Following sample crashes Adobe Acrobat 10 + CuckooMon

[ctxis]

Following sample crashes Adobe Acrobat 10 + CuckooMon

[kevoreilly]

Hmm this could be a tricky one to debug. One thing I've realised is that I am not saving the .pdb files that correspond to the capemon builds published, which makes it needlessly more difficult to tie that offset to a line in the source code. There are a few updates to capemon yet to be published so I will push them shortly. If you could run the sample against the new build and let me know the new offset, I might have a better chance at nailing it down and squashing it!

[kevoreilly]

If you could try with the latest build of the monitor pushed this morning - at least then if it crashes I have the .pdb file and will be able to tie the offset to the source code. Cheers.

[redsand]

Is it too much to ask that you document your workflow when debugging this? I'd like a reference for moving forward. It also may help other developers assist you on the capemon side, which has less community engagement. Thoughts? I'd like to see how you can easily attach a debugger and step through it and what kev usually looks for Hope all is well, bud. The progress is looking great. Tim

…

On Thu, Oct 18, 2018, 6:58 AM kevoreilly ***@***.***> wrote: If you could try with the latest build of the monitor pushed this morning - at least then if it crashes I have the .pdb file and will be able to tie the offset to the source code. Cheers. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#167 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAhV88MqRQreU5LcSd_cmvD9sHu013Eyks5umGzKgaJpZM4XfQJ9> .

[kevoreilly]

No worries I will document anything I find! I guess every case is different. There are 3 main strategies for debugging the monitor. The first is just to use the log mechanism within the monitor then iterate with builds whilst submitting a test job and checking the analysis log for the debug output. Another alternative is to run the monitor outside the sandbox by using the loader's pipe mechanism. You can inject it into a process that is running in a usermode debugger if you like at this point. The ultimate but hardest method (which I had to use to debug the debugger!) is to do remote kernelmode debugging of the target with WinDbg.

Anyway hopefully in this case we can get by with the easiest. Let me know how it runs with the latest build.

[kevoreilly]

Any joy testing with the latest builds?

[kevoreilly]

There have been quite a few bugfixes in the monitor since this issue was raised - I'm tempted to think this may have been solved already, but would be happy to hear this confirmed if you wouldn't mind testing it with a recent build.