Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
100
votes
1answer
75k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
84
votes
17answers
105k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
27
votes
5answers
48k views

How do I acquire SoftICE?

I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
25
votes
5answers
39k views

What is the linux equivalent to OllyDbg and Ida Pro?

What is the Linux equivalent to OllyDbg and IDA Pro ? Or if there are multiple tools that do the various functions that OllyDbg and IDA Pro do, where can I find these tools? I'd like to start ...
15
votes
1answer
2k views

Malware Hooking INT 1 and INT 3

I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
13
votes
4answers
3k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
13
votes
4answers
5k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
13
votes
4answers
6k views

Creating IDA Pro debugger plugins - API documentation and examples?

Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
12
votes
2answers
13k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
10
votes
3answers
13k views

How can I prevent Immunity Debugger / OllyDbg from breaking on attach?

When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ...
10
votes
2answers
3k views

Extract non-extractable private key from OS X Keychain

I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4. Basically, it appears that security import has a -x option to ...
10
votes
1answer
338 views

Thread-Switching with PyDbg

I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious. Basically, I want ...
9
votes
2answers
462 views

How can I analyze a program that uses a JIT compiled code?

A lot of code I encounter today has a considerable amount of code generated at runtime, making analysis extremely laborious and time consuming. Is there any way I can create symbolic names for the ...
8
votes
4answers
12k views

OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?

OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
8
votes
1answer
13k views

Immunity Debugger on Windows 10?

Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or ...
8
votes
3answers
15k views

Reverse engineer Android native code

I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
8
votes
1answer
10k views

How to debug DLL imported from an application?

I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
8
votes
1answer
6k views

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
8
votes
1answer
562 views

How does GDB's process recording work?

A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...
8
votes
1answer
2k views

How to handle exceptions in a debugger when reversing malware?

I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
7
votes
2answers
13k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
7
votes
1answer
9k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
7
votes
1answer
7k views

WinDbg fails to connect to IDA Pro debugger server

Environment: Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg Guest: Win7 SP1 x64 I have VirtualKD setup correctly in my guest and host. I say this because ...
7
votes
2answers
2k views

“Debugged application has modified the debugging registers” with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
6
votes
3answers
2k views

Debugging NewExecutable binaries

I'm trying to debug a 16-bit Windows executable (format: New Executable). The problem is that all the standard tools (W32DASM, IDA, Olly) don't seem to support 16-bit debugging. Can you suggest any ...
6
votes
3answers
4k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
6
votes
1answer
21k views

How to debug (like gdb) with radare2?

I am new to radare2 and Linux. I got problem with r2. As the title states it, many tutorials, articles, videos about r2 are just about disassembling programs, and read assembly codes. But, I want ...
6
votes
1answer
6k views

Is it possible to find static pointer with disassembler?

I found an assembler instruction: mov [esi+2F],dl. I think ESI is a reference to a struct or class. 0x2F is the offset that references a property of the struct/class. Is it possible to find the value ...
6
votes
2answers
1k views

What is difference between Digital Forensic and Reverse Engineering

I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
6
votes
1answer
405 views

How can I check I've moved outside the stack without triggering a protection fault?

I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...
6
votes
1answer
8k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
6
votes
1answer
812 views

Annotating the Stack in GDB?

Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
6
votes
1answer
123 views

Which format/tool to store 'basic' informations?

It's really a productivity bottleneck when various analysis tools can't share information. What's an efficient way to store symbols+comments+structures, so that they can be easily imported into other ...
6
votes
1answer
341 views

Attaching gdb to hidden library/process

On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. The ...
5
votes
2answers
3k views

OllyDbg: Automatically extract string when breakpoint is hit

Given a breakpoint at an expression MOV EDI, EAX, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?
5
votes
1answer
10k views

How to reverse a dll and call its functions?

I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
5
votes
2answers
2k views

Ollydbg target runs automatically

I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.) Is ...
5
votes
2answers
2k views

How to label local variables in x64dbg

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned: I found no way to label locals in the debugger ...
5
votes
1answer
632 views

Dalvik Byte code instrumentation framwork for dynamic data dependency analysis

I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
4
votes
1answer
15k views

How to switch to “Graph View” in IDA Pro while debugging with WinDbg inside a system DLL?

While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view: That will switch it to this nice code-...
4
votes
1answer
438 views

Cannot trace an MS-DOS COM file

When debugging the following com file in MS-DOS, I can successfully run the program with -g and it terminates normally, but when I trace it -t 1000, the program throws an illegal operation exception ...
4
votes
1answer
733 views

How to do debug a running java process in linux?

TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done. I expect that this is a well-solved problem, but I lack the ...
4
votes
1answer
595 views

Where to start with iOS debugging?

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
3
votes
3answers
2k views

Find Address of Windows Kernel Functions

How can I find the address of a Windows kernel function? In this case I'm trying to find CreateThread. Can this be done from a debugger? Olly/Immunity?
3
votes
3answers
5k views

Check DEP , ASLR and SafeSEH enabled or not , immlib

How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ? Actually I am looking for small code snippet for each.
3
votes
1answer
2k views

Displaying IDA names in x64dbg or OllyDbg

I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
3
votes
2answers
9k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
3
votes
1answer
1k views

What is the command to “go to current statement” in IDA debugger?

I'm trying to learn how to use the IDA pro debugger (having used Visual Studio's C++ debugger for years) and I'm struggling to find how to switch the code/asm view back to the current instruction that ...
3
votes
1answer
2k views

how to attach to a process as soon as it is loaded in memory

I want to attach OllyDbg or IDA to a process as soon as it is loaded in memory before a single instruction of it being executed. How do I do This??? I cant use File->Open for some reason. I can only ...
3
votes
2answers
12k views

How to set a conditional breakpoint on specific register value in OllyDbg?

I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg. How can i do that ? I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is ...