Starting my RE adventures with IDA Pro, I'm opening a windows .exe file in it. While debugging the file, the debugger runs fine and exits with a return 1 value: Debugger: process has exited (exit code 1). The problem is all this happens in a second! Before feeding the .exe to IDA Pro, I have tried to open it with double-clicking. The windows console shows itself and fades away in a glimpse; The only way I can get the .exe running with the console remaining open, is by the cmd. I guess IDA Pro debugger is simply exiting for the same reason the console fades in normal running the .exe! So I'm stuck with a .exe file running fine but I don't get the chance to debug it and monitor the flow of the program!
3 Answers
Seems like you did not add any breakpoints. By default no breakpoints are applied.
You can add a breakpoint on program entry (among other events) in the Debugger Options. In Debugger Options, check the box that says "Suspend on process entry point", or any of the other events available. Read more here:
https://www.hex-rays.com/products/ida/support/idadoc/1413.shtml
Alternately, you can find a line of assembly and add a breakpoint on that line and the program will break once execution reaches that instruction.
Once a breakpoint is hit, you can step over each instruction, etc.
-
actually the problem is not the breakpoints! The interesting part is that the debugger won't exit for specific breakpoints while it does for other ones. I didn't have the issue with Ollydbg. However, I find it much more easier to navigate through IDA Pro GUI. I have tried the events too but they basically are not worth the effort. Even when the debugger suspends and I move to the breakpoint, the debugger again exits– NewbieOct 7, 2016 at 7:50
-
Does the binary have anti debugging? Maybe it works in Olly because you have plugins which hide debugging. For Ida look into Ida stealth, Scylla Hide, or Titan hide. Probably others but these are the plugins which I know of that can help you get by anti debugging. Oct 8, 2016 at 6:04
Are you opening a 32 or 64 bit .exe (cannot add this as a comment due to no enough reputation points)? If you are opening on 64 bit file with a 32 bit instance of IDA, you may encounter issues. If you're using the free version,there are limitations on what can be opened as stated here: https://www.hex-rays.com/products/ida/support/download_freeware.shtml
This question is similar to this other posting: IDA cannot launch debugger for 64-bit exe files
-
I tried another .exe which prompted for an input. Since the console remains open for an input, the debugger also won't exit when you open the .exe in IDA Pro. So, I guess it's initially a matter of the .exe file itself.– NewbieOct 8, 2016 at 8:12
So I went through the assembly and found an exit subroutine. Evidently the debugger used to exit once reaching the command. I simply avoided the exit section since all that was supposed to occur, happened before the exit command.