PDA

View Full Version : Ollydebug with threads and exec


rwartell
July 21st, 2010, 17:33
I'm looking for some advice on two fronts. I have two different programs I'm trying to debug with ollydebug.

The first is a web server. Obviously this program is multithreaded, which causes my problem. The client thread works fine (the window that pops up with options), but the server side thread is crashing and I'd like to debug it. However, when I'm attempting to trace through the program, it stays with the client side thread that works fine, so I'm unable to see what's happening with the server thread that's crashing it. Anyone that can give me some advice how to trace through the server thread would be much appreciated.

The second program that I'm trying to debug is an executable that is executed via exec from another program. I'm not sure how to trace a program that is being called from exec. Anyone that can help with that problem would be much appreciated.

Thanks in advance.

dELTA
July 24th, 2010, 17:59
To debug the server thread, just find a breakpoint anywhere inside its code, and you will then land in its context and thread inside the debugger as soon as it executes. Alternatively, find the actual CreateThread call that creates the thread (if it's not pooled), and breakpoint that and go from there.

As for the "exec" call, I assume we are talking about the PHP function "exec"? There are gazillions of ways to do that, but one suggestion would be to patch a "spin loop" at the entrypoint of that executable on disk, then attach to it once it's running, set suitable breakpoints and then restore the loop patch and let it run. You could also breakpoint CreateProcess (or whatever API is used) inside php.exe and take it from there, e.g. by modifying the parameters to create the process in suspended state.