4

I am debugging a shellcode in IDA Pro

IDA Pro version: 6.1.011 (32-bit)
Bochs version: 2.6.2

I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want to debug it.

I am using the Bochs Debugger which is installed on the same machine as the IDA Pro.

I load the shellcode from a text file as a Binary File and the Loading Segment is set to: 0x00000000 and Loading offset to: 0x00000000

seg000:00000000                 db 0FFh
seg000:00000001                 db 0FEh ; ¦
seg000:00000002                 db  55h ; U
seg000:00000003                 db 0EBh ; d
seg000:00000004                 db  6Eh ; n
seg000:00000005                 db  33h ; 3
seg000:00000006                 db 0C0h ; +
seg000:00000007                 db  64h ; d

The actual code starts from the offset, 0x02 so, I press C and it displays the correct disassembly

seg000:00000000                 db 0FFh
seg000:00000001                 db 0FEh ; ¦
seg000:00000002 ; ---------------------------------------------------------------------------
seg000:00000002                 push    ebp
seg000:00000003                 jmp     short loc_73
seg000:00000005
seg000:00000005 ; =============== S U B R O U T I N E =======================================
seg000:00000005
seg000:00000005
seg000:00000005 sub_5           proc near               ; CODE XREF: sub_AE+6p
seg000:00000005                 xor     eax, eax

now, I select "Local Bochs Debugger", select the code starting from offset, 0x2 and press F9.

It gives the error: "**Failed to map a database segment to virtual address, 00000000. This usually happens if the debugged program has segments that overlap with BOCHS loader segments**".

So, I reload the shellcode from the text file and this time set the Loading Segment to: 0x00400000 and leave the Loading Offset set as: 0x00000000

now, when I repeat the steps above, it tries to launch the Bochs Debugger (I just get a busy icon, so I guess it is attempting to launch the Bochs Debugger) and after few seconds, gives me the warning:

"Failed to run bochs with: C:\Program Files (x86)\Bochs-2.6.2\bochsdbg.exe" -f "C:\shellcodes\shellcode.bochsrc" -q

Please make sure that BOCHS is configured properly:
1. You are using bochsdbg.exe executable
2. You are using a supported version of BOCHS."
1
  • 4
    you should write up the answer as an answer, not edit it into your question. Also, any special reason why you don't use the latest IDA version?
    – 0xC0000022L
    Aug 26, 2013 at 11:45

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.