Log in

View Full Version : Alright, what is DbgBreakPoint()?


qwerty
July 19th, 2006, 11:53
So I run calc.exe and attach to thise process with OllyDBG.

When I do, I find myself in ntdll's DbgBreakPoint() at a RETN instruction.

Continuing, I find myself still in ntdll at a JUMP Short. Then there's an or instruction, a push instruction, and a call to RtlExitUserThread(). Game over, wtf?

The most detail I could find about DbgBreakPoint() is "This routine raises an exception that is handled by the kernel debugger if one is installed; otherwise it is handled by the debug system. If no debugger is connected to the system, the exception can be handled in the standard way."

I've read and understand all the basic debugging concepts out there, but I'm having a hard time finding hard tech details about how debug registers and interrupts are used when:

1) attaching to a process
2) running the process from the debugger
3) user mode vs. kernel mode debugging
4) DbgBreakPoint()

Any advice appreciated, thanks!

JMI
July 19th, 2006, 12:14
So broaden your search criteria and try the following:

DbgBreakPoint() microsoft

DbgBreakPoint attach to process

debug registers and interrupts attach to process

debug registers and interrupts running the process from the debugger

debug registers and interrupts user mode vs. kernel mode debugging

debug registers and interrupts DbgBreakPoint()

There certainly appear to be some "hard technical detail" among the many hits each of those search criteria produce.

You might also find something useful in this Thread HERE:

http://www.woodmann.com/forum/showthread.php?p=40349#.

And, of course, there are several debugging books available on the web.

Regards,

naides
July 19th, 2006, 12:22
Disclaimer: I do not have the foggiest idea what is going on, but

I reproduced what you say in my system: The problem occurs when you ATTACH calc.exe, notepad.exe, wordpad.exe . . . if you OPEN the process with olly, things go smooth.

The calc.exe (or notepad.exe, worrpad.exe) process continues to be present in memory, but its thread is suspended.

This does not happen in regular apps that load at RVA 400000 All these accessory progs share the feature of loading at the 10000000 memory block.

??

blabberer
July 19th, 2006, 13:56
start -> run -> calc.exe
cd "ollydbg path" ollydbg.exe
file attach calc.exe
f9

seems to work without problems here
Code:

Call stack of main thread
Address Stack Procedure / arguments Called from Frame
0007FDE0 77D491BE Includes ntdll.KiFastSystemCallRet USER32.77D491BC 0007FDFC
0007FDE4 77D491F1 USER32.77D491B2 USER32.77D491EC 0007FDFC
0007FE00 010021B0 Includes USER32.77D491F1 calc.010021AE 0007FDFC
0007FF20 010125E9 calc.01001F51 calc.010125E4 0007FF1C

deroko
July 19th, 2006, 15:53
Quote:
[Originally Posted by naides]
I reproduced what you say in my system: The problem occurs when you ATTACH calc.exe, notepad.exe, wordpad.exe . . . if you OPEN the process with olly, things go smooth.


isn't problem, 1st break in debugged process is DbgBreakPoint, to cehck this you may go to "Options -> Event -> System Break" in olly, run app and you will break at DbgBreakPoint when you open process in olly

naides
July 19th, 2006, 16:11
OK. All attached processes pause at DbgBreakPoint in NtDll. . .
that is not the issue.

But all other attached applications (Hiew.exe for instance) will continue to run, seamlessly, if you press F9.
Calc, notepad and Worpad hang, remain suspended even after go push run(F9), or trace until exit process .

That is what I find unusual.

goggles99
July 19th, 2006, 17:07
That does not happen for me (tried several times)
I have occasionally seen this happen when attaching to newer high memory/CPU intensive FPS games.

Can you resume the calc thread in the threads window? (I don't believe I was able to when this has happened to me)

Perhaps just an Olly bug? Interesting that it is consistent for you. Try renaming your plugins folder so that none are loaded. I find most problems with Olly come from Plug-Ins that I have loaded.

naides
July 19th, 2006, 17:24
Add On:

I am at my home computer right now, A differerent CPU (AMD64) different OS, and the described problem does not happen when I try to attach the processes. The calc.exe and other Accessories do run fine after attachment.

So, I dunno.

SiGiNT
July 20th, 2006, 01:32
uh huh, but if you pause the program and step thru the code - what is occuring is an invalid address is loaded into EDX at 77D491B7 in user32.dll - game over when that illegal address is read a line or 2 later.

SiGiNT

LLXX
July 20th, 2006, 02:59
Quote:
[Originally Posted by blabberer]start -> run -> calc.exe
cd "ollydbg path" ollydbg.exe
file attach calc.exe
...and then OllyDbg just hangs after attaching, on my system. I have to kill it from the taskmgr.

Windows XP 5.1.2600
OllyDbg 1.10
Intel Pentium IV HT 4.17GHz

Ricardo Narvaja
July 20th, 2006, 03:41
When you attach with ollydbg you need use a new opened ollydbg (fresh), not a olly used in other session of debugging and restarted, i donīt know why,but with an used ollydbg there are random problems while attaching a program.
There are antiattack code too you can check the tool POKEMON, for quit the antiattach protections.
Ricardo Narvaja

blabberer
July 20th, 2006, 04:09
i dont know why i cant get all these nifty problems to poke around i tried on a different computer xp-sp2 and it runs as if it never had any problems in its life

Code:


New session
File 'C:\WINDOWS\System32\calc.exe'
New process with ID 000005E0 created
Main thread with ID 00000730 created
77F97077 New thread with ID 0000039C created
01000000 Module C:\WINDOWS\System32\calc.exe
5AD70000 Module C:\WINDOWS\System32\UxTheme.dll
71950000 Module C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
772D0000 Module C:\WINDOWS\system32\SHLWAPI.dll
773D0000 Module C:\WINDOWS\system32\SHELL32.dll
77C10000 Module C:\WINDOWS\system32\msvcrt.dll
77C70000 Module C:\WINDOWS\system32\GDI32.dll
77CC0000 Module C:\WINDOWS\system32\RPCRT4.dll
77D40000 Module C:\WINDOWS\system32\USER32.dll
77DD0000 Module C:\WINDOWS\system32\ADVAPI32.dll
77E60000 Module C:\WINDOWS\system32\kernel32.dll
77F50000 Module C:\WINDOWS\System32\ntdll.dll
77F7F570 Attached process paused at ntdll.DbgBreakPoint
Thread 0000039C terminated, exit code 0
Analysing calc
158 heuristical procedures
273 calls to known, 167 calls to guessed functions
91 loops, 22 switches
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 127.
hControl = 002501EE ('3',class='Button',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
77E802F4 New thread with ID 000004A0 created
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_SETFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_KILLFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 92.
hControl = 002601BA ('+',class='Button',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_SETFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_KILLFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 127.
hControl = 002501EE ('3',class='Button',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_SETFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_KILLFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 112.
hControl = 003901AE ('=',class='Button',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_SETFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_KILLFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = MENU/BN_CLICKED... ID = 81.
hControl = 001E0182 ('C',class='Button',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_SETFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = BN_PAINT/LBN_SELCHANGE/CBN_SELCHANGE/ACCELERATOR... ID = 129.
hControl = NULL
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = BN_PAINT/LBN_SELCHANGE/CBN_SELCHANGE/ACCELERATOR... ID = 92.
hControl = NULL
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = BN_PAINT/LBN_SELCHANGE/CBN_SELCHANGE/ACCELERATOR... ID = 130.
hControl = NULL
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = BN_PAINT/LBN_SELCHANGE/CBN_SELCHANGE/ACCELERATOR... ID = 112.
hControl = NULL
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_UPDATE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_CHANGE... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
01006118 CALL to Assumed WinProc from USER32.77D43A5C
hWnd = 0012026C ('Calculator',class='SciCalc')
Message = WM_COMMAND
Notify = EN_KILLFOCUS... ID = 403.
hControl = 00300250 (class='Edit',parent=0012026C)
Thread 000004A0 terminated, exit code 2A (42.)
Process terminated, exit code 0
01000000 Unload C:\WINDOWS\System32\calc.exe
5AD70000 Unload C:\WINDOWS\System32\UxTheme.dll
71950000 Unload C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
772D0000 Unload C:\WINDOWS\system32\SHLWAPI.dll
773D0000 Unload C:\WINDOWS\system32\SHELL32.dll
77C10000 Unload C:\WINDOWS\system32\msvcrt.dll
77C70000 Unload C:\WINDOWS\system32\GDI32.dll
77CC0000 Unload C:\WINDOWS\system32\RPCRT4.dll
77D40000 Unload C:\WINDOWS\system32\USER32.dll
77DD0000 Unload C:\WINDOWS\system32\ADVAPI32.dll
77E60000 Unload C:\WINDOWS\system32\kernel32.dll
77F50000 Unload C:\WINDOWS\System32\ntdll.dll
End of session


SiGiNT
July 20th, 2006, 09:14
I suspect, (just a gut feeling), that a recent M$ XP patch may be dicking around with olly, I've noticed during the past 2-4 wks. all of a sudden every time I try to use run trace every target I've tried it on terminates, I'll have to dig out an old target where Im sure it works and see what happens.

SiGiNT

LLXX
July 20th, 2006, 15:06
Quote:
[Originally Posted by Ricardo Narvaja]When you attach with ollydbg you need use a new opened ollydbg (fresh), not a olly used in other session of debugging and restarted, i donīt know why,but with an used ollydbg there are random problems while attaching a program.
There are antiattack code too you can check the tool POKEMON, for quit the antiattach protections.
Ricardo Narvaja
Yes, fresh olly. I did the test above immediately after rebooting the system.

Ricardo Narvaja
July 20th, 2006, 16:39
try pokemon anti-attach. Before attach, open pokemon, search for the process to attach and clean protections anti-attach

http://storage.ricardonarvaja.com.ar/web/OTROS/HERRAMIENTAS/L-M-N-O-P/POKEMON%20AntiAttach.exe

Ricardo Narvaja

qwerty
July 25th, 2006, 13:10
Quote:
[Originally Posted by Ricardo Narvaja]try pokemon anti-attach. Before attach, open pokemon, search for the process to attach and clean protections anti-attach

http://storage.ricardonarvaja.com.ar/web/OTROS/HERRAMIENTAS/L-M-N-O-P/POKEMON%20AntiAttach.exe

Ricardo Narvaja


Nobody wants to download and run a binary, source available?

JMI
July 25th, 2006, 13:20
You, of course, are free to do as you wish, but if you do not wish to trust Ricardo, you probably are on the wrong site and should go code your own resources.

Regards,

Ricardo Narvaja
July 25th, 2006, 17:10
You or nodody?

talk for you, i download hundred of binaries from here or exetools without problem, and if i want, i run in vmware, but pokemon is a good tool made for a crackslatinos member, and is very good against antiattach protections.

you are free to download or not, i publish for all RCE members not only for you.

Ricardo

JMI
July 25th, 2006, 17:12
It's OK Ricardo. I already slapped him.

Regards,