I am using the Local Bochs Debugger along with IDA Pro to debug a shellcode. This shellcode disassembles properly in IDA Pro, however, now I want to debug it.
I tried debugging but since the configuration of Bochs is bare metal, it will not be able to execute some code properly, for instance:
xor eax, eax mov eax, dword ptr fs:[eax+0x30] // PEB
Since PEB is a structure defined in the Windows Operating System, Bochs does not execute this code properly (does not load the PEB address in eax).
Simiarly, other sections of code which parse the kernel32.dll structure to find various API addresses also does not work.
How can I debug the shellcode with IDA Pro and Bochs Debugger?
I also have the following:
Windows XP SP3 Guest OS running in VMWare workstation. IDA Pro running on the host OS.
Is it possible to place the shellcode.txt file inside the Guest OS and then debug it using IDA Pro on the host OS? I think in this case, the Windows Debugger, windbg's engine can be used.
What will be the configuration? In the following article:
It describes how to debug a remote process running on Windows. But in my case, it is not a process but a shellcode loaded from a text file.