Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
3
votes
1answer
2k views

how to attach to a process as soon as it is loaded in memory

I want to attach OllyDbg or IDA to a process as soon as it is loaded in memory before a single instruction of it being executed. How do I do This??? I cant use File->Open for some reason. I can only ...
1
vote
1answer
125 views

What is the difference between application level DEP and OS level DEP?

I am trying to teach myself some ROP programming. And I have tried to do some training exploits from different sites. So, right now, I have this little application where GS, safeSEH ALSR and DEP are ...
2
votes
3answers
665 views

App prints debug strings but no OutputDebugString used

An application I'm reversing frequently outputs debug strings. Some of them could aid me in locating the code I'm looking for, but somehow, the app doesn't seem the be using OutputDebugString at all (...
1
vote
2answers
174 views

Tracing (“logging”) the stack without setting a breakpoint?

I'm familiar with the concept of backtracing the stack after breaking on a specific instruction. What I wonder about is this: theoretically, a great way to aid oneself in analyzing an application ...
0
votes
1answer
72 views

How can I ringfence an EXE to know what system resources it is accessing?

I do not want to debug the code within the program, I simply want to know what external resources it accesses - files, connections, registry, etc... Is there an easy way to do this in Windows?
10
votes
2answers
2k views

Extract non-extractable private key from OS X Keychain

I'm trying to extract a non-extractable private key as a .p12 file from Keychain Access.app or /usr/bin/security on Mac OS X 10.9.4. Basically, it appears that security import has a -x option to ...
6
votes
1answer
5k views

How to find the location of the vtable?

Actually, I am trying to learn a little about vtable overflows. So, my learning documents state the following: The main point to realize is that whenever we declare a C++ class with virtual ...
3
votes
1answer
960 views

Interacting with command line programs in Hopper disassembler (Mac OS 10.9)

To test the debugging capabilities of Hopper, I wrote a simple C++ command line application, and tried to run it on the remote debugging server (with gdb). However, I learned after I failed to be able ...
-4
votes
2answers
3k views

Anti-debug techniques for MS-Windows?

Is there any anti-debugger tricks used by malware other than interrupt INT 0x2D ? And, how do they work ? Working examples would be really nice !
2
votes
2answers
10k views

What's the difference between a disassembler, debugger and decompiler?

I have heard of disassemblers like IDA and debuggers like OllyDbg but honestly, when you give both of them a binary file it gives me the assembly code. I know that the decompiler gives the source code ...
1
vote
2answers
300 views

Which condition has to be met to execute this if branch

Right now I am playing around with a little training application I found on OpenSecurityTraining. So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is ...
2
votes
2answers
1k views

Using USB JTAG probe with ARM & MIPS

Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
2
votes
2answers
2k views

Debugging Virtual Machine using Windbg

I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes. I was following the MSDN kernel mode debugging article, however bcdedit ...
7
votes
1answer
6k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
0
votes
2answers
2k views

At which address on the stack or in memory is eax stored after the malloc call? [closed]

Here is my objdump -d snippet with the malloc call and surrounding code. This binary is stripped. dbgLab.bin: file format elf32-i386 080483d0 <malloc@plt>: 80483d0: ff 25 04 a0 04 08 ...
2
votes
2answers
280 views

Extracting data from a Program for external use

I am looking at basically capturing VU Meter data from an audio recording program, preferably the highest resolution possible, and inputting that data into a circuit to power LED's, respectively. I ...
2
votes
1answer
889 views

How to set a breakpoint when a method is called using LLDB on OS X?

I'm trying to hit a breakpoint that I set in LLDB (CLI), but for whatever reason I'm not hitting my breakpoint. I am messing around with the stock Calculator.app on OS X, and am trying to call / hit ...
3
votes
1answer
1k views

How to search for intermodular calls in WinDBG

In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG? Thanks
3
votes
1answer
437 views

What do the first 16 bytes on the stack represent?

Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes ...
1
vote
0answers
564 views

How to decrypt this file?

I have to decrypt a file that is used by an app built using VB5. The file itself contains some data that is decrypted when the app is run and the decrypted data is text data that is displayed in a ...
5
votes
2answers
3k views

OllyDbg: Automatically extract string when breakpoint is hit

Given a breakpoint at an expression MOV EDI, EAX, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?
2
votes
1answer
977 views

How to extract information from dll compiled in gcc with debug symbols?

I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this. If this is true, how can I view the data in the ...
2
votes
2answers
2k views

How to detect a debugger using some “time” checking strategies?

I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.
1
vote
2answers
4k views

How to find how global variables defined in binary

In Visual Studio I have written simple code, int pranit = 2; int& sumit = pranit; int main(int argc, char** argv) { sumit++; return sumit; } I used OllyDbg to Disassamble, but I am not ...
8
votes
3answers
14k views

Reverse engineer Android native code

I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
4
votes
1answer
398 views

Cannot trace an MS-DOS COM file

When debugging the following com file in MS-DOS, I can successfully run the program with -g and it terminates normally, but when I trace it -t 1000, the program throws an illegal operation exception ...
3
votes
1answer
3k views

How to find where the code is cycling - infinite loop?

Is there some way or technique to determine which code cycles in the program? Like if my application gets on an infinite loop and I would like to know exactly where it loops?
2
votes
1answer
1k views

Unpacking script

As malware are often packed, I'm looking to automate some of the unpacking tasks when that's possible. In order to do that, I thought that OllyScript was an interesting way to write unpacking script ...
3
votes
1answer
323 views

Some programs have always same addressing and some different

Why do IDA and Ollydbg always open some programs with the main() function at the same address? The address given by IDA is equal to that given by Ollydbg in runtime. However, when I wrote my own C ...
10
votes
1answer
331 views

Thread-Switching with PyDbg

I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious. Basically, I want ...
5
votes
1answer
630 views

Dalvik Byte code instrumentation framwork for dynamic data dependency analysis

I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
3
votes
2answers
12k views

How to set a conditional breakpoint on specific register value in OllyDbg?

I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg. How can i do that ? I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is ...
2
votes
1answer
481 views

How to view the content of a file before it is written?

I've got a process that writes to a file (database). In process monitor I see WriteFile. After this I see the file is about to be either written or updated (offset:length). How can I reveal the ...
-4
votes
1answer
4k views

Set a breakpoint before WriteFile operation in OllyDbg [closed]

In the process monitor, I see a WriteFile operation. How can I set a breakpoint and view everything about this operation in OllyDbg? If this is not possible with OllyDbg, what other tools can I use?
0
votes
2answers
168 views

How to modify a file from the process context of iexplore.exe? [closed]

When I use Process Monitor to check iexplore.exe, I see some operations like lock/read/write from iexplore.exe to a specific file. How can I do a modification to this specific file as iexplore.exe? ...
1
vote
2answers
1k views

How to debug Windows Media Player without attach mode?

When I try to debug Windows Media Player and play a movie this error message is shown: Running this process under a debugger while using DRM content is not allowed. But with drmdbg it can debug ...
8
votes
1answer
9k views

How to debug DLL imported from an application?

I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
6
votes
1answer
320 views

Attaching gdb to hidden library/process

On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. The ...
6
votes
2answers
1k views

What is difference between Digital Forensic and Reverse Engineering

I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
3
votes
0answers
363 views

How to quickly/easily make an analysis (reverse engineering) of the code of unknown CMS or framework on PHP? [closed]

I would like to know what tools and techniques do you use for rapid analyze of unknown code CMS or framework. If more specifically that for the following tasks: 1. To locate the file (s) html ...
3
votes
3answers
4k views

Check DEP , ASLR and SafeSEH enabled or not , immlib

How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ? Actually I am looking for small code snippet for each.
3
votes
0answers
289 views

IDA Pro Symbian Debugger 'general OS related' Error [closed]

I am using remote symbian: c5-03 (Application TRK 3.2.7 for all S60 5.0 devices with production images). However, whenever I start the debugger, I get this error: general OS-related error What went ...
7
votes
1answer
2k views

How to handle exceptions in a debugger when reversing malware?

I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
5
votes
2answers
2k views

Ollydbg target runs automatically

I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.) Is ...
2
votes
1answer
1k views

How to debug using OpenWatcom's debugger?

OpenWatcom's debugger just executes the binary instead of single-stepping through it, when I attempt the following steps: File->Open, select executable Run->Trace Into This attempt is on ...
2
votes
2answers
417 views

How to get all the references to function using PyDBG?

I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter. Do I have actually to scan all the code, ...
12
votes
2answers
12k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
13
votes
4answers
4k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
3
votes
1answer
440 views

OS X Power PC RE tool (debugger/disassembler)

So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I ...
13
votes
4answers
3k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...