Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
0
votes
1answer
43 views
Logging the Instruction Pointer Register
Is there a tool that logs the value the IP register of a specific process running?
I am trying to compare the instruction excution before and after a file modification.
2
votes
1answer
27 views
When reopening file lose all information in radare2
I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file.
any help to avoid this?
0
votes
0answers
41 views
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.
I ...
1
vote
1answer
35 views
Is there watchpoints in radare2?
Is there any way to put breakpoints in radare2 that trigger when an address is read/write?
In GDB those are call watchpoints ('rwatch' or 'awatch")
I got this from radare2
[0xB7F08810]> !dr?
...
0
votes
1answer
69 views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
2
votes
0answers
46 views
Does pwntools provide any Radare2 integration?
I want to use pwntools with Radare2, since this is my debugger of choice.
However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb).
Anyone with experience in ...
1
vote
0answers
25 views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
0
votes
1answer
72 views
how watchpoint on register works
GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ?
Is there a way to make it work for lldb also ?
*...
2
votes
0answers
50 views
Radare2 cannot place a breakpoint on a MIPS code
I am doing a crack-me challenge, I would like to execute it to see v0 and v1 values.
This is the file command's output :
./ch27.bin: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), ...
2
votes
1answer
107 views
How to print eax value with Radare2?
I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
0
votes
1answer
89 views
Tricore debugging tools
I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM.
Now I would like to learn about Tricore reverse engineering... ECUs mainly.
I can obtain the ECU ...
1
vote
2answers
63 views
Generate software breakpoint other than int3
Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example?
If so, I was wondering why debuggers don't support generating ...
1
vote
1answer
70 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
7
votes
3answers
2k views
OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?
OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
0
votes
1answer
35 views
Does the Radare Debugger support STABS?
From the wiki on Stabs
stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers.
Does Radare ...
1
vote
1answer
266 views
x64dbg how to watch all changes after one step
We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?
x64dbg 32bit version trace:
NEW UPDATE
...
0
votes
1answer
93 views
GDB MI output vs. stdout
I am using GDBs machine interface (mi) to write some simple tracers/loggers.
Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout.
If I look ...
2
votes
2answers
2k views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
3
votes
1answer
143 views
Disassembly - Why the CMP instruction is multiplying by 2 the value being compared
I'll get right to the point, I have a crack me program, that is a program with a password inside that needs to be found so that you can complete the challenge.
I easily found the cmp instruction ...
2
votes
1answer
99 views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
0
votes
2answers
154 views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
1
vote
1answer
32 views
EDB /usr/bin/xterm
Currently, I am debugging a CLI application that requires a lot of big inputs.
Can I change the default /usr/bin/xterm in edb to something like /bin/bash?
3
votes
0answers
128 views
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere ...
1
vote
1answer
109 views
IDA PRO does miss calls when tracing
I am following this tutorial:
enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program.
I though ...
2
votes
1answer
119 views
Cannot open '/proc/…/maps': No such file or directory in radare2 debug mode
When I try to load a program to radare2 debug mode, most of the time I get the following error:
$sudo r2 -d a.out
Hello world!= attach 2851 2851
Cannot open '/proc/2851/maps': No such file or ...
2
votes
0answers
171 views
Seeking front end for MinGW gdb debugger
We are unit testing with Vectorcast, which uses the MinGW tool chain on Windows.
It launches the command line gdb, but some of the newer engineers are having problems getting to grips with something ...
1
vote
1answer
466 views
Installed IDA 7.0 Freeware — no debugger, is that installed separately? [duplicate]
After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured ...
2
votes
0answers
76 views
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.
Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.
However, whenever I try to debug ...
1
vote
2answers
259 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
0
votes
1answer
1k views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
2
votes
2answers
1k views
How do you use the Radare debugger with command line arguments (parameters)?
If I want to debug ls I can run,
radare -d /bin/ls
But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
3
votes
1answer
384 views
Why most debuggers don't auto recognize functions?
may anyone explain to me why most of the debuggers don't auto recognize functions?
This is a feature I only found in IDA and ollydbg, any other debugger I tried just don't analyze the functions as ...
1
vote
1answer
536 views
Simple Debugger and Hardware BreakPoints in x64 Windows 10
I have coded a very simple Debugger for x64, I am using currently Win10.
I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows:
inline void SETBITS(DWORD64 *dw, ...
0
votes
2answers
151 views
Techniques for marking memory changes
i'm using IDA to reverse some crypto code that seems to derive its key from some hashing functions. I have recognized the algoritm based on magic numbers, but i want to see its changes in memory ...
2
votes
0answers
140 views
How can I fix an unpacked binary which calls out-of-bounds memory?
I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
4
votes
2answers
836 views
How to label local variables in x64dbg
As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:
I found no way to label locals in the debugger ...
1
vote
1answer
681 views
Find what writes to a dynamic memory address
I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
6
votes
3answers
2k views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
0
votes
1answer
120 views
Detecting user<->kernel transitions with hypervisor
Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
0
votes
1answer
585 views
I'd like to ask about unpacking aspack 2.12
I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
2
votes
1answer
2k views
I'm unable to copy to executable (ollydebug)
I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
1
vote
2answers
175 views
How to debug binwalk tool?
My lecturers have requested that I debug binwalk in order to understand how it works and develop new features so that it can extract more. I tried to use gdb to debug binwalk but it results in the ...
0
votes
1answer
899 views
Calling DLL exports in x64dbg
I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
1
vote
1answer
3k views
Access violation when reading [OLLYDEBUG]
Any time I try to crack a program I get this error in olly:
What causes this error? How can I fix this?
If anyone has suggestion or advice that would be great. I already tried pressing F9 but that ...
3
votes
1answer
1k views
Reversing a program with dongle
So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start.
From looking through the disassembly ...
1
vote
1answer
87 views
Log modified memory locations when tracing with Ollydbg
When you trace with Ollydbg it prints the register values near commands that modify them. Is there any way to get it to print some memory locations, of my choice, when modified?
1
vote
2answers
99 views
What is the relationship between .NET and x86-64 assembly?
I'm gathering that it's nearly a waste of time to try to reverse .NET applications in a native debugger. But why? Of course the computer is executing machine code in the end, not CIL. So what clutters ...
0
votes
1answer
81 views
Where can I get systematic problems and solutions for debugging?
I know PEFile headers, assembly language, and other basic stuff.
I am looking for some site or book which systematically teaches me debugging and reversing. Something like "Let us C" for C language.
...
3
votes
1answer
9k views
How to switch to “Graph View” in IDA Pro while debugging with WinDbg inside a system DLL?
While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view:
That will switch it to this nice code-...
1
vote
0answers
704 views
Error: the file can't be loaded by debugger plupin IDA PRO 64 bit
I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
