jmp in memory allocation : "Could not get module base" about ret-sync

[bootleg]

Hi @tonybounty,

indeed dynamically allocated code is complex to handle and basically breaks ret-sync dispatching based on module names. Windbg offers a powerful API IDebugSymbols3::AddSyntheticModule to handle these situations. To the best of my knowledge there is not something similar in the x64dbg API.

However with the x64dbg plugin you can try the following workaround:

• syncmodauto off
• idblist
• idbn xx

I've just added the syncmodauto command to x64dbg in the commit b1b7be1 . It tells ret-sync to stop automatically resolving and switching modules/idb.

With idblist you get the list of all the idb attached to the dispatcher (if you have more than one)

With idbn you force syncing with the idb you selected at the previous step; for example idbn 0 to select the first one.

It should do the trick.

[bootleg]

closing this one as it seems ok with the workaround. Please reopen if necessary.

[Kojuda]

I have tried several things :

• Loading the injected PE as segment at the same loading offset inside an IDB of the victim process
• Create a IDB with the extracted injected PE with the same base address and the same name of the debugged process in x64dbg
• Load the injected PE as an external binary inside the extracted process.

I have extracted all of them with PE-Sieve that gives the better results. The mentioned commands above don't prevent the error message "Could not get module base..."

I don't know how to handle this since a need to debug the running victim process.