A forum for reverse engineering, OS internals and malware analysis 

Discussion on reverse-engineering and debugging.
 #2836  by alon
 Wed Sep 22, 2010 10:22 am
Hi,
Is possible to ignore exceptions retrieved from a specific module on windbg or ida debugger ?

I want the debugger dont handle exceptions from "myprocess.exe" but I want the debugger handle exception from some dll loaded by "myprocess.exe". I have tried to do this with "Event Filtes"( windbg ) but I can`t specify the module( name or address ).

thks.

-----------
alon
 #2837  by GamingMasteR
 Wed Sep 22, 2010 10:51 am
Hi,

I don't know if there's such an option, but I think you can achieve this with help of IDC or add-ons .
 #2851  by alon
 Thu Sep 23, 2010 1:48 pm
Hi GamingMasteR,

thanks for your reply, I have done this debugging with ida( windbg ) and editing exception( gui ida ) from "myprocess.exe" and Setting breakpoint with windbg at address where I want to see the code.

The problem was that I could not stop the execution where I want ( into the dll`s code ) because I was doing this with a "int 3" instruction and the exception that caused this interruption was not handled( it was configured : " pass to application" ) by ida.

Now I'm trying to do this another way( conditionals breakpoints.... )but for now I have no success :(

thanks for your reply!!!


alon