Tracking Debugging Tips

Because the program control of the EIP eventually 0c0c0c0c, if not modified, the debugger will not stop when debugging, then very simple, directly to the 0c0c0c0c to FFFFFFFF can, so the debugger will find the program in the execution of illegal memory address instructions, will stop. When you stop, you can check the stack for clues. According to the principle of the function call, we can know that the instruction that overrides the EIP to be executed before FFFFFFFF should be a ret instruction, there must be a function called before the execution of this instruction, and this function is probably the function that eventually overflow, so there must be some return address in the upper part of the stack space that ESP points to. , then we can write down a few can return address, and then the next time the program loaded the address of the DLL file or EXE file to intercept, and put the breakpoint down to the address just below the previous instruction, then once broken down, there are two situations, the first case is that the stack has not been overwritten, Indicates that the overflow has not occurred, then as long as the single-step tracking carefully debugging, you can follow the overflow of the line of code, the second situation is that the stack has been overwritten, it means that several recorded suspicious address is incorrect, there is no overflow within these functions, it is necessary to continue in the stack after the overflow of the previous , the program must be disconnected before it overflows, because the program must have called a program before it overflows. The return address of this program is stored in the stack.

Tracking Debugging Tips