Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
7
votes
3answers
465 views
OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?
OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
0
votes
1answer
21 views
Does the Radare Debugger support STABS?
From the wiki on Stabs
stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers.
Does Radare ...
1
vote
1answer
110 views
x64dbg how to watch all changes after one step
We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?
x64dbg 32bit version trace:
NEW UPDATE
...
0
votes
0answers
55 views
Radare2 Debugger Crashes — SIGNAL 17, anti-debugger?
I am having a hard time debugging a piece of software.
It appears that the creator of this "crackme" challenge has installed an anti-debugger to kill the process whenever I try to debug.
I need to ...
0
votes
1answer
39 views
GDB MI output vs. stdout
I am using GDBs machine interface (mi) to write some simple tracers/loggers.
Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout.
If I look ...
2
votes
2answers
404 views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
3
votes
1answer
91 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
2
votes
1answer
34 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
0
votes
2answers
116 views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
1
vote
1answer
24 views
EDB /usr/bin/xterm
Currently, I am debugging a CLI application that requires a lot of big inputs.
Can I change the default /usr/bin/xterm in edb to something like /bin/bash?
3
votes
0answers
101 views
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere ...
0
votes
0answers
37 views
IDA PRO - Database changes after some test
I noticed that after some debugging my database has many remarks and some changes which were not there during the initial analysis nor after the firs few debugging sessions.
e.g. i see this is how to ...
1
vote
1answer
58 views
IDA PRO does miss calls when tracing
I am following this tutorial:
enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program.
I though ...
2
votes
0answers
36 views
Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode
When I try to load a program to radare2 debug mode, most of the time I get the following error:
$sudo r2 -d a.out
Hello world!= attach 2851 2851
Cannot open '/proc/2851/maps': No such file or ...
2
votes
0answers
65 views
Seeking front end for MinGW gdb debugger
We are unit testing with Vectorcast, which uses the MinGW tool chain on Windows.
It launches the command line gdb, but some of the newer engineers are having problems getting to grips with something ...
0
votes
1answer
241 views
Installed IDA 7.0 Freeware — no debugger, is that installed separately? [duplicate]
After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured ...
2
votes
0answers
42 views
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.
Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.
However, whenever I try to debug ...
1
vote
2answers
118 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
0
votes
1answer
649 views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
1
vote
2answers
838 views
How do you use the Radare debugger with command line arguments (parameters)?
If I want to debug ls I can run,
radare -d /bin/ls
But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
0
votes
0answers
126 views
Debugging malicious .JAR without sourcecode [duplicate]
I have a malicious JAR file that is very interesting because it's running a custom encryption for its packed malware. I'm looking for a Java debugger, but something that's lightweight. I'm running in ...
3
votes
1answer
367 views
Why most debuggers don't auto recognize functions?
may anyone explain to me why most of the debuggers don't auto recognize functions?
This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
1
vote
1answer
395 views
Simple Debugger and Hardware BreakPoints in x64 Windows 10
I have coded a very simple Debugger for x64, I am using currently Win10.
I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows:
inline void SETBITS(DWORD64 *dw, ...
0
votes
2answers
140 views
Techniques for marking memory changes
i'm using IDA to reverse some crypto code that seems to derive its key from some hashing functions. I have recognized the algoritm based on magic numbers, but i want to see its changes in memory ...
2
votes
0answers
109 views
How can I fix an unpacked binary which calls out-of-bounds memory?
I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
4
votes
2answers
578 views
How to label local variables in x64dbg
As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:
I found no way to label locals in the debugger ...
1
vote
1answer
399 views
Find what writes to a dynamic memory address
I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
6
votes
3answers
1k views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
0
votes
1answer
106 views
Detecting user<->kernel transitions with hypervisor
Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
0
votes
1answer
471 views
I'd like to ask about unpacking aspack 2.12
I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
1
vote
1answer
2k views
I'm unable to copy to executable (ollydebug)
I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
1
vote
2answers
157 views
How to debug binwalk tool?
My lecturers have requested that I debug binwalk in order to understand how it works and develop new features so that it can extract more. I tried to use gdb to debug binwalk but it results in the ...
0
votes
1answer
816 views
Calling DLL exports in x64dbg
I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
1
vote
1answer
3k views
Access violation when reading [OLLYDEBUG]
Any time I try to crack a program I get this error in olly:
What causes this error? How can I fix this?
If anyone has suggestion or advice that would be great. I already tried pressing F9 but that ...
3
votes
1answer
871 views
Reversing a program with dongle
So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start.
From looking through the disassembly ...
1
vote
1answer
80 views
Log modified memory locations when tracing with Ollydbg
When you trace with Ollydbg it prints the register values near commands that modify them. Is there any way to get it to print some memory locations, of my choice, when modified?
0
votes
0answers
244 views
How to reset the value of a register in debugging?
I use IDA PRO 6.6 to remote debug win64.
How to reset the value of a register in debug?
1
vote
2answers
96 views
What is the relationship between .NET and x86-64 assembly?
I'm gathering that it's nearly a waste of time to try to reverse .NET applications in a native debugger. But why? Of course the computer is executing machine code in the end, not CIL. So what clutters ...
0
votes
1answer
81 views
Where can I get systematic problems and solutions for debugging?
I know PEFile headers, assembly language, and other basic stuff.
I am looking for some site or book which systematically teaches me debugging and reversing. Something like "Let us C" for C language.
...
1
vote
1answer
7k views
How to switch to “Graph View” in IDA Pro while debugging with WinDbg inside a system DLL?
While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view:
That will switch it to this nice code-...
1
vote
0answers
635 views
Error: the file can't be loaded by debugger plupin IDA PRO 64 bit
I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
1
vote
2answers
204 views
Identifying DeviceIoControl argument
I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls.
I found a reference to CreateFileA("\\.\Commsb96", GENERIC_READ | ...
3
votes
1answer
1k views
Getting pydbg working on windows 10
I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
0
votes
1answer
322 views
create a string in ollydbg, x32dbg, immunity or similar
I have found a code cave in an executable and want to call winapi functions.
What do i have to write in the assembly window to create a string which can later be referenced?
For learning i changed ...
0
votes
3answers
1k views
IDA Pro Debugging Window Closes in a Second!
Starting my RE adventures with IDA Pro, I'm opening a windows .exe file in it. While debugging the file, the debugger runs fine and exits with a return 1 value:
Debugger: process has exited (exit code ...
0
votes
1answer
63 views
Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]
So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits.
By, default, it doesn't allow keybind ...
1
vote
2answers
3k views
Getting past a whole lot of anti-debug measures for a windows exe
I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
2
votes
1answer
410 views
WinDbg - RVA of current instruction
Do someone know a windbg command to display the RVA of a certain instruction within it's module?
Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, ...
5
votes
1answer
5k views
How can I set breakpoint and get value of a register with IDApython
How can I set a breakpoint and get the value of the EAX register with IDApython?
I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
0answers
606 views
Immunity Debugger Unable to set Breakpoint
I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try.
The first error is that Immunity is 'Unable ...
