Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
207
questions
0
votes
1
answer
5k
views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
CommunityBot
- 1
1
vote
0
answers
50
views
Process stuck on the entry point
I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11.
The current problem with it is that when running the exe file nothing seems to ...
- 21
0
votes
0
answers
56
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 10.9k
9
votes
2
answers
8k
views
How to do debug a running java process in linux?
TLDR I want to do live debugging of a java program on a linux machine, and don't how/what debugger to attach to the JVM to get this done.
I expect that this is a well-solved problem, but I lack the ...
9
votes
1
answer
965
views
Annotating the Stack in GDB?
Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
- 18.9k
3
votes
1
answer
426
views
Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)
I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it").
I found that user to have the most ...
- 11
101
votes
20
answers
138k
views
Decent GUI for GDB
Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
- 257
123
votes
2
answers
97k
views
How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?
I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped:
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
- 111
3
votes
0
answers
231
views
How to do live debugging of ARM64 binaries on macOS with M1/M2 chips?
I'm trying to figure out why NSSavePanel fails in my SwiftUI app. I tried every possible documentation, or asking on the Swift programming forums - to no avail.
I'm originally a Windows programmer, ...
- 1,639
3
votes
0
answers
66
views
x32dbg version causes crash on breakpoint
i'm a newbie to this whole shindig, and have started with https://gamehacking.academy. i'm finding this fun, but am getting stuck here: when i try to apply a breakpoint using x32dbg, as in https://...
1
vote
1
answer
173
views
Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender
In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
CommunityBot
- 1
3
votes
0
answers
498
views
Ghidra view stack frame values
I'm learning reverse engineering, and I'm using Ghidra's debugger to analyze a running program. I want to view the values that are on the stack for a function, but I can't figure out how to do this.
I'...
- 103
2
votes
1
answer
3k
views
Program prevents x64dbg from starting or kills it if it's already running. What to do?
I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows.
It looks like the program has some sort of anti-debug protection. I have the following behavior:
...
CommunityBot
- 1
2
votes
1
answer
360
views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
CommunityBot
- 1
4
votes
1
answer
171
views
How to debug cfg80211.ko
I have an Linux embedded device that I want to debug the cfg80211.ko
I have full root SSH on that device.
How can I debug cfg80211.ko?
CommunityBot
- 1
1
vote
1
answer
404
views
How to debug a malware that does DLL injection into explorer.exe?
What steps would you suggest for debugging a malware that injects a DLL into explorer.exe?
using X32dbg
have already attached explorer.exe to x32dbg
CommunityBot
- 1
1
vote
0
answers
64
views
debug native code and net code
I have a .net dll with a lot of calculations and formulas.
From this dll, I want to set breakpoints to see the calculated results for a specific field.
The main program is written in native code. So, ...
- 11
1
vote
2
answers
610
views
Why IDA debugger on android doesn't show all threads?
My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file.
Here's what I've done:
download a x86_64 system image android emulator from android studio
install that .apk ...
- 59
3
votes
1
answer
247
views
How to use software watchpoints in LLDB?
After trying to use watch command, LLDB said the device had 0 available hardware watchpoints. In GDB you can use
set can-use-hw-watchpoints 0
How do you disable hardware watchpoints in LLDB?
- 459
4
votes
1
answer
543
views
Does pwntools provide any Radare2 integration?
I want to use pwntools with Radare2, since this is my debugger of choice.
However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb).
Anyone with experience in ...
- 111
2
votes
1
answer
309
views
x64dbg : TraceInto only in user code
The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
- 136
1
vote
0
answers
423
views
x64dbg isn't running the program I'm looking at
I'm almost definitely being an idiot but I have opened up an .exe file in x64dbg and I can run the file just fine when looking at the assembly but it doesn't open a second window so I can see the ...
- 11
1
vote
1
answer
230
views
How do you change the stack width/offset in radare2?
Currently, my stack view is 0x10 (16) bytes long.
How do I change it so that the stack view is 8 bytes long?
Edit:
I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
- 1,120
0
votes
2
answers
5k
views
How do I log a string in x64dbg?
This one should be simple, but I can't figure it out. How do I log a string in x64dbg? I can log the address with a breakpoint but wasn't able to log the actual text.
- 11
0
votes
1
answer
3k
views
Reversing a program with dongle
So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start.
From looking through the disassembly ...
- 1
1
vote
1
answer
388
views
Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"
I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:
0: kd> !process 0 0 WindowsProject1.exe
...
CommunityBot
- 1
2
votes
1
answer
446
views
Debugging Native Lib using IDA Pro Fails to Load Registers and other Information
Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
CommunityBot
- 1
1
vote
3
answers
1k
views
x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection
I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
- 61
8
votes
3
answers
7k
views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
- 105
1
vote
2
answers
1k
views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
CommunityBot
- 1
21
votes
4
answers
23k
views
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
OllyDbg had been nice in the past, but it stopped development a decade ago, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't ...
- 643
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 230
1
vote
1
answer
411
views
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
- 1,120
0
votes
1
answer
327
views
Can't add tracing in IDA, showing it in gray
I added read/write trace to a program. I was able to record the trace with IDA for the first time.
When I run it again, it didn't work.
I tried to do what I did on the first time, adding the read/...
- 573
1
vote
2
answers
891
views
How to search for process by name with WinDBG
I know how to list all the processes in the system by running:
0: kd>dx -r1 Debugger.Sessions[0].Processes
OR
0: kd>.tlist
But how can I search for a process by name?
I tried to use the ...
- 16.3k
2
votes
1
answer
569
views
Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"
I tried to debug a C++ that I created but I am getting the following error:
I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
- 66
2
votes
1
answer
799
views
GDB inserting breakpoint cause Segmentation Fault
I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
CommunityBot
- 1
5
votes
2
answers
14k
views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
- 1
1
vote
1
answer
105
views
Switch between debuggers while paused on a breakpoint
Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
- 36.4k
11
votes
1
answer
13k
views
What is the difference between step into and step over when debugging?
I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
- 2,521
1
vote
2
answers
485
views
Changing page permissions at runtime under a debugger
Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
- 111
1
vote
1
answer
905
views
[ARM]How does this checksum code works and how to revert it in C?
I am trying to reverse a simple code that gets a string and calculates it's checksum. I've been trying to understand every instruction, but they look different from what is said in arm documentation.
...
- 154
0
votes
1
answer
436
views
open decompiler view of current module (dll) in dynamic analysis
I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
- 123
0
votes
1
answer
482
views
Advanced Anti-Debugging Techniques
I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
- 56
0
votes
1
answer
186
views
Is it possible for a process to debug itself?
What happens if you try to debug yourself ? I mean, does the process crash ?
If it is possible, how would you implement it ?
I have tried launching x64dbg and I can't attach to my own x64dbg process.
...
- 36.4k
0
votes
2
answers
2k
views
Tricore debugging tools
I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM.
Now I would like to learn about Tricore reverse engineering... ECUs mainly.
I can obtain the ECU ...
0
votes
0
answers
232
views
x64dbg show some text in Chinese
While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why.
This happened after I moved to a new computer but both of them were Windows 10.
In my old computer I ...
- 573
0
votes
2
answers
648
views
ASM Debuggers that visualize the stack (beginner friendly)
(Cross-posted from Stack Overflow)
Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image:
I use gdb for most ...
- 4,701
0
votes
0
answers
1k
views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
- 1
2
votes
2
answers
761
views
Is there a way to tell the IDA debugger to apply all patches from the database?
I'm in the process of "enhancing" an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all ...
- 36.4k