5

I am using the Local Bochs Debugger along with IDA Pro to debug a shellcode. This shellcode disassembles properly in IDA Pro, however, now I want to debug it.

I tried debugging but since the configuration of Bochs is bare metal, it will not be able to execute some code properly, for instance:

xor eax, eax
mov eax, dword ptr fs:[eax+0x30] // PEB

Since PEB is a structure defined in the Windows Operating System, Bochs does not execute this code properly (does not load the PEB address in eax).

Simiarly, other sections of code which parse the kernel32.dll structure to find various API addresses also does not work.

How can I debug the shellcode with IDA Pro and Bochs Debugger?

I also have the following:

Windows XP SP3 Guest OS running in VMWare workstation.
IDA Pro running on the host OS.

Is it possible to place the shellcode.txt file inside the Guest OS and then debug it using IDA Pro on the host OS? I think in this case, the Windows Debugger, windbg's engine can be used.

What will be the configuration? In the following article:

https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf

It describes how to debug a remote process running on Windows. But in my case, it is not a process but a shellcode loaded from a text file.

6

For testing shellcode on windows and in general, it's good idea to wrap it in a small program that executes it.

What you could do is write a small program that would read the shellcode, say , from a file into malloc()-ed buffer and then jump to it.

On windows, you'd probably want to use VirtualProtect to set PAGE_EXECUTE_READWRITE permissions on that memory area before jumping to it.

After reading shellcode into malloced memory and setting the execute permissions, you can simply use function pointer to call/jump to it.

This will produce the executable binary which you can run in any debugger, set the breakpoint just before the function pointer call and then debug the shellcode as you wish.

EDIT:

A quick search reveals just a program like that in an article about Windows x64 Shellcode. The same code can be applied on 32bit Windows.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.