2

I am debugging a shellcode in IDA Pro

IDA Pro version: 6.1.011 (32-bit)
Bochs version: 2.6.2

I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want to debug it.

I am using the Bochs Debugger which is installed on the same machine as the IDA Pro.

I load the shellcode from a text file as a Binary File and the Loading Segment is set to: 0x00000000 and Loading offset to: 0x00000000

seg000:00000000                 db 0FFh
seg000:00000001                 db 0FEh ; ¦
seg000:00000002                 db  55h ; U
seg000:00000003                 db 0EBh ; d
seg000:00000004                 db  6Eh ; n
seg000:00000005                 db  33h ; 3
seg000:00000006                 db 0C0h ; +
seg000:00000007                 db  64h ; d

The actual code starts from the offset, 0x02 so, I press C and it displays the correct disassembly

seg000:00000000                 db 0FFh
seg000:00000001                 db 0FEh ; ¦
seg000:00000002 ; ---------------------------------------------------------------------------
seg000:00000002                 push    ebp
seg000:00000003                 jmp     short loc_73
seg000:00000005
seg000:00000005 ; =============== S U B R O U T I N E =======================================
seg000:00000005
seg000:00000005
seg000:00000005 sub_5           proc near               ; CODE XREF: sub_AE+6p
seg000:00000005                 xor     eax, eax

now, I select "Local Bochs Debugger", select the code starting from offset, 0x2 and press F9.

It gives the error: "**Failed to map a database segment to virtual address, 00000000. This usually happens if the debugged program has segments that overlap with BOCHS loader segments**".

So, I reload the shellcode from the text file and this time set the Loading Segment to: 0x00400000 and leave the Loading Offset set as: 0x00000000

now, when I repeat the steps above, it tries to launch the Bochs Debugger (I just get a busy icon, so I guess it is attempting to launch the Bochs Debugger) and after few seconds, gives me the warning:

"Failed to run bochs with: C:\Program Files (x86)\Bochs-2.6.2\bochsdbg.exe" -f "C:\shellcodes\shellcode.bochsrc" -q

Please make sure that BOCHS is configured properly:
1. You are using bochsdbg.exe executable
2. You are using a supported version of BOCHS."
  • 3
    you should write up the answer as an answer, not edit it into your question. Also, any special reason why you don't use the latest IDA version? – 0xC0000022L Aug 26 '13 at 11:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.