Softice newbie, packed win32 exe question.

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Vinay (devnull001_at_fastmail.fm)
Date: 09/23/04 

Date: 23 Sep 2004 00:52:41 -0700

(First off, I need this towards malware analysis, not cracking s/w
protection.)

I have only recently started using SI. I need to use a plug-in that
works only for SI (for an unpacking+reverse engineering project). I
have an exe packed with UPX compression. I could step through it
easily using Visual Studio and some other debuggers. However, I simply
can't get SI to break at the PE entry-point 0x40xxxx address at all. I
loaded it through the Symbol Loader which first complains that it has
no debug info - which is fine. Then it immediately executes the binary
without breaking at the entry-point - how do I break it at that entry
point? (I could perhaps break it at some API calls later in the
process' execution, but I really need to break at the entry point of
the PE exe file, not later). This process works just fine with the
unpacked version of the exe - it correctly drops into SI saying
"breakpoint by symbol loader".

Also, I couldn't find any equivalent of "pause", "continue" and
"restart" in SI (yet, and I looked quite hard in the docs).. how do I
do these?

I have spent several hours searching on Google/SI docs for info, but
couldn't find any yet.. and decide to post on a few Win32 groups.

Do let me know if you do..

Thanks a lot in advance!

Vinay.

Relevant Pages

  • Softice newbie, packed Win32 exe debug question.
    ... have an exe packed with UPX compression. ... Then it immediately executes the binary ... without breaking at the entry-point - how do I break it at that entry ... I have spent several hours searching on Google/SI docs for info, ...
    (comp.lang.asm.x86)
  • Re: Invoking Console Applications Program.Main from another project
    ... Is it possible to invoke the entry point of a console application project from another project. ... do I have to invoke the associated exe as per the post below ... initialization to happen, but it might not; ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: using exe as dll
    ... >It is possible to export functions out of exe and then use it as ... >dll.What are the potential problems? ... the initial entry point goes instead to main or ... Thus, although you CAN load an executable as a DLL, as soon ...
    (microsoft.public.win32.programmer.kernel)
  • Re: Compile Problems
    ... You can also open the exe in notepad - near the top of the file is an entry ... know is that it isnt a .NET version as some of the functions, ...
    (microsoft.public.vb.general.discussion)
  • Re: Using AttachConsole() to run GUI app in command prompt console
    ... After we discussed in your previous post, my thought truns to the entry point of an .exe. ... Microsoft Online Partner Support ...
    (microsoft.public.win32.programmer.kernel)