Matasano Chargen - Latest Comments in Rafal Wojtczuk’s User-Mode Single Stepping: 100x Faster Than Debuggers

Re: Rafal Wojtczuk’s User-Mode Single Stepping: 100x Faster Than Debuggers

arkon — Tue, 22 Jul 2008 14:45:58 -0000

Halvar,
in a way you're right, but if they implemented their tracer well, then 'call $+5' will result in the 'real' eip and thus your trick won't work.

Re: Rafal Wojtczuk’s User-Mode Single Stepping: 100x Faster Than Debuggers

Thomas Ptacek — Tue, 05 Dec 2006 11:55:50 -0000

Thanks, Jeremy.

Re: Rafal Wojtczuk’s User-Mode Single Stepping: 100x Faster Than Debuggers

jeremy — Mon, 04 Dec 2006 21:03:08 -0000

psst.. your last Detours link in the post points to the UMSS link.

Re: Rafal Wojtczuk’s User-Mode Single Stepping: 100x Faster Than Debuggers

Ryan Russell — Fri, 01 Dec 2006 02:38:53 -0000

Yeah, that's with Restore Breakpoints on. I don't like functions being left out of the chain I'm trying to follow, if I can help it. I need to look into how hard it will be to have a little more fine-grain control over which breakpoints you track. Obviously, it can be done since you can take one sample and exclude it, so it should just be some UI to twiddle those sets.

Re: Rafal Wojtczuk’s User-Mode Single Stepping: 100x Faster Than Debuggers

Thomas Ptacek — Fri, 01 Dec 2006 00:18:32 -0000

PaiMei shouldn't hit any breakpoint more than once in a run (at least in stalker mode), so a tight loop shouldn't be a problem.

Re: Rafal Wojtczuk’s User-Mode Single Stepping: 100x Faster Than Debuggers

Ryan Russell — Thu, 30 Nov 2006 18:57:14 -0000

Is it fast enough that I can still accidentally have it tracing through the message handler loop, and not kiss my process goodbye? 'Cause I can't seem to do that in Paimei.

Re: Rafal Wojtczuk’s User-Mode Single Stepping: 100x Faster Than Debuggers

Halvar — Thu, 30 Nov 2006 12:15:31 -0000

The question is the value for single stepping malicious code in a situation like:

call $+5
pop ebp
mov eax, [ebp+5]
cmp eax, 0xBADDEED
jnz you're tracing me

High speed is good of course, but single-steps
are usually only needed on truly nasty code,
and in truly nasty code heavy modification of
the target address space should be avoided.