Log in

View Full Version : Attach to process freezes the debugger

LaptoniC
February 25th, 2010, 05:42
I am trying to debug an application but there are some problems. It is not packaged or crypted. It is written in Delphi. However if I try to open with debugger directly, it stops in one exception and can't continue. I tried with AntiDebug plugins of OllyDbg and it is still same. If I try to attach running process, After I attach, ollydbg just hangs. It doesn't load the DLL's etc. I tried with OllyDbg, IDA's debugger result is same. I tried on XP and Windows 7, still the same thing. I tried to use Syser Debugger unfortunately it doesn't support Windows 7.(BSOD) I tried with Virtual PC under Windows 7, it restarts the VPC. I don't want to install Windows XP just to debug that program. What you can suggest for a debugger ? What could be the reason for hanging debuggers? Thanks.
evlncrn8
February 25th, 2010, 09:46
possibly some custom code which adjusts the PEB which can kill olly... that'd be my first guess
disavowed
February 25th, 2010, 16:26
Quote:
[Originally Posted by LaptoniC;85436]However if I try to open with debugger directly, it stops in one exception and can't continue.

Set OllyDbg to ignore all exceptions.
LaptoniC
February 25th, 2010, 20:40
I tried to ignore every exception, that is why it hangs. If I don't ignore it stops at EEDFADE exception and there is no way to go. Anyway I just patched to program to show me the values I need. It turns out that program was using hardcoded MD5 strings in the program. MD5(Input) must be equal to hardcoded ones. So for me this program is no more. I can patch hardcoded values to the one I like and it is over. Thanks.
naides
February 26th, 2010, 06:48
There is a crack in everything. . .
Darkelf
February 26th, 2010, 07:27
For me, the interesting part would be WHY debuggers show this behavior.
Maybe one day you come across a program, which is not patchable that easy and debuggers are acting strange again - then the knowledge you could gain by examine your recently patched program will be invaluable.
LaptoniC
February 28th, 2010, 00:07
The problem is I can't. If anybody is interested, you can PM for the name of the program.
LOPAN
March 2nd, 2010, 17:15
Have you tried the IDA Stealth plugin? It has solved most of the anti-debugging issues for me.
LaptoniC
March 3rd, 2010, 04:47
I tried and still the same. If I try to run with debugger, it hangs in an exception.If I try to attach it hangs again. I don't know maybe this program isn't using any antidebug tricks. It is a spy program which hooks keyboard and other stuff. Maybe those hook DLL files causing problems. I really don't know.