0

When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet.

When I listen with procmon I can see that this exe send and recive tcp packet.

1) I look on the exe file import tab, and put break point at send function , but that not stop .

2) I looking at the line at procmon when I see tcp send in stack tab , and see

frame 0 ,module ntoskml.exe , Location CcMdlWriteAbout + 0x.... frame 1 ,module tcpip.sys , Location tcpip.sys + 0x.... frame 2 ,module tcpip.sys , Location tcpip.sys + 0x....

and etc..

How can I find the punction in exe file that send tcp packet , I want to put break point there .

1 Answer 1

0

If you can see the send event in ProcMon, just double click it and check the Stack tab to see what API the program used to perform it. Note that the stack trace usually includes the kernel part; you’ll need to skip it and look at the user-mode calls (skip the system libraries too except the one called directly by the process).

4
  • in ProcMon Stack tab I see only ntosknl.exe , and the rest is .sys Modules
    – joif doi
    Nov 17, 2019 at 13:34
  • @joifdoi there should be some user-mode code in there unless the send actually originates in a driver... which is possible but unlikely
    – Igor Skochinsky
    Nov 18, 2019 at 10:45
  • @IgorSkochinsky what exact stack should we see in ProcMon? AFAIK for example socket.send() in python will call the needed syscall under the hood, and ProcMon will not be able to track what caused the call except it somehow knows debug symbols of program or maybe the app is built without stripping the debug info
    – Ivan
    Dec 26, 2023 at 12:28
  • @Ivan on Windows, raw syscalls are not used by user-mode programs. WS2_32.dll send() will likely be used in such case.
    – Igor Skochinsky
    Dec 27, 2023 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.