0

I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks.

In OllyDbg, the following breakpoint gets me exactly what I want:

Address=75B0C4FA | Module=KERNELBA | Active=Always | Disassembly=CMP EAX,103

But when I try to set a breakpoint in WinDbg , it never comes back with anything:

bp 75b0c4fa

According to the MS Dev Center documentation for the bp command, I should be able to reference addresses specifically, but in my searching, most people are using bp to reference API calls, such as bp ReadFile (which does break as expected).

My questions: is it possible to use the breakpoint (75B0C4FA) using WinDbg? And if so, what am I missing in terms of adapting the address I have to make it work in Windbg? Does it have to do with bp ReadFile accessing the ReadFile API calls for the main process, while with my breakpoint, it is trying to put breaks into sub module?

Improve this question
1
  • It might also be a parse error if you don't use the "0x" prefix for addresses. But as others mentioned it's probably ASLR biting you in the ass.
    – mrexodia
    Mar 26, 2017 at 16:43

1 Answer 1

Reset to default
1

Dlls do not load at same address the load address is randomised due to aslr subtract the base address of kernelbase from your address in ollydbg viz75xxxx - say 74xxxxx. = 01xxxxx. Now in windbg find where kernelbase is loaded. Ssy 58xxxxxx. Add the 01xxxxx to this base address. And set bp viz 58xxxxx + 01xxxxx = 59xxxxx

Bp 59xxxxxx.

Read about rva aslr loadaddress etc to get a hang of this

Improve this answer
2
  • Thanks for this answer. I looked up what you were talking about here with the randomized address space. One thing I don't understand is this "viz" when I googled for it, it was mostly other responses from you on stack overflow, etc... Can you explain that? Thank you!
    – ranvel
    Mar 26, 2017 at 15:07
  • Viz is an adverb a contraction of videlecit a latin word that means namely/ for example look it up on wikipedia. en.m.wikipedia.org/wiki/Viz. The abbreviation viz. (or viz without a full stop), short for the Latin videlicet, is used as a synonym for "namely", "that is to say", "to wit", or "as follows". It is typically used to introduce examples or further details to illustrate a point.[1]
    – blabb
    Mar 26, 2017 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.