All Questions

Tagged with
Filter by
Sorted by
Tagged with
1
vote
1answer
331 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
3
votes
3answers
571 views

How to debug ServiceMain function of a service?

I have a malware which is checking for keyboard type and locale information. After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
2
votes
1answer
2k views

Get address of where process mapped in Windbg

I'm looking for the start address of where myfile.exe mapped into memory using Windbg. For this I connected to a VMWare for kernel debugging through serial port, after that I run myfile.exe in guest ...
0
votes
1answer
131 views

Using breakpoints from OllyDbg in Windbg

I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks. In OllyDbg, the following ...
4
votes
3answers
476 views

Is there a tool to see kernel space mapping of a Windows exe?

In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
0
votes
2answers
1k views

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ? Also,I was debugging an exe which has PTRD at 0x600 and AEP at ...
1
vote
0answers
179 views

How to call DebugActiveProcessStop from disassembled code?

I am debugging an application. Another process is debugged by this application. Here is the call 00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] I want to ...
3
votes
1answer
1k views

How to search for intermodular calls in WinDBG

In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG? Thanks
12
votes
2answers
3k views

Should I switch from WinDbg to OllyDbg?

I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I ...