Let's start with a simpler example. I made a simple "Hello World" program:
int main(int argc, char* argv[])
{
printf("Hello World!\n");
return 0;
}
I compile this program (Microsoft Visual C++ 6.0) to make hello.exe
I disassemble hello.exe using PE Explorer (a disassembler).
00401010 55 push ebp
00401011 8BEC mov ebp,esp
00401013 83EC40 sub esp,00000040h
00401016 53 push ebx
00401017 56 push esi
00401018 57 push edi
00401019 8D7DC0 lea edi,[ebp-40h]
0040101C B910000000 mov ecx,00000010h
00401021 B8CCCCCCCC mov eax,CCCCCCCCh
00401026 F3AB rep stosd
00401028 681C204200 push SSZ0042201C_Hello_World__
0040102D E82E000000 call SUB_L00401060
00401032 83C404 add esp,00000004h
00401035 33C0 xor eax,eax
00401037 5F pop edi
00401038 5E pop esi
00401039 5B pop ebx
0040103A 83C440 add esp,00000040h
0040103D 3BEC cmp ebp,esp
0040103F E89C000000 call SUB_L004010E0
00401044 8BE5 mov esp,ebp
00401046 5D pop ebp
00401047 C3 retn
(the full disassembly listing is 119269 lines long. This is the part I'm interested in.)
I run WinDbg. FILE -> OPEN EXECUTABLE, hello.exe:
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
CommandLine: "C:\Documents and Settings\Owner\My Documents\C++\hello\Debug\
Symbol search path is: *** Invalid ***
***********************
* Symbol loading may be unreliable without a symbol search path. *
* Use .symfix to have the debugger choose a symbol path. *
* After setting your symbol path, use .reload to refresh symbol locations. *
*************************
Executabl
ModLoad: 00400000 0042c000 hello.exe
ModLoad: 7c900000 7c9b2000 ntdll.dll
ModLoad: 7c800000 7c8f6000 C:\WINDOWS\system32\kernel
(948
eax=00241eb4 ebx=7ffd8000 ecx=00000000 edx=00000001 esi=00241f48 edi=00241eb4
eip=7c90120e esp=0012fb20 ebp=0012fc94 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
*** ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll -
ntdll!DbgBreakPoint:
7c901
0:000> .symfix
0:000> .reload
Reloading current modules
...
0:000> u
ntdll!DbgBreakPoint:
7c901
7c90120f c3 ret
7c901210 8bff mov edi,edi
ntdll!DbgUserBreakP
7c901
7c901213 c3 ret
7c901214 8bff mov edi,edi
ntdll!DbgBreakPoint
7c901216 8b442404 mov eax,dword ptr [esp+4]
ntdll!RtlpBreakWith
7c
0:000> k
ChildEBP RetAddr
0012fb1c 7c940442 ntdll!DbgBreakPoint
0012fc9
001
00000000 00000000 ntdll!KiUserApcDispatcher+
stack trace doesn't show my program
0:000> ~
. 0 Id: 948.1424 Suspend: 1 Teb: 7ffdf000 Unfrozen
I START STEPPING...
0:000> p
eax=00241eb4 ebx=7ffde000 ecx=00000000 edx=00000001 esi=00241f48 edi=00241eb4
eip=7c90120f esp=0012fb20 ebp=0012fc94 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!DbgBreak
7c90120f c3 ret
0:000> p
eax=00241eb4 ebx=7ffde000 ecx=00000000 edx=00000001 esi=00241f48 edi=00241eb4
eip=7c940442 esp=0012fb24 ebp=0012fc94 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202
ntdll!LdrpInit
7c940442 8b4368 mov eax,dword ptr [ebx+68h] ds:0023:7ffde068=00000070
0
eax=00000000 ebx=00000000 ecx=00005f00 edx=00241ebc esi=7ffde000 edi=7ffdd000
eip=7c9211ff esp=0012fc98 ebp=0012fd1c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!LdrpInit
7c9211ff c21400 ret 14h
0:000> p
eax=00000000 ebx=00000000 ecx=00005f00 edx=00241ebc esi=7ffde000 edi=7ffdd000
eip=7c9210af esp=0012fcb0 ebp=0012fd1c iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!_LdrpIni
7c9210
0:000> pt
eax=00000000 ebx=7ffde000 ecx=7c91b02a edx=7c90e514 esi=017df7b2 edi=0012fd30
eip=7c91b02a esp=0012fd20 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!_LdrpIni
7c91b0
0:000> p
eax=00000000 ebx=7ffde000 ecx=7c91b02a edx=7c90e514 esi=017df7b2 edi=0012fd30
eip=7c90e457 esp=0012fd30 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiUserAp
7c90
0:000> p
eax=00000000 ebx=7ffde000 ecx=7c91b02a edx=7c90e514 esi=017df7b2 edi=0012fd30
eip=7c90e459 esp=0012fd2c ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiUserAp
7c90
0:000> p
eax=00000000 ebx=7ffde000 ecx=7c91b02a edx=7c90e514 esi=017df7b2 edi=0012fd30
eip=7c90e45a esp=0012fd28 ebp=00000000 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiUserAp
7c90
0:000> p
eax=00000000 ebx=00000000 ecx=7c800000 edx=7c97e120 esi=7c90de6e edi=00000000
eip=7c90e514 esp=0012fe54 ebp=0012ff50 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSy
7c90e514
My program ran but I never managed to get into to my actual program. I want to somehow get to that assembly code I listed above that pushes "Hello World" and makes a call.
Main Topics
Browse All Topics





by: roman2Posted on 2009-08-08 at 22:13:16ID: 25052934
Hello,
You can keep track of loading modules (dlls), for example:
sxe ld:wshcon.dll
this command breaks execution before that module (wshcon.dll) will be loaded
WinDbg (cdb) has useful command "wt" for trace, but, I am not sure I understand what you want