1

I have a binary that is utilizing OutputDebugString as an anti-debugging technique. I want to find the calls and patch up the jump table or something similar. Normally I can find an API call by using the "Names" window. Also I have tried searching for all intermodular calls. The OutputDebugString API is found in neither, but I know it is being called. How do I find the calls to this API and set a BP on them?

Note: This software is packed and protected using Armadillo, which uses some API redirections, so maybe it is using LoadLib/GetProcAddr to call the API by offset instead of by name?

  • In the case of armadillo the module that calls these apis is decrypted and loaded in memory at runtime. With x64dbg you can name this module and correctly restore your breakpoints in it. Try finding it by placing a breakpoint on the api itself and then look in the callstack. Also, x64dbg is not susceptible to this anti debug trick so that might help you too... – mrexodia Feb 1 '17 at 19:36
  • @mrexodia Okay, so I tried the method of Ctrl+G and "OutputDebugStringA". This took me to, presumably, the first line of the API in kernel32.dll. If I Alt+F9 to run until user code, then I land before a call made to an address loaded in the DS. I guess at some point it uses GetProcAddr and saves it there? Still, in the comment section, Olly detects it as a call to OutputDebugStringA. Is the reason it is not being found with Ctrl+N because its generated at runtime? That would mean all calls made by discovery via GetProcAddr are not listed in the names list? – typedeaf Feb 6 '17 at 16:40
  • Olly doesn't work well with modules that are dynamically allocated. Who knows what's going on. – mrexodia Feb 6 '17 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.