As part of an assignment, I am trying to do some debugging in
iexplore.exe (Aurora vulnerability).
After I load the test webpage in iexplorer 8, I open windbg and attach to the iexplore process.
I verify my symbolpath by using:
.sympathy Symbol search path is: srv*C:\Users\User\Desktop\Symbols Expanded Symbol search path is: srv*c:\users\user\desktop\symbols
I know that what I am interested in is inside of
mshtml, so I list all the symbols in mshtml via:
x /t /n mshtml!*
Next, I use:
To see the function I am interested in and discover that one of the instructions I want to examine is at:
I try setting a breakpoint at that address by:
Then, I run:
And the breakpoint shown is actually at:
Why isn't my breakpoint at the point I specified ?
Also I have tried using:
And the code is totally different than when I simply unassembled the entire function based on the symbol address for the function.
Any ideas would be greatly appreciated.