Log in

View Full Version : Debugging Delphi with DeDe - Help

r3aper
February 19th, 2009, 19:23
I've used DeDe several times and I had no problem with it until today.

I've downloaded Guitar Pro 5 and had it opened in DeDe.
DeDe will start to process, with no problems, but when it reaches "dumping process" after "loading d7.doi" DeDe will simply shutdown.

I'm using windows vista home premium and the last version of DeDe.

Any idea why this is happening?

Thanks,
r3aper
Externalist
February 20th, 2009, 00:32
DeDe is sometimes buggy. Try this method instead.

http://forum.tuts4you.com/?showtopic=7554
arc_
February 20th, 2009, 03:39
Externalist, that link seems broken?

What I do for debugging Delphi apps (and other native-compiled apps that use some kind of framework, e.g. MFC), is disassemble the target in IDA to have it recognize the Delphi library functions, export the names to a .map file, then import the map into Olly (using e.g. the MapConv plugin) and debug the target there. You may want to scout around in IDA first, looking for library functions that display modal dialogs (for nag screens) etc. and then set breakpoints on them in Olly.
simonzack
February 20th, 2009, 08:43
IDA can recognize those?
never knew that, that's awesome!
thanks
dede *is* really buggy, sometimes it dies after misinterpreting jumps
r3aper
February 20th, 2009, 10:47
Thank you all for your replies.

I'm a little busy today, but this weekend I'll try your method, arc_ and let you know how it went.
Just a quick question for IDA to recognize the Delphi API do I need to download some signatures first and add them to IDA or IDA does already have the signatures' file.

Also, Externalist, if you could update the link it would be great, too much knowledge is never enough =)

Once again thanks
esther
February 20th, 2009, 11:07
I'm not surprised its not very compatiable on vista or windows xp ,it has not being updated since 2000.Like arc_ mention,use all avaliable tools you have
xenakis
February 20th, 2009, 12:01
Link works for me. Just guessing, but perhaps you have to be a member/signed in at tuts4you for the link to work.

xenakis

EDIT: Just confirmed by signing out and following link, thread is only accessible to signed in members.
r3aper
February 20th, 2009, 12:07
I've just created an account and it worked, indeed.
Thanks

r3aper
arc_
February 20th, 2009, 14:23
IDA comes with Delphi and other signatures, no need to download them separately. Just disassemble and watch the magic happen

(And I was already guessing the tuts4you page was for members only, though the specific error message made me think it was really broken.)
r3aper
February 20th, 2009, 22:10
I've done it.
I haven't tried the IDA export thing, but I promise I will, for now I just bypassed the nag but in the future I want to register the app.
To bypass the nag I just used winspector to find the class of the nag, used GODUP to place a bp on the event OnCreate and then it was only a matter of tracing back and looking at where the call to the event was made. Voilą.

Once again, thanks for all your help/comments/tips. I guess I will stick around and see if I can help anyone.
r3aper
Externalist
February 21st, 2009, 20:06
Quote:
[Originally Posted by arc_;79434]Externalist, that link seems broken?

What I do for debugging Delphi apps (and other native-compiled apps that use some kind of framework, e.g. MFC), is disassemble the target in IDA to have it recognize the Delphi library functions, export the names to a .map file, then import the map into Olly (using e.g. the MapConv plugin) and debug the target there. You may want to scout around in IDA first, looking for library functions that display modal dialogs (for nag screens) etc. and then set breakpoints on them in Olly.


Sorry for the belated reply! I'll post the entire topic here just for the people who haven't registered in the SND board and for archival purposes.

Quote:
[Originally Posted by SuperCRacker]Hi there, here are new tips how to deal with delphi apps.
I explain what we're gonna do. Sometimes when you click on a button you don't know where the program jumps exactly, or sometimes when you click on "about" you want to trace from the begining to see how the about dialog is shown (to look for "non registered" string for example).
Someone could say, use DeDe ... I say that sometimes it gives many errors, sometimes DeDe couldn't retrieve this info, takes much time to do it or even reports decompilation error. So why not see where this data is located??
I've coded a little delphi crackme so that we can apply out technique on it. (see download link below).
Let's go ... Tools needed : Your favorite hex editor (that's all ) I use HEdit.
We're going to remove the nag screen while clicking on the remove me button.
Easy generic steps to follow and you have exactly VA address when you click on the button.

1- Retrieve the name of the button (for example here we have "Remove next window nag"
2- Search for this string using your hex editor.
3- You'll find just after the string "OnClick" ... Retrieve the name after it (for example here "Button1Click"
4- Search for this string (for example here "Button1Click" and you will find one instance in the app.
5- 5 bytes before and you have your VA address.

Take a look to the screenshots attached to see how the work has been done.

Now of course you can put a bp on this VA address in olly .... Bingo !! it breaks exactly at the address. Now it's easy to remove the nag just return from the call you'll find a je, change it to a jnz or jmp and job is done.

Note that this technique can be applied for all sorts of events, not only for click events : for example (OnClick, OnMove, OnClose ,.....) . You can apply this also to Forms, Buttons, Edits, ListBoxs and all delphi items. It's why i named this topic Delphi events !!

That's all for this tip ...
Hope it is useful for you, and of course questions are welcome if something isn't clear ...

SC.


It's a simple method and you can automize it with any script language.
Cheers!
simonzack
February 22nd, 2009, 08:59
Quote:

(And I was already guessing the tuts4you page was for members only, though the specific error message made me think it was really broken.)

yeah, is disturbing me sometimes, guess i need to write a script for it