So, here is the context: All start with a RTF file that has 3 objects. The first one loads a non-ASLR module "MSCOMCTL.OCX" and uses it to succed on a Heap Spray technique so it allocates enough memory to load the second object: One .doc file that has a shellcode embedded in an ActiveX file (activex1.bin).

enter image description here

In this picture we can see the NOP-Sled and how the first stage of the shellcode is trying to XOR some bytes in memory. The problem is, ECX points to 82849735 and it is out of memory.

I need to extract second stage of the shellcode. I tryed WinHex to see if there was something in that position but I didn's succed.

Aclaration: I got to this point using jmp2it with the activex1.bin directly, so it is not the "context" of all the things the RTF file did (The heap spray and so on) and maybe it is important. I don't know how to proceed since it's a RTF file and I cannot just put that in the debugger.

Edit/Update: I tried jmp2it to load the shellcode, and as you can see here: Getting Handle. It uses GetFileSize to check for a file handle (the rtf file). The problem is: If I launch jmp2it with the handle option, and point to that rtf, even though the shellcode will run properly, I will not have time to attach a debugger to the process (and I would lose the initial things).

So I don't know if there is a way or a tool that will let me stop a proccess anytime it calls a function?

I tried to load the rtf and attach a debugger but it doesn't work. Everything I tried does not work because most of the tools are for .exe's but most importantly because when I tried to launch the shellcode with anyother tool it fails since all the things (ASLR bypass for example) that .RTF does didn't happen.

  • 2
    – Remko
    Commented Dec 3, 2017 at 14:35
  • I edited the post, since the tools I tried didn't work. Problem seems to be that I can take two paths: Run the shellcode and failing to extract second stage cause its out of memory or try something since the beggining with the .rtf file. Commented Dec 10, 2017 at 21:56

1 Answer 1


Jmp2it has option to pause before shellcode executes so you have time to attach debugger

  • 2
    Maybe add a bit more on how to use it in this case. Commented Feb 4, 2018 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.