Re: [WinAppDbg-users] single stepping at RtlUserThreadStart

[Mario V. <mv...@gm...>]

Hi! Honestly, no idea. Sounds like the flags are being cleared. In any case
such aggressive single steppubg inside the operating system libraries is
bound to fail anyway for any reason... It's best to only do the debugging
within the target application rather than everything in the entire process.

Cheers,
-Mario

El miércoles, 17 de diciembre de 2014, Justin Kim <jus...@gm...>
escribió:

> Hi WinAppDbg, I am trying to single-step every instruction of all threads
> from process creation to process termination. My code is as following, and
> my problem is that it stops receiving single step events when it reaches
> ntdll!RtlUserThreadStart. Is this expected? Should I be missing some
> configuration perhaps? Cheers -- Justin
>
> Code:
> import sys
> from winappdbg import *
>
> class Taint(EventHandler):
>     def create_process(self, event):
>         module = event.get_process().get_main_module()
>         print "[+] Process created: %s" % module.fileName
>         print "[+] Thread #%d tracing enabled." % event.get_tid()
>         event.debug.start_tracing( event.get_tid() )
>
>     def exit_process(self, event):
>         print "[+] Process terminated."
>
>     def create_thread( self, event ):
>         print "[+] Thread #%d tracing enabled." % event.get_tid()
>         event.debug.start_tracing( event.get_tid() )
>
>     def single_step(self, event):
>         thread = event.get_thread()
>         pc = thread.get_pc()
>         tid = thread.get_tid()
>         instruction = thread.disassemble(pc, 0x10)[0]
>         address = instruction[0]
>         mnemonic = " ".join(instruction[2].split())
>         print "[T%d] 0x%08X: %s" % (tid, address, mnemonic)
>
> # main
> with Debug(Taint(), True) as debug:
>     debug.execv(sys.argv[1:], bFollow=True)
>     debug.loop()
>
>
> Output:
> ...
> [T120] 0x774DBA7B: mov dword [ss:esp+00000084h], 00000040h
> [ntdll!RtlTimeFieldsToTime+0x3ce]
> [T120] 0x774DBA86: mov dword [ss:esp+00000088h], 00000000h
> [ntdll!RtlTimeFieldsToTime+0x3d9]
> [T120] 0x774DBA91: mov dword [ss:esp+0000008Ch], 00000000h
> [ntdll!RtlTimeFieldsToTime+0x3e4]
> [T120] 0x774DBA9C: call 774BBFC0h [ntdll!ZwQueryAttributesFile]
> [T120] 0x774BBFC0: mov eax, 0000003Ch [ntdll!ZwQueryAttributesFile]
> [T120] 0x774BBFC5: call dword [fs:000000C0h]
> [ntdll!ZwQueryAttributesFile+0x5]
> [T120] 0x774711D8: jmp far 0033h : 774721A4h [0x774711d8]
> [T120] 0x774BDE3C: mov dword [ss:esp+04h], eax [ntdll!RtlUserThreadStart]
> [+] Process terminated.
>
>

-- 
“There's a reason we separate military and the police: one fights the enemy
of the state, the other serves and protects the people. When the military
becomes both, then the enemies of the state tend to become the people.”