Skip to main content

Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
123 votes
2 answers
100k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
0xC0000022L's user avatar
  • 10.9k
102 votes
20 answers
142k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
mrduclaw's user avatar
  • 4,066
32 votes
5 answers
57k views

How do I acquire SoftICE?

I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
amccormack's user avatar
  • 1,326
31 votes
5 answers
57k views

What is the linux equivalent to OllyDbg and Ida Pro?

What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
k170's user avatar
  • 453
21 votes
4 answers
25k views

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

OllyDbg had been nice in the past, but it stopped development a decade ago, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't ...
T.Todua's user avatar
  • 643
16 votes
1 answer
3k views

Malware Hooking INT 1 and INT 3

I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
mrduclaw's user avatar
  • 4,066
15 votes
4 answers
4k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
RcketCalf's user avatar
  • 153
14 votes
4 answers
7k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
shebaw's user avatar
  • 685
14 votes
4 answers
7k views

Creating IDA Pro debugger plugins - API documentation and examples?

Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
dingo_kinznerhook's user avatar
12 votes
2 answers
16k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
Daniel Filipe's user avatar
12 votes
2 answers
5k views

Extract non-extractable private key from OS X Keychain

I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4. Basically, it appears that security import has a -x option to ...
cnst's user avatar
  • 299
11 votes
3 answers
15k views

How can I prevent Immunity Debugger / OllyDbg from breaking on attach?

When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ...
Polynomial's user avatar
  • 1,272
11 votes
1 answer
14k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
user avatar
11 votes
1 answer
360 views

Thread-Switching with PyDbg

I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious. Basically, I want ...
Unix-dude's user avatar
  • 111
10 votes
3 answers
18k views

Reverse engineer Android native code

I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
msk's user avatar
  • 109
10 votes
2 answers
810 views

How can I analyze a program that uses a JIT compiled code?

A lot of code I encounter today has a considerable amount of code generated at runtime, making analysis extremely laborious and time consuming. Is there any way I can create symbolic names for the ...
zetavolt's user avatar
  • 1,213
10 votes
1 answer
3k views

How to handle exceptions in a debugger when reversing malware?

I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
user2142's user avatar
  • 1,537
9 votes
1 answer
20k views

Immunity Debugger on Windows 10?

Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or ...
Starwarsfan2099's user avatar
9 votes
1 answer
11k views

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
Dirk's user avatar
  • 443
9 votes
1 answer
11k views

How to debug DLL imported from an application?

I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
studentofmp's user avatar
9 votes
1 answer
678 views

How does GDB's process recording work?

A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...
zetavolt's user avatar
  • 1,213
9 votes
1 answer
974 views

Annotating the Stack in GDB?

Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
David's user avatar
  • 285
9 votes
2 answers
10k views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
stacksmasher's user avatar
8 votes
3 answers
7k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
pizzaEatingGuy's user avatar
8 votes
2 answers
25k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
bernd feinman's user avatar
8 votes
1 answer
8k views

WinDbg fails to connect to IDA Pro debugger server

Environment: Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg Guest: Win7 SP1 x64 I have VirtualKD setup correctly in my guest and host. I say this because ...
Lelouch Lamperouge's user avatar
7 votes
2 answers
22k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
Pervy Sage's user avatar
  • 1,205
7 votes
3 answers
3k views

Debugging NewExecutable binaries

I'm trying to debug a 16-bit Windows executable (format: New Executable). The problem is that all the standard tools (W32DASM, IDA, Olly) don't seem to support 16-bit debugging. Can you suggest any ...
heinrich5991's user avatar
7 votes
1 answer
25k views

How to debug (like gdb) with radare2?

I am new to radare2 and Linux. I got problem with r2. As the title states it, many tutorials, articles, videos about r2 are just about disassembling programs, and read assembly codes. But, I want ...
hachzz's user avatar
  • 81
7 votes
2 answers
2k views

What is difference between Digital Forensic and Reverse Engineering

I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
Pranit Kothari's user avatar
7 votes
1 answer
435 views

How can I check I've moved outside the stack without triggering a protection fault?

I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...
zetavolt's user avatar
  • 1,213
7 votes
1 answer
12k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
user121314's user avatar
7 votes
2 answers
5k views

How to label local variables in x64dbg

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned: I found no way to label locals in the debugger ...
Viacheslav Kroilov's user avatar
7 votes
2 answers
2k views

Ollydbg target runs automatically

I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.) Is ...
Arunabh Ray's user avatar
7 votes
2 answers
2k views

"Debugged application has modified the debugging registers" with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
user3097712's user avatar
  • 1,541
7 votes
1 answer
132 views

Which format/tool to store 'basic' informations?

It's really a productivity bottleneck when various analysis tools can't share information. What's an efficient way to store symbols+comments+structures, so that they can be easily imported into other ...
Ange's user avatar
  • 6,694
7 votes
1 answer
453 views

Attaching gdb to hidden library/process

On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. The ...
Joe Habadas's user avatar
6 votes
1 answer
28k views

How to switch to "Graph View" in IDA Pro while debugging with WinDbg inside a system DLL?

While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view: That will switch it to this nice code-...
c00000fd's user avatar
  • 1,691
6 votes
1 answer
8k views

Is it possible to find static pointer with disassembler?

I found an assembler instruction: mov [esi+2F],dl. I think ESI is a reference to a struct or class. 0x2F is the offset that references a property of the struct/class. Is it possible to find the value ...
tested's user avatar
  • 63
6 votes
2 answers
3k views

OllyDbg: Automatically extract string when breakpoint is hit

Given a breakpoint at an expression MOV EDI, EAX, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?
Martin Vogel's user avatar
6 votes
1 answer
643 views

Dalvik Byte code instrumentation framwork for dynamic data dependency analysis

I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
P basak's user avatar
  • 161
5 votes
1 answer
2k views

What is the command to "go to current statement" in IDA debugger?

I'm trying to learn how to use the IDA pro debugger (having used Visual Studio's C++ debugger for years) and I'm struggling to find how to switch the code/asm view back to the current instruction that ...
c00000fd's user avatar
  • 1,691
5 votes
2 answers
15k views

How can i add plugins in x64dbg?

I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger. Its installation instructions are not working.
crotonain's user avatar
5 votes
1 answer
13k views

How to reverse a dll and call its functions?

I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
FreeMind's user avatar
  • 639
5 votes
1 answer
618 views

Cannot trace an MS-DOS COM file

When debugging the following com file in MS-DOS, I can successfully run the program with -g and it terminates normally, but when I trace it -t 1000, the program throws an illegal operation exception ...
Johnny Cache's user avatar
5 votes
0 answers
394 views

Instruction counting anti-debug

I recently came across this anti-debug technique being used in the wild. In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section A debugger will interfere ...
P. Private's user avatar
4 votes
1 answer
3k views

Displaying IDA names in x64dbg or OllyDbg

I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
SRobertJames's user avatar
4 votes
1 answer
4k views

how to attach to a process as soon as it is loaded in memory

I want to attach OllyDbg or IDA to a process as soon as it is loaded in memory before a single instruction of it being executed. How do I do This??? I cant use File->Open for some reason. I can only ...
ASHUTOSH's user avatar
  • 203
4 votes
2 answers
6k views

How do you use the Radare debugger with command line arguments (parameters)?

If I want to debug ls I can run, radare -d /bin/ls But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
Evan Carroll's user avatar
  • 1,789
4 votes
2 answers
13k views

How to set a conditional breakpoint on specific register value in OllyDbg?

I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg. How can i do that ? I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is ...
studentofmp's user avatar

1
2 3 4 5