Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
0 votes
0 answers
70 views

Deobfuscating WPF obfuscated code

The project uses WPF : What should i do for XAML links de4dot supporting that ? I have been trying to deobfuscate an encrypted code for days but no matter what I did, I bypassed the debugger ...
Waltcher's user avatar
0 votes
0 answers
64 views

Decompile or analyse injected /usr/bin/cat

I'm trying to decompile or analyse an injected Linux executable binary file /usr/bin/cat ,and find the injected code as a readable. Need some tips as a beginner how to find the injection method if it'...
Dany Burgos's user avatar
0 votes
0 answers
383 views

Failed to attach: unable to connect to remote frida-server: closed

I'm trying to bypass Frida (Android) local port scanning detection, so I followed this guide. The sequence of commands I used are : (magic_man is alias for frida_server) adb root adb push magic_man /...
exploitr's user avatar
  • 101
1 vote
0 answers
64 views

Process stuck on the entry point

I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11. The current problem with it is that when running the exe file nothing seems to ...
Yair Derry's user avatar
0 votes
0 answers
64 views

Is there a debugger for the entire x86 architecture?

When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process. I am ...
AirToTec's user avatar
3 votes
0 answers
501 views

How to do live debugging of ARM64 binaries on macOS with M1/M2 chips?

I'm trying to figure out why NSSavePanel fails in my SwiftUI app. I tried every possible documentation, or asking on the Swift programming forums - to no avail. I'm originally a Windows programmer, ...
c00000fd's user avatar
  • 1,659
3 votes
0 answers
78 views

x32dbg version causes crash on breakpoint

i'm a newbie to this whole shindig, and have started with https://gamehacking.academy. i'm finding this fun, but am getting stuck here: when i try to apply a breakpoint using x32dbg, as in https://...
Axolotl Kumar's user avatar
3 votes
0 answers
671 views

Ghidra view stack frame values

I'm learning reverse engineering, and I'm using Ghidra's debugger to analyze a running program. I want to view the values that are on the stack for a function, but I can't figure out how to do this. I'...
Alex Q's user avatar
  • 131
1 vote
1 answer
459 views

How to debug a malware that does DLL injection into explorer.exe?

What steps would you suggest for debugging a malware that injects a DLL into explorer.exe? using X32dbg have already attached explorer.exe to x32dbg
purple.jar's user avatar
1 vote
0 answers
73 views

debug native code and net code

I have a .net dll with a lot of calculations and formulas. From this dll, I want to set breakpoints to see the calculated results for a specific field. The main program is written in native code. So, ...
Mrplcmodbus's user avatar
4 votes
1 answer
193 views

How to debug cfg80211.ko

I have an Linux embedded device that I want to debug the cfg80211.ko I have full root SSH on that device. How can I debug cfg80211.ko?
Kokomelom's user avatar
  • 281
3 votes
1 answer
329 views

How to use software watchpoints in LLDB?

After trying to use watch command, LLDB said the device had 0 available hardware watchpoints. In GDB you can use set can-use-hw-watchpoints 0 How do you disable hardware watchpoints in LLDB?
Silent's user avatar
  • 164
2 votes
1 answer
409 views

x64dbg : TraceInto only in user code

The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
HK47's user avatar
  • 23
1 vote
0 answers
557 views

x64dbg isn't running the program I'm looking at

I'm almost definitely being an idiot but I have opened up an .exe file in x64dbg and I can run the file just fine when looking at the assembly but it doesn't open a second window so I can see the ...
x02's user avatar
  • 11
1 vote
1 answer
298 views

How do you change the stack width/offset in radare2?

Currently, my stack view is 0x10 (16) bytes long. How do I change it so that the stack view is 8 bytes long? Edit: I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
user40683's user avatar
1 vote
1 answer
213 views

Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender

In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
Edw590's user avatar
  • 188
2 votes
1 answer
419 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
Meigyoku Thmn's user avatar
3 votes
1 answer
540 views

Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)

I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it"). I found that user to have the most ...
G. L.'s user avatar
  • 31
1 vote
3 answers
1k views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
Charles Weerawansa's user avatar
2 votes
1 answer
630 views

Debugging Native Lib using IDA Pro Fails to Load Registers and other Information

Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
Display's user avatar
  • 121
1 vote
2 answers
2k views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
TensionRising's user avatar
1 vote
1 answer
478 views

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
programming_is_bae's user avatar
1 vote
2 answers
697 views

Why IDA debugger on android doesn't show all threads?

My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file. Here's what I've done: download a x86_64 system image android emulator from android studio install that .apk ...
ratsafalig's user avatar
0 votes
1 answer
378 views

Can't add tracing in IDA, showing it in gray

I added read/write trace to a program. I was able to record the trace with IDA for the first time. When I run it again, it didn't work. I tried to do what I did on the first time, adding the read/...
E235's user avatar
  • 583
1 vote
2 answers
1k views

How to search for process by name with WinDBG

I know how to list all the processes in the system by running: 0: kd>dx -r1 Debugger.Sessions[0].Processes OR 0: kd>.tlist But how can I search for a process by name? I tried to use the ...
E235's user avatar
  • 583
1 vote
1 answer
449 views

Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"

I have a WinForm project in C++. I attached a kernel debugger to my VMware machine. I set a breakpoint on the kernel and switched context to my application: 0: kd> !process 0 0 WindowsProject1.exe ...
E235's user avatar
  • 583
2 votes
1 answer
697 views

Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"

I tried to debug a C++ that I created but I am getting the following error: I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
E235's user avatar
  • 583
1 vote
1 answer
119 views

Switch between debuggers while paused on a breakpoint

Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
korri123's user avatar
  • 113
2 votes
1 answer
935 views

GDB inserting breakpoint cause Segmentation Fault

I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
JamesQuinn's user avatar
1 vote
2 answers
615 views

Changing page permissions at runtime under a debugger

Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
0-0's user avatar
  • 111
2 votes
1 answer
3k views

Program prevents x64dbg from starting or kills it if it's already running. What to do?

I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows. It looks like the program has some sort of anti-debug protection. I have the following behavior: ...
ne0n's user avatar
  • 21
0 votes
1 answer
507 views

open decompiler view of current module (dll) in dynamic analysis

I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
Soleil's user avatar
  • 123
0 votes
1 answer
227 views

Is it possible for a process to debug itself?

What happens if you try to debug yourself ? I mean, does the process crash ? If it is possible, how would you implement it ? I have tried launching x64dbg and I can't attach to my own x64dbg process. ...
beauthi's user avatar
0 votes
0 answers
253 views

x64dbg show some text in Chinese

While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why. This happened after I moved to a new computer but both of them were Windows 10. In my old computer I ...
E235's user avatar
  • 583
0 votes
2 answers
809 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
David542's user avatar
  • 103
0 votes
0 answers
2k views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
w4po's user avatar
  • 1
2 votes
0 answers
825 views

Recommended plugins for x64dbg

I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks. The more you can ...
beginner's user avatar
1 vote
1 answer
182 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
rickhg12hs's user avatar
0 votes
3 answers
977 views

How To Identify Which Process Is Being Written To With WriteProcessMemory?

Basically, I cannot find which process is being written to when WriteProcessMemory is being called. Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
MadMax2020's user avatar
0 votes
1 answer
2k views

Evan's debugger (edb) - Failed to open and attach to process: execv() failed: No such file or directory

Problem: When I try to open an executable (in this case exploit exercises protostar stack0), then the following message appears in a pop-up box: Failed to open and attach to process: execv() failed: ...
Nopslide__'s user avatar
0 votes
0 answers
480 views

Using IDA pro 7.2 and android server breakpoints problem

i have been trying to use IDA to make a breakpoints on a 4 byte memory address to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
Mr. Zex's user avatar
3 votes
0 answers
53 views

IDA's debuggers disappeared

Using IDA 7 I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
Tom Young's user avatar
0 votes
0 answers
121 views

Immunity Debuggger Inconsistent Results

Question for people using Immunity Debugger. Just started using Immunity Debugger, using 1.85 on Win 7 Pro. Doing some labs on vulnserver.exe and I am getting inconsistent results from Immunity ...
CG2000's user avatar
  • 1
1 vote
0 answers
2k views

In X64dbg, how can I script a string write to memory?

I find that I can write to memory as [addr] = value As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html And while I could work around my problem as dividing ...
Sharky's user avatar
  • 11
1 vote
2 answers
2k views

Difference between 32 bit and 64 bit disassemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
J.Doe's user avatar
  • 15
1 vote
0 answers
270 views

Issues with Symbols when running windbg on windows xp sp3

I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
sinpingsegfaults's user avatar
1 vote
0 answers
1k views

Ida permission error

I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
jojo osinga's user avatar
1 vote
0 answers
458 views

UTF8, UTF16 encoding string search

I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them.. P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
Nikoloz Chitashvili's user avatar
1 vote
0 answers
394 views

How to find function called by instantaneous event (like mouse press for exemple)

I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me. I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what ...
user29223's user avatar
0 votes
1 answer
1k views

Remote debugging using IDA, connecting to windbg server (kernel mode)

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
eyal karni's user avatar

1
2 3 4 5