0

Well, I have several questions about this topic. I don't know if I'm using the right method to achieve what I need.

I need to debug which exact method does something inside a process in order to replicate that call in C# using interop/detours.

The thing here is that this question gave me a big clue about how to do it.

It suggested using GDB in order to obtain the called process. The problem is that I'm running under Windows, not under Linux, so I used the GDB app from MinGW (located under C:\MinGW\bin\gdb.exe).

I started a Powershell terminal and I executed the command using first the PID specifier argument (gdb -p <pid>), then rbreak, but the process seems to be infinite (I'm running it while I'm asking this).

In order to do it as the answer suggested I used gdb --args <path> <arg> and then rbreak which contained only like 30-40 functions. But when I try to run the process using run the process won't start.

Error accessing memory address xxx: Input/output error

And Idk how to solve it. So maybe I'm doing it wrong and the unique way to debug it is by executing rbreak on a running process but it's very slow and Idk if this is a very reliable way to do this.

Real question

I'll try to expose my real question. The problem here is that I need to download something using the UI console that some important app provides. It has a textbox where you can type the commands, I already tried to do it by moving the mouse cursor, clicking it and typing this command using the Win API (but this is not the best way to do this).

So, researching for information I discovered the question I attached, and maybe this is the most similar question I found. Because when I type the command in that textbox I need to press enter in order to trigger the function that executes that command. But if the gdb process lasts like an hour (maybe) to execute the rbreak how could I just get the diff here?

Also, as I'm not running on Windows as I needed to adapt this Python script into C#, and this is what I have:


        private static void ExecGDB()
        {
            try
            {
                var startInfo = new ProcessStartInfo
                {
                    CreateNoWindow = true,
                    RedirectStandardInput = true,
                    FileName = "gdb",
                    // Arguments = $"-p {pid}",
                    Arguments = @"--args ""<path>"" <arg>",
                    UseShellExecute = false,
                    RedirectStandardOutput = true,
                    RedirectStandardError = true
                    //WorkingDirectory = @"C:\MinGW\bin"
                };

                using (process = new Process { StartInfo = startInfo, EnableRaisingEvents = true }) // , EnableRaisingEvents = true
                {
                    process.OutputDataReceived += (sender, args) => Console.WriteLine(args.Data);
                    process.ErrorDataReceived += (sender, args) => Console.WriteLine(args.Data, Color.DarkRed);
                    process.Start();

                    process.BeginOutputReadLine();
                    process.BeginErrorReadLine();

                    Console.WriteLine("Sending commands!", Color.ForestGreen);

                    Thread.Sleep(10);

                    var gdb = process.StandardInput;

                    gdb.WriteLine("rbreak");
                    gdb.WriteLine("run");

                    gdb.WriteLine("continue");

                    gdb.WriteLine("Quit");

                    Thread.Sleep(10);

                    gdb.WriteLine("y");
                }
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex, Color.Red);
            }

            Console.WriteLine("Process exited!", Color.ForestGreen);
        }

This seems to work in the same way as executing it on a Powershell terminal. But as I said right now there is like ~32000 funcs pointed with rbreak and this seems to be infinite.

Also, I have IDA installed on my machine, maybe I can use it in order to do what I need but I'm not sure about this.

Maybe rbreak is something like the IDA first analysis? I need help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.