Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
15 votes
4 answers

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
RcketCalf's user avatar
  • 153
123 votes
2 answers

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
0xC0000022L's user avatar
  • 10.9k
101 votes
20 answers

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
mrduclaw's user avatar
  • 4,056
14 votes
4 answers

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
shebaw's user avatar
  • 685
12 votes
2 answers

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
Daniel Filipe's user avatar
14 votes
4 answers

Creating IDA Pro debugger plugins - API documentation and examples?

Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
dingo_kinznerhook's user avatar
9 votes
1 answer

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
Dirk's user avatar
  • 443
32 votes
5 answers

How do I acquire SoftICE?

I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
amccormack's user avatar
  • 1,326
9 votes
1 answer

Immunity Debugger on Windows 10?

Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or ...
Starwarsfan2099's user avatar
8 votes
3 answers

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
pizzaEatingGuy's user avatar
7 votes
2 answers

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
Pervy Sage's user avatar
  • 1,195
7 votes
2 answers

"Debugged application has modified the debugging registers" with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
user3097712's user avatar
  • 1,531
7 votes
1 answer

Attaching gdb to hidden library/process

On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. The ...
Joe Habadas's user avatar
4 votes
2 answers

How to set a conditional breakpoint on specific register value in OllyDbg?

I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg. How can i do that ? I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is ...
studentofmp's user avatar
1 vote
1 answer

How do you change the stack width/offset in radare2?

Currently, my stack view is 0x10 (16) bytes long. How do I change it so that the stack view is 8 bytes long? Edit: I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
user40683's user avatar
1 vote
2 answers

How to print from pointers in radare2 in debug session

when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction 0x08048498 8b4508 mov eax, dword [ebp+arg2] ...
u185619's user avatar
  • 335
0 votes
1 answer

Anti-kernelmode functions (specifically zwquerysysteminformation) [closed]

I'm working on a program that has lots of checks, and I've decided to start by disabling their anti-kernel mode, as it'd surely be more easy to isolate than normal anti-debugging. After poking around ...
asd's user avatar
  • 3
0 votes
0 answers

How to access and modify data segment when doing hardware breakpoint crashes the application?

I want to modify the data segment in the x64_DBG, however, I don't know how to access it. lea r8,qword ptr ds:[7FEF0CA6AD8] In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I ...
FreeMind's user avatar
  • 629
-3 votes
2 answers

Anti-debug techniques for MS-Windows?

Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !
Ahmed's user avatar
  • 135