0

When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet.

When I listen with procmon I can see that this exe send and recive tcp packet.

1) I look on the exe file import tab, and put break point at send function , but that not stop .

2) I looking at the line at procmon when I see tcp send in stack tab , and see

frame 0 ,module ntoskml.exe , Location CcMdlWriteAbout + 0x.... frame 1 ,module tcpip.sys , Location tcpip.sys + 0x.... frame 2 ,module tcpip.sys , Location tcpip.sys + 0x....

and etc..

How can I find the punction in exe file that send tcp packet , I want to put break point there .

Improve this question

1 Answer 1

Reset to default
0

If you can see the send event in ProcMon, just double click it and check the Stack tab to see what API the program used to perform it. Note that the stack trace usually includes the kernel part; you’ll need to skip it and look at the user-mode calls (skip the system libraries too except the one called directly by the process).

Improve this answer
2
  • in ProcMon Stack tab I see only ntosknl.exe , and the rest is .sys Modules
    – joif doi
    Nov 17, 2019 at 13:34
  • @joifdoi there should be some user-mode code in there unless the send actually originates in a driver... which is possible but unlikely
    – Igor Skochinsky ♦
    Nov 18, 2019 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.