3

I debug exe file in Ida , and put breakpoint in some address.

I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with breakPoint. Running it simply from cmd or from c/cpp/c# code, not from Gui

And if it passable I want :

  1. Before I continue running it in another PC edit value in spesific address

  2. Running this process untill it will come to spesific address , then look thr value in spesific address.

CreateRemoteThread not good for me of course.

VM not help me , because I want to merge it with code without VM .

How can I do it please? Thanks

  • How about using something like VirtualBox to take a full system snapshot which you can copy and resume elsewhere. – 0xec Dec 30 '18 at 20:38
  • @0xec Because I want to merge it with c/cpp/c/#/java ode and not via VM – g319909.nwytg.coM Dec 30 '18 at 21:08
  • Every process has an associated context like file handles which you cannot simply copy over to another PC and expect them to be valid. VM snapshots work as it copies the entire state of the OS and not individual processes. – 0xec Dec 30 '18 at 21:22
  • @0xec I dont need the context file handles ,If I will copy the VM snapshot it will be hard to running it with code that exist out of VM (and the snapshot will takes some GB) I only need the register and stack values when I put the breakpoint – g319909.nwytg.coM Dec 31 '18 at 7:12
2

If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to the current EIP. OllyDumpEx (https://low-priority.appspot.com/ollydumpex/) is commonly used for this purpose for malware analysis. Despite its name, it is a plugin for both OllyDbg, IDA, x64dbg, and WinDbg.

If you do need some of the program state, you can add a custom EntryPoint function or set of instructions that set it up.

In theory, the following should work (for a single-threaded 32-bit process)...

You need to save the processor state, stack, and any sections allocated on the heap by user code (such as with calls to VirtualAlloc, HeapAlloc, or malloc). You will also need to find a place to insert some setup instructions.

First, when you start your process in the debugger, view the memory map/segments (in IDA, I believe it is in the menu View > Open Subview > Segments) and make note of them (or take a screenshot for reference).

Next, run the program up to the point that you want to move it to your other system. Now look at the memory segments again and note which ones under the Heap are new. Also make note of the current address of the instruction pointer.

Now to save the processor state, you can use the PUSHAD and PUSHFD instructions. Find a code cave of at least 7 bytes in length. Edit bytes and change them to 0x60 0x9c, then change the instruction pointer to point to the address of where you inserted those two bytes. Now single-step twice. That will execute the PUSHAD and PUSHFD that saves the general purpose registers (including the stack pointer) and the flags. Now edit those same bytes to 0x9d 0x61 0xEA . Finally, change the instruction pointer to point to the address of where you inserted those bytes.

Run the OllyDumpEx plugin. Under List section choose All memory, then click the ReScan memory button. Now check the box next to Auto Adjust Image Base Address. Then click on Get EIP as OEP button.

Now, in the list of sections in the bottom of the dialog box, there should be several already selected. Keep those selected. Additionally select any that are related to the Stack and Heap. Now click the Dump button. This may require a bit of trial and error.

NOTE: If your process is multi-threaded then this won't work. There will be thread-specific state that will also need to be saved, but I am uncertain how to do that.

  • thank you about your comment , I don't need open handles, but I need the register values and the stack values, so how can I load all of this value and start the process again in another pc? – g319909.nwytg.coM Dec 31 '18 at 7:09
  • You mean that let say once the process pause in the breakpoint, you will copy the register values and then use these to another process? – ismael_akez Jan 1 at 10:10
  • @ismael_akez yes, When I pause the process with breakPoint I want to continu it in another PC, so I need to copy all the registers and the stack, because some registers point on address in the stack , and stack contains some important values , shortly continue running process in another PC in the point it break with breakPoint – g319909.nwytg.coM Jan 1 at 18:01
  • I think you should consider the GetThreadContext, get the important values or registers, use SetThreadContext to set the values then ResumeThread by assigning the address to EIP.. Copying the stack might not work. – ismael_akez Jan 2 at 4:34
  • The stack is a memory segment, so could dump it into the new PE. Depending on which dumping tool you use, might take a little work (OllyDumpEx) or be impossible (the original OllyDump). If this is of interest, let me know and I'll add the details to my answer. – knowmalware Jan 3 at 0:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.