2

I have a dotnet malware sample that I'm trying to debug with dnSpy. It has string obfuscation (contains function names such as BarriersBottomed, etc.) I cleaned the sample using de4dot and renamed functions to make them more understandable.

I placed a breakpoint on Main and also specified in the debug settings to break at Entry Point, but the program never hits the breakpoint. When I click on Start, it runs for a few seconds and then I get a dnSpy error:

An unhandled exception occurred in kahjvb-cleaned.exe (2160)
Exception: ???
Message: "<no exception message>"

So, in the Debug options I checked the Ignore unhandled exceptions and restarted debugging with the same options as before. Now, the debugger just runs for a few seconds and the debugging process completes. It still doesn't hit the breakpoint.

Has anyone faced an issue of this type before or has any insights into this problem? Thanks for the help!

  • It might be difficult to propose anything without looking into this specific binary. – Paweł Łukasik Apr 26 at 4:45
2

Debugging a "cleaned" binary is typically hard. Many cleaning techniques will leave you with a malformed binary that is easy to "read" but won't execute properly. I suggest statically analyzing the "cleaned" version and then using what you learn to debug the original version.

  • Right, that's what I ended up doing. Thanks! – Nikhil May 1 at 13:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.