Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
177
questions
1
vote
0answers
63 views
Recommended plugins for x64dbg
I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks.
The more you can ...
1
vote
1answer
82 views
Is `movq rax, xmm0` buggy in Radare2?
Why doesn't rax get loaded from xmm0 here? radare2 bug?
GitHub issue `movq rax, xmm0` doesn't work in native debugger filed.
[0x0003b0e0]> drr
role reg value ref
―――――――――――――――――――...
0
votes
3answers
122 views
How To Identify Which Process Is Being Written To With WriteProcessMemory?
Basically, I cannot find which process is being written to when WriteProcessMemory is being called.
Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
0
votes
0answers
59 views
About x64dbg find command + Help to unpack a program
The find command in x64dbg(x86),
(found here: https://help.x64dbg.com/en/latest/commands/searching/find.html)
doesn't return anything. For example:
findall 0x00524180, "E8 ????????" returns 50 ...
0
votes
1answer
98 views
Evan's debugger (edb) - Failed to open and attach to process: execv() failed: No such file or directory
Problem:
When I try to open an executable (in this case exploit exercises protostar stack0), then the following message appears in a pop-up box:
Failed to open and attach to process: execv() failed: ...
0
votes
0answers
78 views
Using IDA pro 7.2 and android server breakpoints problem
i have been trying to use IDA to make a breakpoints on a 4 byte memory address
to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
3
votes
0answers
39 views
IDA's debuggers disappeared
Using IDA 7
I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
0
votes
0answers
32 views
Immunity Debuggger Inconsistent Results
Question for people using Immunity Debugger.
Just started using Immunity Debugger, using 1.85 on Win 7 Pro.
Doing some labs on vulnserver.exe and I am getting inconsistent results from Immunity ...
0
votes
0answers
55 views
Pass arguments to EDB
Is there a way to pass an argument in edb?
I've tried Options -> Application Arguments, but to no avail.
Here's some simple print code for application arguments to see if it'll work.
#include <...
0
votes
0answers
232 views
In X64dbg, how can I script a string write to memory?
I find that I can write to memory as
[addr] = value
As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html
And while I could work around my problem as dividing ...
1
vote
2answers
388 views
Difference between 32 bit and 64 bit disassemblers
As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
0
votes
0answers
86 views
Issues with Symbols when running windbg on windows xp sp3
I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
0
votes
0answers
62 views
Why x64dbg doesn’t list GetDlgItemTextA
When I was working on the same application, I realized that x64dbg didn't catch the GetDlgItemTextA Function while Ollydbg did when I placed a breakpoint on GetDlgItemTextA; Actually x64dbg doesn't ...
1
vote
0answers
253 views
Ida permission error
I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
1
vote
0answers
60 views
UTF8, UTF16 encoding string search
I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them..
P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
0answers
49 views
How to find function called by instantaneous event (like mouse press for exemple)
I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me.
I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what ...
0
votes
1answer
373 views
Remote debugging using IDA, connecting to windbg server (kernel mode)
I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
4
votes
1answer
715 views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
0
votes
0answers
171 views
Advanced Anti-Debugging Techniques
I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
0
votes
0answers
89 views
OllyDbg - After restarting program, breakpoints lost
I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
3
votes
0answers
93 views
How to redirect stdin in OllyDbg?
When I use IDA, I can use stdin from the file as in bash.
When I tried to do it in OllyDbg, it processed the parameters simply as a string.
Can I redirect stdin in OllyDbg?
-1
votes
1answer
64 views
Logging the Instruction Pointer Register
Is there a tool that logs the value the IP register of a specific process running?
I am trying to compare the instruction excution before and after a file modification.
2
votes
1answer
164 views
When reopening file lose all information in radare2
I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file.
any help to avoid this?
0
votes
0answers
73 views
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.
I ...
1
vote
1answer
185 views
Is there watchpoints in radare2?
Is there any way to put breakpoints in radare2 that trigger when an address is read/write?
In GDB those are call watchpoints ('rwatch' or 'awatch")
I got this from radare2
[0xB7F08810]> !dr?
...
0
votes
1answer
782 views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
2
votes
0answers
158 views
Does pwntools provide any Radare2 integration?
I want to use pwntools with Radare2, since this is my debugger of choice.
However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb).
Anyone with experience in ...
1
vote
0answers
50 views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
1
vote
1answer
216 views
how watchpoint on register works
GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ?
Is there a way to make it work for lldb also ?
*...
2
votes
1answer
445 views
How to print eax value with Radare2?
I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
0
votes
1answer
479 views
Tricore debugging tools
I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM.
Now I would like to learn about Tricore reverse engineering... ECUs mainly.
I can obtain the ECU ...
1
vote
2answers
457 views
Generate software breakpoint other than int3
Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example?
If so, I was wondering why debuggers don't support generating ...
1
vote
1answer
162 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
8
votes
4answers
12k views
OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?
OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
0
votes
1answer
79 views
Does the Radare Debugger support STABS?
From the wiki on Stabs
stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers.
Does Radare ...
1
vote
1answer
1k views
x64dbg how to watch all changes after one step
We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?
x64dbg 32bit version trace:
NEW UPDATE
...
0
votes
1answer
276 views
GDB MI output vs. stdout
I am using GDBs machine interface (mi) to write some simple tracers/loggers.
Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout.
If I look ...
3
votes
2answers
9k views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
3
votes
1answer
262 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
2
votes
1answer
485 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
0
votes
2answers
272 views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
1
vote
1answer
68 views
EDB /usr/bin/xterm
Currently, I am debugging a CLI application that requires a lot of big inputs.
Can I change the default /usr/bin/xterm in edb to something like /bin/bash?
3
votes
0answers
232 views
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere ...
1
vote
1answer
224 views
IDA PRO does miss calls when tracing
I am following this tutorial:
enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program.
I though ...
3
votes
1answer
379 views
Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode
When I try to load a program to radare2 debug mode, most of the time I get the following error:
$sudo r2 -d a.out
Hello world!= attach 2851 2851
Cannot open '/proc/2851/maps': No such file or ...
2
votes
0answers
355 views
Seeking front end for MinGW gdb debugger
We are unit testing with Vectorcast, which uses the MinGW tool chain on Windows.
It launches the command line gdb, but some of the newer engineers are having problems getting to grips with something ...
1
vote
1answer
891 views
Installed IDA 7.0 Freeware — no debugger, is that installed separately? [duplicate]
After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured ...
2
votes
0answers
154 views
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.
Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.
However, whenever I try to debug ...
1
vote
2answers
803 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
0
votes
1answer
5k views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
