2

I'm having trouble debugging a win32 executable file under Windows 7. I've tried using ollyDbg and x64dbg: the former simply does nothing, while the latter complains with an "Error starting process (invalid pe?)!" message.

I think this might have to do with the fact that said executable is digitally signed. I did some quick research and this SO question came up, where I learned that digital signatures in windows executables are referenced in the file's PE header, which I think might be what x64dbg was complaining about.

The executable I'm talking about is the Mumble windows client version 1.2.10. It is the only executable signed with two different digital signatures, which further reinforces my hypothesis. Sadly, even after stripping the digital signatures using the delcert.exe linked in the SO question above, the problem remains which brings me to a dead end.

Is it possible digital signatures are messing these debuggers up? Is it possible that the signature stripping tool doesn't produce a valid pe file for the debuggers I tried? What else could I be doing wrong?

As a footnote: I know mumble is free software and I could just compile my own version, but this is Reverse Engineering, right?

Update: Following Jason comment, I'm posting the ollydbg log, which doesn't really say anything, unfortunately:

Log data
Address    Message
OllyDbg v1.10
Bookmarks sample plugin v1.06 (plugin demo)
  Copyright (C) 2001, 2002 Oleh Yuschuk
Command line plugin v1.10
  Written by Oleh Yuschuk
File 'C:\Program Files (x86)\Mumble\mumble.exe'
Improve this question
7
  • "I've tried using ollyDbg and x64dbg: the former simply does nothing" -- What do you mean, "does nothing"? Can you paste the logs from OllyDbg's log window? – Jason Geffner Sep 27 '15 at 23:38
  • Signing shouldn't have anything to do debugger issues, but if you want to strip it, you need to clear the IMAGE_DIRECTORY_ENTRY_SECURITY data directory. – broadway Sep 27 '15 at 23:52
  • You're using an outdated version of OllyDbg. Please try with OllyDbg v2.01. – Jason Geffner Sep 28 '15 at 13:17
  • try copying the file into a different directory, too - the program files directory has protection that x86dbg might not like. – peter ferrie Sep 28 '15 at 15:16
  • 1
    i had mumble ( standalone zip) somewhere and took a look at it in ollydbg 1.10 and it does not complain it starts the audio setup wizard checks my speaker / mic / and asks me to set a few sliders to make latency lowest and then starts off the connect to server (it does emit a lot of debug strings i ran it in winitors pestudio and it appears it uses a comodo cert cert is not a problem for debugging this app you have some other problem – blabb Sep 29 '15 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.