it to be able to debug or unpack?

Improve this question
2
  • What is you final goal?
    – PhoeniX
    Commented Jan 2, 2014 at 9:02
  • I want to Unpack EMS SQL Management Studio for PostgreSQL
    – Danyal
    Commented Jan 2, 2014 at 9:10

2 Answers 2

Reset to default
5
  1. Depending on what you try to achieve, you can try to attach WinDbg in noninvasive mode: F6 -> select the process and select noninvasive mode down on left.
  2. Other suggestion is, to patch the executable on disk at the entery point, which you can locate for example by using CFF explorer with the infinite jump : 0xEB 0xFE. After you finish with the patch, just execute it and attach the debugger and restore the initial bytes back. You can continue from here to do what ever you want. As to bypassing debugger protection, there are plenty of plugins for debugger to help you: for OllyDbg - OllyExt, aadp and regarding Windbg
  3. If Tls calls are present (you can also check it using CFF explorer) which will be executed before the entery point code, you can patch them too, and try to attach debugger too.

To debug child processes, you can use procmon to inspect the whole flow and get the information regarding the parameter that the child processes are executed with. Or, you can breakpoint on CreateProcessA(W) or similar and go from there.

HxD could be used as a hex editor for the above.

Improve this answer
2
  • 1. WinDBG cannot debug this exe as it says. 2. I found 0xEB 0xFE using CFF. now what? I disassembled it but it doesn't run
    – Danyal
    Commented Dec 31, 2013 at 13:18
  • at the hex editor, you need to get to the entery point and there replace first 2 bytes with 0xeb 0xfe. After replacement, execute the file. Just save the original ones, to restore them once you are connected with the debugger.
    – PhoeniX
    Commented Dec 31, 2013 at 13:25
4

It may have a form of protection from debugger attaching. Programs can call IsDebuggerPresent or have a different way of dealing with debugger detection. They usually pop up a fake "error" or immediately terminate.

You could modify kernel32.dll (it has the debugger check function) and make it return false, but it's not usually a good idea to mess with system files.

Improve this answer
2
  • 1
    ok. Any way to bypass debugger protection
    – Danyal
    Commented Dec 24, 2013 at 7:26
  • Not much that I know of unfortunately.
    – Discord
    Commented Dec 25, 2013 at 0:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.