Skip to content

Better step return strategy for x86 binaries in native windows debug adapter #977

@xusheng6

Description

@xusheng6

Right now the native windows debug adapter uses the same strategy to do step return, i.e., placing a breakpoint at the return address and then resumes the target. While this works fine, the stack frame information returned by StackWalk function is often times inaccurate, causing the target to behave unexpectedly in various cases, e.g., in #421

There are a couple of ways to deal with. To start with, we can use binja's analysis to find return instructions and put a breakpoint on all of them. However, this does not work well for recursion. Similarly, we can consider breakpoint on ret, then continue until the stack pointer is larger, though it might break in case of tailcalls. A different way to leverage binja's analysis is since binja knows the stack pointer offset from the entry (return address) at every point in the function via LLIL stack pointer, we can find the return address on the stack and then put a breakpoint there

For context, x64dbg does step over until a return instruction is encountered

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions