Home » Forums » Other Projects

IDA Stealth Plugin

I spent some hours to make this work , but I giv'it up . The server debugger IDAStealthRemote.exe allways show :

Accepted connection from 192.168.3.100
Error while handling connection: End of file

What I did wrong ?
I've tested with IDA 5.5 and 5.2 , and with stealth plugin v1.2.
Port is setup on 4242 in plugin.

What are the exact steps to do ? I made all the readme file says.

Thanks

‹ [NCodeHook] significance of 0x7FFF0000 N-InjectLib and N-CodeHook simple example ›
Submitted by Anonymous on Wed, 12/23/2009 - 23:49

Home » IDA Stealth Plugin Reply to comment IDA Stealth Plugin

Submitted by jan newger on Thu, 12/24/2009 - 00:13.

Hi,

are you using the latest version of both, IDA plugin and remote server? Unfortunately, I'm unable to reproduce the problem here. Is the port on the server unblocked in the windows firewall?
I suppose standard remote debugging using IDA alone does work?

IDAStealth fetches the remote debugger settings automatically so there is actually no further setup required. Are you running the server component on a virtual machine? I'm using VMWare with bridged network and it works. However, I can't think of a reason why the network settings should make any difference.

I can't reproduce your issue here, so you might want to compile the remote stealth server by yourself and debug it with VS.

At the moment I've no better idea - sorry

»

Thinking ...

Submitted by adixtx (not verified) on Thu, 12/24/2009 - 17:11.

Maybe I missunderstood the way this plugin works.
I setup IDA in Debugger menu -> Remote debug , and I setup the remote host and filled in the port 4242.
In fact I dont have to make this setup because your debug server handles only specific exception , and I think I must leave debugger setup to "local win32 debugger" (in case I dont use a remote debug server like win32_remote.exe) .
Am I right ?
Can you send me a litle .exe file to debug it ,wich will show me the plugin actualy works (some activity in stealth debugg server window) ?

»

IDAStealth Remote Debugging

Submitted by jan newger on Sun, 12/27/2009 - 01:59.

Hi,

it seems you're confusing IDA remote debugging with the IDAStealth remote server.
You need to configure IDA for remote debugging as usual:

  1. Fire up win32_remote.exe at the server side.
  2. In IDA itself, set the correct process options, enter the IP of the server and the corresponding port used by the debugging server (default: 23946).
  3. Start IDAStealthRemote.exe, and, if you specified a non-default port, modify it in the IDAStealth GUI.
  4. Finally, set all your stealth options and hit F9 to start remote debugging.

That's it.
If this still doesn't work, pls let me know

»
© 2010 newgre.net // jan newger