Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
5
votes
3answers
3k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
0
votes
1answer
145 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
0
votes
1answer
709 views

I'd like to ask about unpacking aspack 2.12

I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
2
votes
1answer
3k views

I'm unable to copy to executable (ollydebug)

I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
1
vote
2answers
210 views

How to debug binwalk tool?

My lecturers have requested that I debug binwalk in order to understand how it works and develop new features so that it can extract more. I tried to use gdb to debug binwalk but it results in the ...
0
votes
1answer
1k views

Calling DLL exports in x64dbg

I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
1
vote
1answer
4k views

Access violation when reading [OLLYDEBUG]

Any time I try to crack a program I get this error in olly: What causes this error? How can I fix this? If anyone has suggestion or advice that would be great. I already tried pressing F9 but that ...
2
votes
1answer
1k views

Reversing a program with dongle

So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start. From looking through the disassembly ...
1
vote
1answer
98 views

Log modified memory locations when tracing with Ollydbg

When you trace with Ollydbg it prints the register values near commands that modify them. Is there any way to get it to print some memory locations, of my choice, when modified?
1
vote
2answers
102 views

What is the relationship between .NET and x86-64 assembly?

I'm gathering that it's nearly a waste of time to try to reverse .NET applications in a native debugger. But why? Of course the computer is executing machine code in the end, not CIL. So what clutters ...
0
votes
1answer
84 views

Where can I get systematic problems and solutions for debugging?

I know PEFile headers, assembly language, and other basic stuff. I am looking for some site or book which systematically teaches me debugging and reversing. Something like "Let us C" for C language. ...
4
votes
1answer
12k views

How to switch to “Graph View” in IDA Pro while debugging with WinDbg inside a system DLL?

While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view: That will switch it to this nice code-...
1
vote
0answers
803 views

Error: the file can't be loaded by debugger plupin IDA PRO 64 bit

I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
1
vote
2answers
258 views

Identifying DeviceIoControl argument

I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls. I found a reference to CreateFileA("\\.\Commsb96", GENERIC_READ | ...
2
votes
1answer
2k views

Getting pydbg working on windows 10

I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
0
votes
1answer
347 views

create a string in ollydbg, x32dbg, immunity or similar

I have found a code cave in an executable and want to call winapi functions. What do i have to write in the assembly window to create a string which can later be referenced? For learning i changed ...
1
vote
3answers
2k views

IDA Pro Debugging Window Closes in a Second!

Starting my RE adventures with IDA Pro, I'm opening a windows .exe file in it. While debugging the file, the debugger runs fine and exits with a return 1 value: Debugger: process has exited (exit code ...
0
votes
1answer
78 views

Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]

So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits. By, default, it doesn't allow keybind ...
1
vote
2answers
4k views

Getting past a whole lot of anti-debug measures for a windows exe

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
2
votes
1answer
541 views

WinDbg - RVA of current instruction

Do someone know a windbg command to display the RVA of a certain instruction within it's module? Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, ...
6
votes
1answer
7k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
0answers
751 views

Immunity Debugger Unable to set Breakpoint

I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try. The first error is that Immunity is 'Unable ...
1
vote
0answers
439 views

OllyDbg step over command not behaving exactly as the Immunity Debugger

I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching. In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
1
vote
0answers
406 views

Ignore Path and Extension in OllyDBG 2?

I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a ...
1
vote
1answer
665 views

[ARM]How does this checksum code works and how to revert it in C?

I am trying to reverse a simple code that gets a string and calculates it's checksum. I've been trying to understand every instruction, but they look different from what is said in arm documentation. ...
0
votes
1answer
2k views

How do I log a string in x64dbg?

This one should be simple, but I can't figure it out. How do I log a string in x64dbg? I can log the address with a breakpoint but wasn't able to log the actual text.
3
votes
3answers
2k views

Find Address of Windows Kernel Functions

How can I find the address of a Windows kernel function? In this case I'm trying to find CreateThread. Can this be done from a debugger? Olly/Immunity?
4
votes
1answer
519 views

Where to start with iOS debugging?

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
3
votes
1answer
2k views

Displaying IDA names in x64dbg or OllyDbg

I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
-1
votes
2answers
6k views

Attaching Ida to a process

I am a little new to ida. So don't judge on the question I am about to ask but I am tired chasing my tail around. I am trying to attach ida to a running process but I get the following error messages: ...
8
votes
1answer
12k views

Immunity Debugger on Windows 10?

Has anybody gotten Immunity Debugger to work on windows 10 yet? I downloaded it on Windows 10, launch it as administrator, and the GUI opens for about half a second and then it exits, no errors or ...
3
votes
1answer
975 views

What is the command to “go to current statement” in IDA debugger?

I'm trying to learn how to use the IDA pro debugger (having used Visual Studio's C++ debugger for years) and I'm struggling to find how to switch the code/asm view back to the current instruction that ...
1
vote
2answers
5k views

How to print from pointers in radare2 in debug session

when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction 0x08048498 8b4508 mov eax, dword [ebp+arg2] ...
0
votes
1answer
135 views

Get DLL name with PyDBG and System_dll.py?

Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just: dbg.set_callback(...
1
vote
0answers
250 views

immunity debugger MSVCR90.dll R6034

I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit ...
0
votes
1answer
101 views

What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?

In Core Debugger Concepts What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?
6
votes
1answer
18k views

How to debug (like gdb) with radare2?

I am new to radare2 and Linux. I got problem with r2. As the title states it, many tutorials, articles, videos about r2 are just about disassembling programs, and read assembly codes. But, I want ...
0
votes
0answers
158 views

How to access and modify data segment when doing hardware breakpoint crashes the application?

I want to modify the data segment in the x64_DBG, however, I don't know how to access it. lea r8,qword ptr ds:[7FEF0CA6AD8] In the above code, the address 7FEF0CA6AD8 is loaded in r8 register. I ...
5
votes
1answer
10k views

How to reverse a dll and call its functions?

I have got a custom.dll which is utilized in a larger application. The application executable imports this dll to use its functionality. But this functionality is not used through out the life cycle ...
1
vote
2answers
287 views

pydbg: Disassemble at $exentry and relative offset from $exentry

I am attempting to disassemble a test binary I compiled written in masm. Here are the follwing bytes: Microsoft (R) COFF/PE Dumper Version 10.00.40219.01 Copyright (C) Microsoft Corporation. All ...
-1
votes
2answers
2k views

How can I use an x64 debugger to reroute a .NET application's logic?

I'd like to improve my reverse engineering skills, so I made this WPF application (targeting x64, of course): MainWindow.xaml: <Window x:Class="ApplicationTest.MainWindow" xmlns="http://...
0
votes
1answer
862 views

Anti-kernelmode functions (specifically zwquerysysteminformation) [closed]

I'm working on a program that has lots of checks, and I've decided to start by disabling their anti-kernel mode, as it'd surely be more easy to isolate than normal anti-debugging. After poking around ...
1
vote
1answer
119 views

Chrome Vulnerability Issue

My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
0
votes
1answer
1k views

Windows debugger with ltrace functionality

I recently found the program: ltrace. And was wondering if it's possible to achieve the same using one of the gui debuggers for windows: ida, immunity, etc. The only thing I've found is a port of the ...
2
votes
1answer
619 views

Custom gdb output

Yesterday i noticed a nice output from dbg while going through a write up on the internet. As am new to dbg i googled a lot as i wanted to make dbg work similar for me. As seen below this ...
7
votes
2answers
2k views

“Debugged application has modified the debugging registers” with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
3
votes
1answer
295 views

Program crashes after resuming from breakpoint

After solving few crackmes I tried to take one step further and move on "real life" reversing tasks, targeting a known win7 program's password check feature. The program in question obviously doesn't ...
2
votes
3answers
615 views

IDA Pro debugger hit counter

I'm looking for a way to found out how many times instruction at specified address was executed before break point hit. Is there some standard way? I cannot found this in its interface.
0
votes
1answer
473 views

Turbo Debugger - output cpu pane to file

I was asked for a special debugger which prints out the name of original calls used by author. I know the original exe was packed with Borland Turbo C (v.3) and the only debugger which output function ...
1
vote
1answer
519 views

Is there a way to tell the IDA debugger to apply all patches from the database?

I'm in the process of "enhancing" an Android application that comes with a huge compiled .so file. After patching about 200 bytes in the database, i'd like to attach to the running app, apply all ...