Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
0
votes
1answer
34 views
GDB MI output vs. stdout
I am using GDBs machine interface (mi) to write some simple tracers/loggers.
Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout.
If I look ...
0
votes
0answers
42 views
Find entry point of start anti debugger? [closed]
I need help to bypass this protector. Because game not loading after.
Game (Blade and soul), and i not found info what a version using in this game, very sad.
Maybe someone unpacking this protector, ...
2
votes
2answers
241 views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
3
votes
1answer
85 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
2
votes
1answer
27 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
0
votes
2answers
107 views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
1
vote
1answer
21 views
EDB /usr/bin/xterm
Currently, I am debugging a CLI application that requires a lot of big inputs.
Can I change the default /usr/bin/xterm in edb to something like /bin/bash?
3
votes
0answers
89 views
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere ...
0
votes
0answers
33 views
IDA PRO - Database changes after some test
I noticed that after some debugging my database has many remarks and some changes which were not there during the initial analysis nor after the firs few debugging sessions.
e.g. i see this is how to ...
1
vote
1answer
50 views
IDA PRO does miss calls when tracing
I am following this tutorial:
enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program.
I though ...
2
votes
0answers
28 views
Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode
When I try to load a program to radare2 debug mode, most of the time I get the following error:
$sudo r2 -d a.out
Hello world!= attach 2851 2851
Cannot open '/proc/2851/maps': No such file or ...
2
votes
0answers
51 views
Seeking front end for MinGW gdb debugger
We are unit testing with Vectorcast, which uses the MinGW tool chain on Windows.
It launches the command line gdb, but some of the newer engineers are having problems getting to grips with something ...
0
votes
1answer
145 views
Installed IDA 7.0 Freeware — no debugger, is that installed separately? [duplicate]
After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured ...
2
votes
0answers
31 views
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.
Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.
However, whenever I try to debug ...
1
vote
2answers
68 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
0
votes
1answer
398 views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
1
vote
2answers
645 views
How do you use the Radare debugger with command line arguments (parameters)?
If I want to debug ls I can run,
radare -d /bin/ls
But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
0
votes
0answers
105 views
Debugging malicious .JAR without sourcecode [duplicate]
I have a malicious JAR file that is very interesting because it's running a custom encryption for its packed malware. I'm looking for a Java debugger, but something that's lightweight. I'm running in ...
3
votes
1answer
363 views
Why most debuggers don't auto recognize functions?
may anyone explain to me why most of the debuggers don't auto recognize functions?
This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
1
vote
1answer
342 views
Simple Debugger and Hardware BreakPoints in x64 Windows 10
I have coded a very simple Debugger for x64, I am using currently Win10.
I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows:
inline void SETBITS(DWORD64 *dw, ...
0
votes
2answers
138 views
Techniques for marking memory changes
i'm using IDA to reverse some crypto code that seems to derive its key from some hashing functions. I have recognized the algoritm based on magic numbers, but i want to see its changes in memory ...
2
votes
0answers
98 views
How can I fix an unpacked binary which calls out-of-bounds memory?
I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
4
votes
2answers
501 views
How to label local variables in x64dbg
As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:
I found no way to label locals in the debugger ...
1
vote
1answer
295 views
Find what writes to a dynamic memory address
I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
6
votes
3answers
981 views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
0
votes
1answer
99 views
Detecting user<->kernel transitions with hypervisor
Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
0
votes
1answer
424 views
I'd like to ask about unpacking aspack 2.12
I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
1
vote
1answer
1k views
I'm unable to copy to executable (ollydebug)
I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
1
vote
2answers
144 views
How to debug binwalk tool?
My lecturers have requested that I debug binwalk in order to understand how it works and develop new features so that it can extract more. I tried to use gdb to debug binwalk but it results in the ...
0
votes
1answer
775 views
Calling DLL exports in x64dbg
I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
1
vote
1answer
2k views
Access violation when reading [OLLYDEBUG]
Any time I try to crack a program I get this error in olly:
What causes this error? How can I fix this?
If anyone has suggestion or advice that would be great. I already tried pressing F9 but that ...
3
votes
1answer
736 views
Reversing a program with dongle
So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start.
From looking through the disassembly ...
1
vote
1answer
75 views
Log modified memory locations when tracing with Ollydbg
When you trace with Ollydbg it prints the register values near commands that modify them. Is there any way to get it to print some memory locations, of my choice, when modified?
0
votes
0answers
226 views
How to reset the value of a register in debugging?
I use IDA PRO 6.6 to remote debug win64.
How to reset the value of a register in debug?
1
vote
2answers
96 views
What is the relationship between .NET and x86-64 assembly?
I'm gathering that it's nearly a waste of time to try to reverse .NET applications in a native debugger. But why? Of course the computer is executing machine code in the end, not CIL. So what clutters ...
0
votes
1answer
81 views
Where can I get systematic problems and solutions for debugging?
I know PEFile headers, assembly language, and other basic stuff.
I am looking for some site or book which systematically teaches me debugging and reversing. Something like "Let us C" for C language.
...
1
vote
1answer
6k views
How to switch to “Graph View” in IDA Pro while debugging with WinDbg inside a system DLL?
While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view:
That will switch it to this nice code-...
1
vote
0answers
593 views
Error: the file can't be loaded by debugger plupin IDA PRO 64 bit
I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
1
vote
2answers
195 views
Identifying DeviceIoControl argument
I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls.
I found a reference to CreateFileA("\\.\Commsb96", GENERIC_READ | ...
3
votes
1answer
957 views
Getting pydbg working on windows 10
I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
0
votes
1answer
316 views
create a string in ollydbg, x32dbg, immunity or similar
I have found a code cave in an executable and want to call winapi functions.
What do i have to write in the assembly window to create a string which can later be referenced?
For learning i changed ...
0
votes
3answers
1k views
IDA Pro Debugging Window Closes in a Second!
Starting my RE adventures with IDA Pro, I'm opening a windows .exe file in it. While debugging the file, the debugger runs fine and exits with a return 1 value:
Debugger: process has exited (exit code ...
0
votes
1answer
61 views
Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]
So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits.
By, default, it doesn't allow keybind ...
1
vote
2answers
3k views
Getting past a whole lot of anti-debug measures for a windows exe
I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
2
votes
1answer
383 views
WinDbg - RVA of current instruction
Do someone know a windbg command to display the RVA of a certain instruction within it's module?
Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, ...
4
votes
1answer
5k views
How can I set breakpoint and get value of a register with IDApython
How can I set a breakpoint and get the value of the EAX register with IDApython?
I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
0answers
587 views
Immunity Debugger Unable to set Breakpoint
I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try.
The first error is that Immunity is 'Unable ...
1
vote
0answers
269 views
OllyDbg step over command not behaving exactly as the Immunity Debugger
I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching.
In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
0
votes
0answers
219 views
How to get the arguments passed to a function located in a DLL?
I am using Pydbg for resolving the exported function address located in the dll. Going through the pydbg documentation, i couldn't find a way to dump the arguments passed to those functions.
2
votes
0answers
143 views
Ignore Path and Extension in OllyDBG 2?
I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a ...
