Re: [WinAppDbg-users] single stepping at RtlUserThreadStart

[John H. <jo...@ca...>]

Are you actually holding the main thread while the sub thread finishes execution? If you “start” the thread, then the main thread exits, you’ll probably never see the child thread start because the application exits before the thread gets a chance to start. You’d have to hold the main thread open until the child thread finishes its work.

John


From: Mario Vilas [mailto:mv...@gm...]
Sent: Wednesday, December 17, 2014 9:51 AM
To: win...@li...
Subject: Re: [WinAppDbg-users] single stepping at RtlUserThreadStart

Hi! Honestly, no idea. Sounds like the flags are being cleared. In any case such aggressive single steppubg inside the operating system libraries is bound to fail anyway for any reason... It's best to only do the debugging within the target application rather than everything in the entire process.

Cheers,
-Mario

El miércoles, 17 de diciembre de 2014, Justin Kim <jus...@gm...<mailto:jus...@gm...>> escribió:
Hi WinAppDbg, I am trying to single-step every instruction of all threads from process creation to process termination. My code is as following, and my problem is that it stops receiving single step events when it reaches ntdll!RtlUserThreadStart. Is this expected? Should I be missing some configuration perhaps? Cheers -- Justin

Code:
import sys
from winappdbg import *

class Taint(EventHandler):
    def create_process(self, event):
        module = event.get_process().get_main_module()
        print "[+] Process created: %s" % module.fileName
        print "[+] Thread #%d tracing enabled." % event.get_tid()
        event.debug.start_tracing( event.get_tid() )

    def exit_process(self, event):
        print "[+] Process terminated."

    def create_thread( self, event ):
        print "[+] Thread #%d tracing enabled." % event.get_tid()
        event.debug.start_tracing( event.get_tid() )

    def single_step(self, event):
        thread = event.get_thread()
        pc = thread.get_pc()
        tid = thread.get_tid()
        instruction = thread.disassemble(pc, 0x10)[0]
        address = instruction[0]
        mnemonic = " ".join(instruction[2].split())
        print "[T%d] 0x%08X: %s" % (tid, address, mnemonic)

# main
with Debug(Taint(), True) as debug:
    debug.execv(sys.argv[1:], bFollow=True)
    debug.loop()


Output:
...
[T120] 0x774DBA7B: mov dword [ss:esp+00000084h], 00000040h [ntdll!RtlTimeFieldsToTime+0x3ce]
[T120] 0x774DBA86: mov dword [ss:esp+00000088h], 00000000h [ntdll!RtlTimeFieldsToTime+0x3d9]
[T120] 0x774DBA91: mov dword [ss:esp+0000008Ch], 00000000h [ntdll!RtlTimeFieldsToTime+0x3e4]
[T120] 0x774DBA9C: call 774BBFC0h [ntdll!ZwQueryAttributesFile]
[T120] 0x774BBFC0: mov eax, 0000003Ch [ntdll!ZwQueryAttributesFile]
[T120] 0x774BBFC5: call dword [fs:000000C0h] [ntdll!ZwQueryAttributesFile+0x5]
[T120] 0x774711D8: jmp far 0033h : 774721A4h [0x774711d8]
[T120] 0x774BDE3C: mov dword [ss:esp+04h], eax [ntdll!RtlUserThreadStart]
[+] Process terminated.



--
“There's a reason we separate military and the police: one fights the enemy of the state, the other serves and protects the people. When the military becomes both, then the enemies of the state tend to become the people.”