So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough memory to load the second object: One .doc file that has a shellcode embedded in an ActiveX file (activex1.bin).
In this picture we can see the NOP-Sled and how the first stage of the shellcode is trying to XOR some bytes in memory. The problem is, ECX points to 82849735 and it is out of memory.
I need to extract second stage of the shellcode. I tryed WinHex to see if there was something in that position but I didn's succed.
Aclaration: I got to this point using jmp2it with the activex1.bin directly, so it is not the "context" of all the things the RTF file did (The heap spray and so on) and maybe it is important. I don't know how to proceed since it's a RTF file and I cannot just put that in the debugger.
Edit/Update: I tried jmp2it to load the shellcode, and as you can see here:
It uses GetFileSize to check for a file handle (the rtf file). The problem is:
If I launch jmp2it with the handle option, and point to that rtf, even though the shellcode will run properly, I will not have time to attach a debugger to the process (and I would lose the initial things).
So I don't know if there is a way or a tool that will let me stop a proccess anytime it calls a function?
I tried to load the rtf and attach a debugger but it doesn't work. Everything I tried does not work because most of the tools are for .exe's but most importantly because when I tried to launch the shellcode with anyother tool it fails since all the things (ASLR bypass for example) that .RTF does didn't happen.
