Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

Hardware Breakpoint wont work on address created during runtime

I am currently trying to crack a crackme.exe. Before the jump it compares the following (0 == not registered): cmp byte ptr ds:[eax+0x15FC], 0x0 If I normally load the .exe and try to go to the ...
0
votes
1answer
30 views

Debugging Native Lib using IDA Pro Fails to Load Registers and other Information

Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
1
vote
2answers
69 views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1answer
47 views

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
1
vote
1answer
80 views

Why IDA debugger on android doesn't show all threads?

My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file. Here's what I've done: download a x86_64 system image android emulator from android studio install that .apk ...
0
votes
1answer
27 views

Can't add tracing in IDA, showing it in gray

I added read/write trace to a program. I was able to record the trace with IDA for the first time. When I run it again, it didn't work. I tried to do what I did on the first time, adding the read/...
1
vote
2answers
54 views

How to search for process by name with WinDBG

I know how to list all the processes in the system by running: 0: kd>dx -r1 Debugger.Sessions[0].Processes OR 0: kd>.tlist But how can I search for a process by name? I tried to use the ...
0
votes
1answer
31 views

Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"

I have a WinForm project in C++. I attached a kernel debugger to my VMware machine. I set a breakpoint on the kernel and switched context to my application: 0: kd> !process 0 0 WindowsProject1.exe ...
2
votes
1answer
67 views

Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"

I tried to debug a C++ that I created but I am getting the following error: I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
0
votes
0answers
80 views

Process close when try attach some debugger

I'm begin with reverse engineering, because I want to create some new functions to the "game server". That is, I want to inject(hook dll) in this game. **The source code of project not is ...
1
vote
1answer
38 views

Switch between debuggers while paused on a breakpoint

Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
1
vote
1answer
103 views

GDB inserting breakpoint cause Segmentation Fault

I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
0
votes
0answers
228 views

x64dbg for linux executables?

Is there a x64dbg for Linux executables? I really love x64dbg, but in a lot of CTF challenges there are Linux executables and not .exe files or .dll files.
1
vote
2answers
41 views

Changing page permissions at runtime under a debugger

Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
0
votes
1answer
261 views

Program prevents x64dbg from starting or kills it if it's already running. What to do?

I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows. It looks like the program has some sort of anti-debug protection. I have the following behavior: ...
0
votes
1answer
56 views

open decompiler view of current module (dll) in dynamic analysis

I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
0
votes
1answer
56 views

Is it possible for a process to debug itself?

What happens if you try to debug yourself ? I mean, does the process crash ? If it is possible, how would you implement it ? I have tried launching x64dbg and I can't attach to my own x64dbg process. ...
0
votes
0answers
86 views

x64dbg show some text in Chinese

While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why. This happened after I moved to a new computer but both of them were Windows 10. In my old computer I ...
0
votes
0answers
58 views

Unable to debug with Debuggers

I can't debug Screen Recorders on any debugger. I tried every possible way including anti debugging plugins, editing up the instructions but every time I failed. Mostly they land on pushad (which ...
0
votes
2answers
124 views

ASM Debuggers that visualize the stack (beginner friendly)

(Cross-posted from Stack Overflow) Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image: I use gdb for most ...
0
votes
0answers
203 views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
1
vote
0answers
227 views

Recommended plugins for x64dbg

I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks. The more you can ...
1
vote
1answer
113 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
0
votes
3answers
374 views

How To Identify Which Process Is Being Written To With WriteProcessMemory?

Basically, I cannot find which process is being written to when WriteProcessMemory is being called. Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
0
votes
1answer
484 views

Evan's debugger (edb) - Failed to open and attach to process: execv() failed: No such file or directory

Problem: When I try to open an executable (in this case exploit exercises protostar stack0), then the following message appears in a pop-up box: Failed to open and attach to process: execv() failed: ...
0
votes
0answers
275 views

Using IDA pro 7.2 and android server breakpoints problem

i have been trying to use IDA to make a breakpoints on a 4 byte memory address to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
3
votes
0answers
42 views

IDA's debuggers disappeared

Using IDA 7 I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
0
votes
0answers
56 views

Immunity Debuggger Inconsistent Results

Question for people using Immunity Debugger. Just started using Immunity Debugger, using 1.85 on Win 7 Pro. Doing some labs on vulnserver.exe and I am getting inconsistent results from Immunity ...
0
votes
0answers
874 views

In X64dbg, how can I script a string write to memory?

I find that I can write to memory as [addr] = value As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html And while I could work around my problem as dividing ...
1
vote
2answers
803 views

Difference between 32 bit and 64 bit disassemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
0
votes
0answers
182 views

Issues with Symbols when running windbg on windows xp sp3

I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
1
vote
0answers
676 views

Ida permission error

I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
1
vote
0answers
184 views

UTF8, UTF16 encoding string search

I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them.. P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
0answers
69 views

How to find function called by instantaneous event (like mouse press for exemple)

I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me. I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what ...
0
votes
1answer
706 views

Remote debugging using IDA, connecting to windbg server (kernel mode)

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
5
votes
1answer
3k views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
0
votes
1answer
310 views

Advanced Anti-Debugging Techniques

I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
0
votes
0answers
176 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
3
votes
0answers
155 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
-1
votes
1answer
74 views

Logging the Instruction Pointer Register

Is there a tool that logs the value the IP register of a specific process running? I am trying to compare the instruction excution before and after a file modification.
2
votes
1answer
304 views

When reopening file lose all information in radare2

I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file. any help to avoid this?
0
votes
0answers
84 views

How to debug programs that load from another one? with radare2/gdb

I'm reversing engendering a plugin. This plugin is loaded into memory by the main program. I disassemble the plugin with radare2 but I don't know how to debug it. I try with gdb but same problem. I ...
1
vote
1answer
308 views

Is there watchpoints in radare2?

Is there any way to put breakpoints in radare2 that trigger when an address is read/write? In GDB those are call watchpoints ('rwatch' or 'awatch") I got this from radare2 [0xB7F08810]> !dr? ...
-1
votes
1answer
2k views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
3
votes
0answers
216 views

Does pwntools provide any Radare2 integration?

I want to use pwntools with Radare2, since this is my debugger of choice. However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb). Anyone with experience in ...
1
vote
0answers
79 views

IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)

I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these: Copied linux_server form IDApro into this VM and tried to run it, ...
2
votes
1answer
388 views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
2
votes
1answer
877 views

How to print eax value with Radare2?

I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
0
votes
2answers
998 views

Tricore debugging tools

I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM. Now I would like to learn about Tricore reverse engineering... ECUs mainly. I can obtain the ECU ...
1
vote
2answers
727 views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...