Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
19
questions
15
votes
4
answers
4k
views
Debugging malware that will only run as a service
I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
- 153
123
votes
2
answers
100k
views
How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?
I have GDB but the binary I want to reverse engineer dynamically has no symbols. That is, when I run the file utility it shows me stripped:
ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
- 10.9k
102
votes
20
answers
142k
views
Decent GUI for GDB
Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
- 4,066
14
votes
4
answers
7k
views
Debugger hiding plugin for WinDbg?
Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
- 685
12
votes
2
answers
17k
views
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
My ...
- 223
14
votes
4
answers
7k
views
Creating IDA Pro debugger plugins - API documentation and examples?
Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
- 1,026
9
votes
1
answer
11k
views
How to find the location of the vtable?
Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following:
The main point to realize is that whenever we declare a C++ class
with virtual ...
- 443
32
votes
5
answers
58k
views
How do I acquire SoftICE?
I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
- 1,326
9
votes
1
answer
20k
views
Immunity Debugger on Windows 10?
Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or ...
- 345
8
votes
3
answers
7k
views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
- 181
7
votes
2
answers
2k
views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
- 1,541
7
votes
2
answers
22k
views
What's the difference between a disassembler, debugger and decompiler?
I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
- 1,215
7
votes
1
answer
456
views
Attaching gdb to hidden library/process
On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file.
The ...
- 171
4
votes
2
answers
13k
views
How to set a conditional breakpoint on specific register value in OllyDbg?
I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg.
How can i do that ?
I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is ...
- 317
1
vote
2
answers
8k
views
How to print from pointers in radare2 in debug session
when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction
0x08048498 8b4508 mov eax, dword [ebp+arg2]
...
- 335
1
vote
1
answer
323
views
How do you change the stack width/offset in radare2?
Currently, my stack view is 0x10 (16) bytes long.
How do I change it so that the stack view is 8 bytes long?
Edit:
I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
- 63
0
votes
0
answers
204
views
How to access and modify data segment when doing hardware breakpoint crashes the application?
I want to modify the data segment in the x64_DBG, however, I don't know how to access it.
lea r8,qword ptr ds:[7FEF0CA6AD8]
In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I ...
- 639
0
votes
1
answer
1k
views
Anti-kernelmode functions (specifically zwquerysysteminformation) [closed]
I'm working on a program that has lots of checks, and I've decided to start by disabling their anti-kernel mode, as it'd surely be more easy to isolate than normal anti-debugging. After poking around ...
- 3
-3
votes
2
answers
3k
views
Anti-debug techniques for MS-Windows?
Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !
- 135