2
CreateRemoteThread takes 7 arguments and the 4th of them is called lpStartAddress.
Now, from MSDN docs:
lpStartAddress
A pointer to the application-defined function of type LPTHREAD_START_ROUTINE to be executed by the thread and represents the starting address of the thread in the remote process. The function must exist in the remote process. For more ...
2
Yes, mov DWORD PTR 40[rsp], 6 is the same as mov DWORD PTR [rsp + 40], 6. The first syntax makes a lot more sense in cases where the constant is the base address of an array, and the register contains a byte offset into that array. That's the use case the syntax was designed for.
1
Yes, this is possible with some cooperation from the debugger. The OllyMigrate plugin supports migration between following debuggers:
OllyDbg
Immunity Debugger
IDA Pro/Freeware
WinDbg
x64dbg
It seems Visual Studio is not supported but you can always do it the manual way:
Patch an infinite loop (EB FE) at the current EIP/RIP;
Detach the current debugger. ...
1
You can parse a header using File > Load file > C header file or create a type library beforehand.
1
If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to setup your header file. Hope this helps.
1
All statically linked MFC binaries I've seen always include strings for some internal classes. The naming convention can be found in afximpl.h:
#define AFX_WNDCLASS(s) \
_T("Afx") _T(s) _T(_MFC_FILENAME_VER) _STATIC_SUFFIX _UNICODE_SUFFIX _DEBUG_SUFFIX
#define AFX_WND AFX_WNDCLASS("Wnd")
#define AFX_WNDCONTROLBAR ...
1
It is strange that segments ends in the middle of a function.
You could optimize your method, writing script that calculates the desired start and end of combined segments , deleting the relevant segments and then recreating as a combined segment. It is probably better than merging. You have a lot of control over parameters of the segments and it needs to ...
1
The earliest break is sxe ibp break on kd communication
if you want to break earlier than that you need to lookup boot debugging
you can use ctrl+alt+d for a debug spew of kdcom kdnet packets sent to and fro
Only top voted, non community-wiki answers of a minimum length are eligible
