I am debugging a shellcode in IDA Pro
IDA Pro version: 6.1.011 (32-bit)
Bochs version: 2.6.2
I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want to debug it.
I am using the Bochs Debugger which is installed on the same machine as the IDA Pro.
I load the shellcode from a text file as a Binary File and the Loading Segment is set to: 0x00000000 and Loading offset to: 0x00000000
seg000:00000000 db 0FFh
seg000:00000001 db 0FEh ; ¦
seg000:00000002 db 55h ; U
seg000:00000003 db 0EBh ; d
seg000:00000004 db 6Eh ; n
seg000:00000005 db 33h ; 3
seg000:00000006 db 0C0h ; +
seg000:00000007 db 64h ; d
The actual code starts from the offset, 0x02 so, I press C and it displays the correct disassembly
seg000:00000000 db 0FFh
seg000:00000001 db 0FEh ; ¦
seg000:00000002 ; ---------------------------------------------------------------------------
seg000:00000002 push ebp
seg000:00000003 jmp short loc_73
seg000:00000005
seg000:00000005 ; =============== S U B R O U T I N E =======================================
seg000:00000005
seg000:00000005
seg000:00000005 sub_5 proc near ; CODE XREF: sub_AE+6p
seg000:00000005 xor eax, eax
now, I select "Local Bochs Debugger", select the code starting from offset, 0x2 and press F9.
It gives the error: "**Failed to map a database segment to virtual address, 00000000. This usually happens if the debugged program has segments that overlap with BOCHS loader segments**".
So, I reload the shellcode from the text file and this time set the Loading Segment to: 0x00400000 and leave the Loading Offset set as: 0x00000000
now, when I repeat the steps above, it tries to launch the Bochs Debugger (I just get a busy icon, so I guess it is attempting to launch the Bochs Debugger) and after few seconds, gives me the warning:
"Failed to run bochs with: C:\Program Files (x86)\Bochs-2.6.2\bochsdbg.exe" -f "C:\shellcodes\shellcode.bochsrc" -q
Please make sure that BOCHS is configured properly:
1. You are using bochsdbg.exe executable
2. You are using a supported version of BOCHS."