Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
207
questions
123
votes
2
answers
96k
views
How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?
I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped:
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
- 10.9k
100
votes
20
answers
137k
views
Decent GUI for GDB
Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
- 4,036
32
votes
5
answers
56k
views
How do I acquire SoftICE?
I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
- 1,326
30
votes
5
answers
54k
views
What is the linux equivalent to OllyDbg and Ida Pro?
What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
- 433
21
votes
4
answers
23k
views
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
OllyDbg had been nice in the past, but it stopped development a decade ago, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't ...
- 643
16
votes
1
answer
3k
views
Malware Hooking INT 1 and INT 3
I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
- 4,036
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 153
14
votes
4
answers
6k
views
Debugger hiding plugin for WinDbg?
Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
- 685
14
votes
4
answers
7k
views
Creating IDA Pro debugger plugins - API documentation and examples?
Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
- 1,016
12
votes
2
answers
16k
views
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
My ...
- 223
12
votes
2
answers
5k
views
Extract non-extractable private key from OS X Keychain
I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4.
Basically, it appears that security import has a -x option to ...
- 299
11
votes
3
answers
15k
views
How can I prevent Immunity Debugger / OllyDbg from breaking on attach?
When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ...
- 1,252
11
votes
1
answer
13k
views
What is the difference between step into and step over when debugging?
I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
user4466
11
votes
1
answer
356
views
Thread-Switching with PyDbg
I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious.
Basically, I want ...
- 111
10
votes
3
answers
18k
views
Reverse engineer Android native code
I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
- 109
10
votes
2
answers
753
views
How can I analyze a program that uses a JIT compiled code?
A lot of code I encounter today has a considerable amount of code generated at runtime, making analysis extremely laborious and time consuming.
Is there any way I can create symbolic names for the ...
- 1,213
10
votes
1
answer
3k
views
How to handle exceptions in a debugger when reversing malware?
I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
- 1,527
9
votes
1
answer
19k
views
Immunity Debugger on Windows 10?
Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or ...
- 345
9
votes
1
answer
11k
views
How to debug DLL imported from an application?
I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
- 317
9
votes
1
answer
10k
views
How to find the location of the vtable?
Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following:
The main point to realize is that whenever we declare a C++ class
with virtual ...
- 443
9
votes
1
answer
630
views
How does GDB's process recording work?
A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...
- 1,213
9
votes
1
answer
958
views
Annotating the Stack in GDB?
Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
- 285
9
votes
2
answers
8k
views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
- 91
8
votes
3
answers
7k
views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
- 181
8
votes
1
answer
8k
views
WinDbg fails to connect to IDA Pro debugger server
Environment:
Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg
Guest: Win7 SP1 x64
I have VirtualKD setup correctly in my guest and host.
I say this because ...
7
votes
2
answers
21k
views
What's the difference between a disassembler, debugger and decompiler?
I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
- 1,185
7
votes
3
answers
3k
views
Debugging NewExecutable binaries
I'm trying to debug a 16-bit Windows executable (format: New Executable). The problem is that all the standard tools (W32DASM, IDA, Olly) don't seem to support 16-bit debugging.
Can you suggest any ...
- 627
7
votes
1
answer
25k
views
How to debug (like gdb) with radare2?
I am new to radare2 and Linux. I got problem with r2.
As the title states it, many tutorials, articles, videos about r2 are just about disassembling programs, and read assembly codes. But, I want ...
- 81
7
votes
2
answers
2k
views
What is difference between Digital Forensic and Reverse Engineering
I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
- 927
7
votes
1
answer
432
views
How can I check I've moved outside the stack without triggering a protection fault?
I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...
- 1,213
7
votes
2
answers
22k
views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
- 453
7
votes
1
answer
11k
views
How can I set breakpoint and get value of a register with IDApython
How can I set a breakpoint and get the value of the EAX register with IDApython?
I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
- 73
7
votes
2
answers
4k
views
How to label local variables in x64dbg
As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:
I found no way to label locals in the debugger ...
7
votes
2
answers
2k
views
Ollydbg target runs automatically
I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.)
Is ...
- 71
7
votes
2
answers
2k
views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
- 1,521
7
votes
1
answer
132
views
Which format/tool to store 'basic' informations?
It's really a productivity bottleneck when various analysis tools can't share information.
What's an efficient way to store symbols+comments+structures, so that they can be easily imported into other ...
- 6,674
7
votes
1
answer
413
views
Attaching gdb to hidden library/process
On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file.
The ...
- 171
6
votes
1
answer
26k
views
How to switch to "Graph View" in IDA Pro while debugging with WinDbg inside a system DLL?
While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view:
That will switch it to this nice code-...
- 1,517
6
votes
1
answer
7k
views
Is it possible to find static pointer with disassembler?
I found an assembler instruction: mov [esi+2F],dl. I think ESI is a reference to a struct or class. 0x2F is the offset that references a property of the struct/class. Is it possible to find the value ...
- 63
6
votes
2
answers
3k
views
OllyDbg: Automatically extract string when breakpoint is hit
Given a breakpoint at an expression MOV EDI, EAX, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?
- 63
6
votes
1
answer
641
views
Dalvik Byte code instrumentation framwork for dynamic data dependency analysis
I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
- 161
5
votes
1
answer
2k
views
What is the command to "go to current statement" in IDA debugger?
I'm trying to learn how to use the IDA pro debugger (having used Visual Studio's C++ debugger for years) and I'm struggling to find how to switch the code/asm view back to the current instruction that ...
- 1,517
5
votes
2
answers
14k
views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
- 51
5
votes
1
answer
13k
views
How to reverse a dll and call its functions?
I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
- 619
5
votes
1
answer
584
views
Cannot trace an MS-DOS COM file
When debugging the following com file in MS-DOS, I can successfully run the program with -g and it terminates normally, but when I trace it -t 1000, the program throws an illegal operation exception ...
- 51
5
votes
0
answers
370
views
Instruction counting anti-debug
I recently came across this anti-debug technique being used in the wild.
In The Ultimate Anti-Debugging Reference, the author wrote in the "Instruction Counting" section
A debugger will interfere ...
- 180
4
votes
1
answer
3k
views
Displaying IDA names in x64dbg or OllyDbg
I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
- 41
4
votes
1
answer
3k
views
how to attach to a process as soon as it is loaded in memory
I want to attach OllyDbg or IDA to a process as soon as it is loaded in memory before a single instruction of it being executed. How do I do This???
I cant use File->Open for some reason. I can only ...
- 203
4
votes
2
answers
6k
views
How do you use the Radare debugger with command line arguments (parameters)?
If I want to debug ls I can run,
radare -d /bin/ls
But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
- 1,769
4
votes
2
answers
13k
views
How to set a conditional breakpoint on specific register value in OllyDbg?
I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg.
How can i do that ?
I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is ...
- 317