1

When I try to debug Windows Media Player and play a movie this error message is shown:

Running this process under a debugger while using DRM content is not allowed.

But with drmdbg it can debug wmplayer and play a movie.

Is there a solution to overcome this?

4
  • 2
    What are you using to debug? – PSS Sep 3 '13 at 0:57
  • @studentofmp: Please explain what debugger you are using, if "drmdbg" does the job, why don't you use that? Also, more careful formatting will more easily get you the attention of the users here ;) – 0xC0000022L Sep 3 '13 at 2:06
  • @0xC0000022L thanks for this comment but drmdbg it does its own job it is not a debugguer like ollydbg .. – studentofmp Sep 3 '13 at 9:47
  • Did you try using any debugger stealth plugins for OllyDbg? If not, go ahead and try them, there are many. Next step could possibly be using a kernel mode debugger, e.g. SoftIce or even WinDBG in kernel dbg mode. Last but not least, you could as well remove the debugging detection from the binary you are trying to debug - there are some tutorials on that subject as well.... Just for your entertainment, this would be a simple one: youtube.com/watch?v=h54jlxpyT3w – Till Sep 3 '13 at 17:11
2

Another (not easy) option could be to use a patched version of Wine (as it supports running Windows Media Player) and connect to the GDB remote debugger it offers. While it may sound weird I did that to debug, for example, Themida packed executables.

You can download a patch for Wine 1.2 (if I remember correctly) from here:

http://sourceforge.net/projects/zerowine/files/Zerowine%202.0/zerowine.patch/download

2

DRMDBG is a debugger like OllyDbg, but it seems to be meant for a single executable.

Call stack of thread 00000E2C
Address    Stack      Procedure / arguments                                   Called from        Frame
01CC9FAC   7C8192E2   ? ntdll.ZwCreateProcessEx                               KERNEL32.7C8192DC
01CCA9FC   7C802362   ? KERNEL32.CreateProcessInternalW                       KERNEL32.7C80235D
01CCAA34   0047DD6E   ? <JMP.&kernel32.CreateProcessW>                        drmdbg.0047DD69    01CCAA30
01CCAA38   0016CF84     ModuleFileName = "C:\Program Files\Windows Media Player\wmplayer.exe"
01CCAA3C   00000000     CommandLine = NULL
01CCAA40   00000000     pProcessSecurity = NULL
01CCAA44   00000000     pThreadSecurity = NULL
01CCAA48   00000000     InheritHandles = FALSE
01CCAA4C   00000003     CreationFlags = DEBUG_PROCESS|DEBUG_ONLY_THIS_PROCESS
01CCAA50   00000000     pEnvironment = NULL
01CCAA54   00000000     CurrentDir = NULL
01CCAA58   0048A388     pStartupInfo = drmdbg.0048A388
01CCAA5C   0048A3CC     pProcessInfo = drmdbg.0048A3CC
01CCAA68   0047E9E3   drmdbg.0047DD0C                                         drmdbg.0047E9DE    01CCAA64
01CCFF68   0047F10B   ? drmdbg.0047E954                                       drmdbg.0047F106    01CCFF64
01CCFF74   00422149   drmdbg.0047F0F0                                         drmdbg.00422146    01CCFF70

You can use WinDbg in a non-invasive way. Using stealth plugins in ollydbg can let you attach to wmplayer.exe. You need to identify antidebugging routines and bypass them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.