<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Nic&#039;s Blog &#187; debugging</title>
	<atom:link href="http://nicbedford.co.uk/tag/debugging/feed/" rel="self" type="application/rss+xml" />
	<link>http://nicbedford.co.uk</link>
	<description>Where my thoughts on life, the universe and everything trickle onto the internet…</description>
	<lastBuildDate>Sat, 31 Dec 2011 23:59:41 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>CHimpREC x64</title>
		<link>http://nicbedford.co.uk/2008/06/27/chimprec-x64/</link>
		<comments>http://nicbedford.co.uk/2008/06/27/chimprec-x64/#comments</comments>
		<pubDate>Fri, 27 Jun 2008 09:17:54 +0000</pubDate>
		<dc:creator>Nic</dc:creator>
				<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[debugging]]></category>
		<category><![CDATA[x64]]></category>

		<guid isPermaLink="false">http://nicbedford.co.uk/?p=98</guid>
		<description><![CDATA[My x64 tool bag continues to grow with this new import reconstructing tool created by TiGa (Sébastien Doucet) and demo&#8217;d at the RECon 2008 event. You can read more about this new tool and grab yourself a copy at the Collaborative RCE Tool Library. Also you can download the video of TiGa&#8217;s RECon session on [...]]]></description>
			<content:encoded><![CDATA[<p>My x64 tool bag continues to grow with this new import reconstructing tool created by TiGa (Sébastien Doucet) and demo&#8217;d at the <a href="http://recon.cx/2008/">RECon 2008</a> event. You can read more about this new tool and grab yourself a copy at the <a href="http://www.woodmann.com/collaborative/tools/index.php/CHimpREC">Collaborative RCE Tool Library</a>. Also you can download the video of TiGa&#8217;s RECon session on x64 unpacking <a href="http://www.recon.cx/2008/speakers.html#i64bitunpacking">here</a> and see the tool in use.</p>
<p><a href="http://nbedford.net78.net/wordpress/wp-content/uploads/2008/06/chimprec.jpg" rel="lightbox[98]"><img class="alignnone size-medium wp-image-99" title="CHimpREC x64" src="http://nbedford.net78.net/wordpress/wp-content/uploads/2008/06/chimprec-300x225.jpg" alt="" width="300" height="225" /></a></p>
]]></content:encoded>
			<wfw:commentRss>http://nicbedford.co.uk/2008/06/27/chimprec-x64/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Reflector + Deblector + x64 = 0x80131C30</title>
		<link>http://nicbedford.co.uk/2008/06/24/reflector-deblector-x64-0x80131c30/</link>
		<comments>http://nicbedford.co.uk/2008/06/24/reflector-deblector-x64-0x80131c30/#comments</comments>
		<pubDate>Tue, 24 Jun 2008 11:48:29 +0000</pubDate>
		<dc:creator>Nic</dc:creator>
				<category><![CDATA[Reverse Engineering]]></category>
		<category><![CDATA[.net]]></category>
		<category><![CDATA[debugging]]></category>
		<category><![CDATA[x64]]></category>

		<guid isPermaLink="false">http://nicbedford.co.uk/?p=94</guid>
		<description><![CDATA[I was trying to debug a problem the other day and I set out using Lutz Roeder&#8217;s excellent Reflector for .NET tool, along with Deblector, an addin for debugging within Reflector. I loaded my target into Reflector and started the debugging addin and up popped the following dialog. Now this dialog contains a lot of [...]]]></description>
			<content:encoded><![CDATA[<p>I was trying to debug a problem the other day and I set out using Lutz Roeder&#8217;s excellent <a href="http://www.aisto.com/roeder/dotnet/">Reflector for .NET</a> tool, along with <a href="http://www.codeplex.com/deblector">Deblector</a>, an addin for debugging within Reflector. I loaded my target into Reflector and started the debugging addin and up popped the following dialog.</p>
<p><a href="http://nbedford.net78.net/wordpress/wp-content/uploads/2008/06/mdbg.jpg" rel="lightbox[94]"><img class="alignleft size-medium wp-image-95" title="MDbg Critical Failures" src="http://nbedford.net78.net/wordpress/wp-content/uploads/2008/06/mdbg-300x300.jpg" alt="" width="300" height="300" /></a>Now this dialog contains a lot of information, but to be honest it kind of overwhelmed me and didn&#8217;t really give me any good feeling about what had actually gone wrong. Obviously it was related in some way to MDbg, the managed debugger used by Reflector. So I pulled down the <a href="http://www.microsoft.com/downloads/details.aspx?familyid=38449a42-6b7a-4e28-80ce-c55645ab1310&amp;displaylang=en">Managed Debugger Sample</a> and the Deblector source and set about trying to figure what had really gone wrong. Anyway I tracked this dialog down to the following piece of code</p>

<div class="wp_syntax"><div class="code"><pre class="csharp" style="font-family:monospace;"><span style="color: #0600FF; font-weight: bold;">private</span> <span style="color: #6666cc; font-weight: bold;">void</span> DebuggerErrorEventHandler<span style="color: #008000;">&#40;</span><span style="color: #6666cc; font-weight: bold;">Object</span> sender, CorDebuggerErrorEventArgs e<span style="color: #008000;">&#41;</span>
<span style="color: #008000;">&#123;</span>
    Trace<span style="color: #008000;">.</span><span style="color: #0000FF;">WriteLine</span><span style="color: #008000;">&#40;</span><span style="color: #666666;">&quot;ManagedCallback::DebuggerError&quot;</span><span style="color: #008000;">&#41;</span><span style="color: #008000;">;</span>
    <span style="color: #0600FF; font-weight: bold;">if</span> <span style="color: #008000;">&#40;</span>InternalHandleRawMode<span style="color: #008000;">&#40;</span>ManagedCallbackType<span style="color: #008000;">.</span><span style="color: #0000FF;">OnDebuggerError</span>, e<span style="color: #008000;">&#41;</span><span style="color: #008000;">&#41;</span>
        <span style="color: #0600FF; font-weight: bold;">return</span><span style="color: #008000;">;</span>
&nbsp;
    e<span style="color: #008000;">.</span><span style="color: #0600FF; font-weight: bold;">Continue</span> <span style="color: #008000;">=</span> <span style="color: #0600FF; font-weight: bold;">false</span><span style="color: #008000;">;</span>
    InternalSignalRuntimeIsStopped<span style="color: #008000;">&#40;</span><span style="color: #0600FF; font-weight: bold;">null</span>, <span style="color: #008000;">new</span> DebuggerErrorStopReason<span style="color: #008000;">&#40;</span><span style="color: #008000;">&#41;</span><span style="color: #008000;">&#41;</span><span style="color: #008000;">;</span>
    Debug<span style="color: #008000;">.</span><span style="color: #0000FF;">Assert</span><span style="color: #008000;">&#40;</span><span style="color: #0600FF; font-weight: bold;">false</span>, <span style="color: #666666;">&quot;Critical failures -- received DebuggerError callback.&quot;</span><span style="color: #008000;">&#41;</span><span style="color: #008000;">;</span>
<span style="color: #008000;">&#125;</span></pre></div></div>

<p>And examining the CorDebuggerErrorEventArgs object allowed my to actually find the error code 0x80131C30, this wasn&#8217;t a number I was familiar with, so I had to Google it, which led me to the fact that <a href="http://blogs.msdn.com/jmstall/archive/2007/08/27/icorpublish-does-not-cross-the-32-64-bit-boundary.aspx">ICorPublish does not cross the 32/64 bit boundary</a>. Ah, now were getting somewhere I thought, the .net flags in the header of the target I was trying to debug was set as follows</p>
<p><a href="http://nbedford.net78.net/wordpress/wp-content/uploads/2008/06/dotnetflags.jpg" rel="lightbox[94]"><img class="alignright size-medium wp-image-96" title="CFF Explorer showing .net header Flags" src="http://nbedford.net78.net/wordpress/wp-content/uploads/2008/06/dotnetflags-300x284.jpg" alt="" width="300" height="284" /></a>But for some (presumably good) reason, Reflector&#8217;s binary is set to &#8217;32bit required&#8217;. As I was running on Vista x64 my target was being run as a 64 bit image, but Relfector + Deblector + the ICorPublish interface they created were running as 32 bit.</p>
<p>The solution to my problem, well I simply ticked the &#8217;32bit required&#8217; tick box in the flags section of the .net header for the target I wished to debug and everything started working.</p>
]]></content:encoded>
			<wfw:commentRss>http://nicbedford.co.uk/2008/06/24/reflector-deblector-x64-0x80131c30/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
	</channel>
</rss>

<!-- www.000webhost.com Analytics Code -->
<script type="text/javascript" src="http://analytics.hosting24.com/count.php"></script>
<noscript><a href="http://www.hosting24.com/"><img src="http://analytics.hosting24.com/count.php" alt="web hosting" /></a></noscript>
<!-- End Of Analytics Code -->

