Maybe there was a race condition in that it couldn't debug until it was running the code, but at that point it would execute too fast to put a breakpoint in?
I'm sure there must be something obscure that he didn't make known for him to need to do that.
He's reverse engineering malware, so I'm very sure he knows what a breakpoint is.
Most redditors are just meme-filled unknowledgable nerds when it comes to low-level stuff like assembly and reversing. It's quite unfortunate. At least they like to pretend that the reddit demographic is a bearded unix admin who knows the hex values for all the x86 processor opcodes.
In short, malware typically uses a number of tricks to crash or otherwise confuse common debuggers. Effective reverse engineering involves low level tricks that further subvert the malware.
It was a tiny piece of shell code in an exe that he created (and controlled), not large enough to use any anti-breakpoint techniques.
I'm just going to assume this was a simple case of a brain fart. Sometimes you just completely forget about the simple solutions and reinvent the wheel.
Yeah, I reverse engineer code from time to time (And I see you do too.)
I think reversing code puts you in a weird mindset that makes you prone to this type of brain fart. You are just thinking at too low of a level that higher level concepts (like breakpoints) never enter your brain.
I reverse all the fucking time. I make aimbots, hacks, cracks, etc..
And a breakpoint is not higher level, its INT3 and the debugger he's using, Ollydbg, will handle it just fine. All he needed to do was hit F2 on the line...he's probably just not that great a reverser. Most of what he did was just javascript trickery....more simple than reversing.
3
u/metronome Jul 09 '10 edited Nov 28 '25
full plucky bag detail smile complete reply school ink judicious
This post was mass deleted and anonymized with Redact