search

Cisco-Talos / CASC

GNU General Public License v2.0
43 stars 16 forks source link

Masking instructions in dynamic memory (during a debugging session) #24

Open recvfrom opened 5 years ago

recvfrom commented 5 years ago

I was trying to write a signature based on some shellcode written to the heap during a debugging session:

debug054:005F18AE mov     dword_FFFFFFD8[ebp], 50746547h
debug054:005F18B5 mov     dword_FFFFFFDC[ebp], 41636F72h
debug054:005F18BC mov     dword_FFFFFFE0[ebp], 65726464h
debug054:005F18C3 mov     dword_FFFFFFE4[ebp], 7373h

Highlighting this and right-clicking on "Add Assembly to CASC" at first resulted in the error Address range is not within the sample segments. Trying again resulted in the instructions appearing to populate the CASC screen correctly, but I exited out. Trying again resulted in IDA crashing.

It'd be cool if this were supported, although I'm sure it would complicate things given that after the debugging session the addresses stored would be invalid.