Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
198
questions
1
vote
1answer
49 views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
0
votes
0answers
16 views
<"..." is not a valid class name"> when trying to debug an android app using jdb
I am trying to reverse engineer an android app for education purpose, but I ran into an annoying problem: the android app is obfuscated and some classnames start with digits.
So when I tried putting a ...
1
vote
0answers
94 views
Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)
I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it").
I found that user to have the most ...
1
vote
3answers
132 views
x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection
I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
0answers
28 views
Hardware Breakpoint wont work on address created during runtime
I am currently trying to crack a crackme.exe. Before the jump, it compares the following (0 == not registered):
cmp byte ptr ds:[eax+0x15FC], 0x0
If I normally load the .exe and try to go to the ...
1
vote
1answer
52 views
Debugging Native Lib using IDA Pro Fails to Load Registers and other Information
Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
1
vote
2answers
99 views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1answer
86 views
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
1
vote
1answer
136 views
Why IDA debugger on android doesn't show all threads?
My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file.
Here's what I've done:
download a x86_64 system image android emulator from android studio
install that .apk ...
0
votes
1answer
35 views
Can't add tracing in IDA, showing it in gray
I added read/write trace to a program. I was able to record the trace with IDA for the first time.
When I run it again, it didn't work.
I tried to do what I did on the first time, adding the read/...
1
vote
2answers
95 views
How to search for process by name with WinDBG
I know how to list all the processes in the system by running:
0: kd>dx -r1 Debugger.Sessions[0].Processes
OR
0: kd>.tlist
But how can I search for a process by name?
I tried to use the ...
0
votes
1answer
47 views
Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"
I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:
0: kd> !process 0 0 WindowsProject1.exe
...
2
votes
1answer
104 views
Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"
I tried to debug a C++ that I created but I am getting the following error:
I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
0
votes
0answers
115 views
Process close when try attach some debugger
I'm begin with reverse engineering, because I want to create some new functions to the "game server". That is, I want to inject(hook dll) in this game. **The source code of project not is ...
1
vote
1answer
46 views
Switch between debuggers while paused on a breakpoint
Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
1
vote
1answer
171 views
GDB inserting breakpoint cause Segmentation Fault
I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
0
votes
0answers
327 views
x64dbg for linux executables?
Is there a x64dbg for Linux executables? I really love x64dbg, but in a lot of CTF challenges there are Linux executables and not .exe files or .dll files.
1
vote
2answers
48 views
Changing page permissions at runtime under a debugger
Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
0
votes
1answer
502 views
Program prevents x64dbg from starting or kills it if it's already running. What to do?
I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows.
It looks like the program has some sort of anti-debug protection. I have the following behavior:
...
0
votes
1answer
68 views
open decompiler view of current module (dll) in dynamic analysis
I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
0
votes
1answer
68 views
Is it possible for a process to debug itself?
What happens if you try to debug yourself ? I mean, does the process crash ?
If it is possible, how would you implement it ?
I have tried launching x64dbg and I can't attach to my own x64dbg process.
...
0
votes
0answers
105 views
x64dbg show some text in Chinese
While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why.
This happened after I moved to a new computer but both of them were Windows 10.
In my old computer I ...
0
votes
2answers
162 views
ASM Debuggers that visualize the stack (beginner friendly)
(Cross-posted from Stack Overflow)
Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image:
I use gdb for most ...
0
votes
0answers
294 views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
1
vote
0answers
250 views
Recommended plugins for x64dbg
I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks.
The more you can ...
1
vote
1answer
132 views
Is `movq rax, xmm0` buggy in Radare2?
Why doesn't rax get loaded from xmm0 here? radare2 bug?
GitHub issue `movq rax, xmm0` doesn't work in native debugger filed.
[0x0003b0e0]> drr
role reg value ref
―――――――――――――――――――...
0
votes
3answers
447 views
How To Identify Which Process Is Being Written To With WriteProcessMemory?
Basically, I cannot find which process is being written to when WriteProcessMemory is being called.
Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
0
votes
1answer
611 views
Evan's debugger (edb) - Failed to open and attach to process: execv() failed: No such file or directory
Problem:
When I try to open an executable (in this case exploit exercises protostar stack0), then the following message appears in a pop-up box:
Failed to open and attach to process: execv() failed: ...
0
votes
0answers
313 views
Using IDA pro 7.2 and android server breakpoints problem
i have been trying to use IDA to make a breakpoints on a 4 byte memory address
to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
3
votes
0answers
43 views
IDA's debuggers disappeared
Using IDA 7
I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
0
votes
0answers
65 views
Immunity Debuggger Inconsistent Results
Question for people using Immunity Debugger.
Just started using Immunity Debugger, using 1.85 on Win 7 Pro.
Doing some labs on vulnserver.exe and I am getting inconsistent results from Immunity ...
0
votes
0answers
1k views
In X64dbg, how can I script a string write to memory?
I find that I can write to memory as
[addr] = value
As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html
And while I could work around my problem as dividing ...
1
vote
2answers
938 views
Difference between 32 bit and 64 bit disassemblers
As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
0
votes
0answers
195 views
Issues with Symbols when running windbg on windows xp sp3
I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
1
vote
0answers
803 views
Ida permission error
I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
1
vote
0answers
223 views
UTF8, UTF16 encoding string search
I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them..
P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
0answers
83 views
How to find function called by instantaneous event (like mouse press for exemple)
I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me.
I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what ...
0
votes
1answer
774 views
Remote debugging using IDA, connecting to windbg server (kernel mode)
I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
5
votes
1answer
4k views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
0
votes
1answer
332 views
Advanced Anti-Debugging Techniques
I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
0
votes
0answers
208 views
OllyDbg - After restarting program, breakpoints lost
I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
3
votes
0answers
171 views
How to redirect stdin in OllyDbg?
When I use IDA, I can use stdin from the file as in bash.
When I tried to do it in OllyDbg, it processed the parameters simply as a string.
Can I redirect stdin in OllyDbg?
-1
votes
1answer
80 views
Logging the Instruction Pointer Register
Is there a tool that logs the value the IP register of a specific process running?
I am trying to compare the instruction excution before and after a file modification.
2
votes
1answer
342 views
When reopening file lose all information in radare2
I have problem with my radare2, when I try to reopen file in debug mode (ood) my radare loses all informations about that file.
any help to avoid this?
0
votes
0answers
85 views
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.
I ...
1
vote
1answer
349 views
Is there watchpoints in radare2?
Is there any way to put breakpoints in radare2 that trigger when an address is read/write?
In GDB those are call watchpoints ('rwatch' or 'awatch")
I got this from radare2
[0xB7F08810]> !dr?
...
-1
votes
1answer
3k views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
3
votes
0answers
225 views
Does pwntools provide any Radare2 integration?
I want to use pwntools with Radare2, since this is my debugger of choice.
However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb).
Anyone with experience in ...
1
vote
0answers
87 views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
2
votes
1answer
430 views
how watchpoint on register works
GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ?
Is there a way to make it work for lldb also ?
*...
