Results 1 to 13 of 13

Thread: Attach Extended

Hybrid View

  1. #1

    Attach Extended

    Hi all
    This is a really small plugin that I have written for improving attach feature of OllyDbg.
    With this plugin,you can attach to process by identifing its PID directly,not only selecting process list. In addition,you can find PID of process by dragging a small cursor on each window(This can be used on some protection which remove process from process list like GameGuard).

    Please let me know about Bugs, and your suggestions for more process attaching options.

    Regards
    Attached Files Attached Files
    I should look out my posts,Or JMI will get mad at me! ;)

  2. #2
    A possible extra feature would be anti-anti-attach. There are various ways a protection system can detect and even prevent a debugger attaching to it, and there are also various ways to counter these tricks. You could look into this subject and automate the countermeasures in your plugin, completely transparently (ie the plugin simply kills/circumvents any anti-attach when attaching, without the reverser even having to know there was an anti-attach at all).

    nezumi documents some interesting techniques in the Blogs forum. There also exists a plugin called AttachAnyway which kills some anti-attach methods, but not all.

  3. #3
    Administrator dELTA's Avatar
    Join Date
    Oct 2000
    Location
    Ring -1
    Posts
    4,204
    Blog Entries
    5
    Hey Hero, can it attach to (not yet ResumeThread'ed) processes created with the CREATE_SUSPENDED flag, unlike normal Olly? That would be really great...
    "Give a man a quote from the FAQ, and he'll ignore it. Print the FAQ, shove it up his ass, kick him in the balls, DDoS his ass and kick/ban him, and the point usually gets through eventually."

  4. #4
    Quote Originally Posted by arc_ View Post
    nezumi documents some interesting techniques in the Blogs forum. There also exists a plugin called AttachAnyway which kills some anti-attach methods, but not all.
    I will try to read it in blog,and add it to this plugin on my free time.

    Quote Originally Posted by dELTA View Post
    Hey Hero, can it attach to (not yet ResumeThread'ed) processes created with the CREATE_SUSPENDED flag, unlike normal Olly? That would be really great...
    hmmmm
    I think this will be a good feature too,but is it possible in theory at all?
    If process has started in debug mode,in addition of suspended mode,i think we cannot attach it,because as I know we cannot debug a process which is debugged. But perhaps it is possible on a non-debugging suspended creation process.
    I should test if I can attach to a suspended process at all,if yes I surely add it.

    Regards
    Last edited by Hero; March 4th, 2009 at 15:35.
    I should look out my posts,Or JMI will get mad at me! ;)

  5. #5
    Administrator dELTA's Avatar
    Join Date
    Oct 2000
    Location
    Ring -1
    Posts
    4,204
    Blog Entries
    5
    It should absolutely be possible (from a Debug API viewpoint) to attach to a process created with the CREATE_SUSPENDED flag, it's just a bug in Olly that it can't do it I think.

    It would indeed be great if you could add it.

    I also added it to the CRCETL, please feel free to update its entry as soon as you release an update (and also specify the version number, which I left out because I didn't know it):

    http://www.woodmann.com/collaborative/tools/index.php/AttachExtended
    "Give a man a quote from the FAQ, and he'll ignore it. Print the FAQ, shove it up his ass, kick him in the balls, DDoS his ass and kick/ban him, and the point usually gets through eventually."

  6. #6
    Quote Originally Posted by dELTA View Post
    It should absolutely be possible (from a Debug API viewpoint) to attach to a process created with the CREATE_SUSPENDED flag, it's just a bug in Olly that it can't do it I think.

    It would indeed be great if you could add it.

    I also added it to the CRCETL, please feel free to update its entry as soon as you release an update (and also specify the version number, which I left out because I didn't know it):

    http://www.woodmann.com/collaborative/tools/index.php/AttachExtended
    Hi dELTA
    I checked olly and noticed that it cannot attach to a suspended process because DebugActiveProcess fails.
    Further check shows that in DebugActiveProcess fails at DbgUiConnectToDbg in this line:
    Code:
    .text:7C950691                 xor     ecx, ecx
    .text:7C950693                 mov     eax, large fs:18h
    .text:7C950699                 cmp     [eax+0F24h], ecx
    .text:7C95069F                 jnz     short loc_7C9506D5 <-this jump occurs
    As I remembr,FS:18h contains information for thread,isn't it? Anybody knows what is that data in [eax+0f24h] for?

    Edit1: I was WRONG, because after testing on another computer,I noticed that problem is not here,don't know why my other PC was failing here,but it seems I was wrong.
    Edit2:Found a bug in olly which prevents to attach suspended process. Trying to solve it now(donna if it there is more bug,but this one is sure) :P

    Regards
    Last edited by Hero; March 5th, 2009 at 12:27.
    I should look out my posts,Or JMI will get mad at me! ;)

Similar Threads

  1. IDA: Attach to Process -> Menu deactivated
    By Drigo in forum Tools of Our Trade (TOT) Messageboard
    Replies: 1
    Last Post: May 14th, 2009, 00:31
  2. Extended Precision representation
    By r3aper in forum The Newbie Forum
    Replies: 2
    Last Post: March 19th, 2009, 00:03
  3. Attach to process WITHOUT stopping
    By w00b in forum OllyDbg Support Forums
    Replies: 6
    Last Post: February 2nd, 2008, 11:38
  4. Unable to Attach to Process
    By Anonymous in forum OllyDbg Support Forums
    Replies: 11
    Last Post: October 1st, 2003, 19:33
  5. Attach
    By Anonymous in forum OllyDbg Support Forums
    Replies: 6
    Last Post: February 19th, 2003, 16:24

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •