Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
3
votes
1answer
479 views

What do the first 16 bytes on the stack represent?

Whenever I attach a process in OllyDbg v1.10 on my Windows 7 64-bit machine, I notice that the first saved EBP on the stack doesn't point to the very base of the stack. Instead it points 16 bytes ...
1
vote
0answers
618 views

How to decrypt this file?

I have to decrypt a file that is used by an app built using VB5. The file itself contains some data that is decrypted when the app is run and the decrypted data is text data that is displayed in a ...
5
votes
2answers
3k views

OllyDbg: Automatically extract string when breakpoint is hit

Given a breakpoint at an expression MOV EDI, EAX, how can you automatically log/write to file the referenced string whenever the breakpoint is hit?
2
votes
1answer
1k views

How to extract information from dll compiled in gcc with debug symbols?

I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this. If this is true, how can I view the data in the ...
2
votes
2answers
3k views

How to detect a debugger using some "time" checking strategies?

I have seen several anti-debug strategies, and I am wondering if there are some anti-debugger methods that can evaluate the program running time, thus detecting the exist of debugger.
1
vote
2answers
5k views

How to find how global variables defined in binary

In Visual Studio I have written simple code, int pranit = 2; int& sumit = pranit; int main(int argc, char** argv) { sumit++; return sumit; } I used OllyDbg to Disassamble, but I am not ...
8
votes
3answers
17k views

Reverse engineer Android native code

I am looking for an reverse engineering tool or a way to decompile the existing android native code to an human understandable format rather than Assembly language. Can anyone please suggest me as i ...
4
votes
1answer
492 views

Cannot trace an MS-DOS COM file

When debugging the following com file in MS-DOS, I can successfully run the program with -g and it terminates normally, but when I trace it -t 1000, the program throws an illegal operation exception ...
3
votes
1answer
5k views

How to find where the code is cycling - infinite loop?

Is there some way or technique to determine which code cycles in the program? Like if my application gets on an infinite loop and I would like to know exactly where it loops?
2
votes
1answer
2k views

Unpacking script

As malware are often packed, I'm looking to automate some of the unpacking tasks when that's possible. In order to do that, I thought that OllyScript was an interesting way to write unpacking script ...
3
votes
1answer
355 views

Some programs have always same addressing and some different

Why do IDA and Ollydbg always open some programs with the main() function at the same address? The address given by IDA is equal to that given by Ollydbg in runtime. However, when I wrote my own C ...
10
votes
1answer
341 views

Thread-Switching with PyDbg

I'm having trouble switching from debugging one thread to another in pydbg. I don't have much experience with multithreading, so I'm hoping that I'm just missing something obvious. Basically, I want ...
5
votes
1answer
635 views

Dalvik Byte code instrumentation framwork for dynamic data dependency analysis

I am looking forward to having your input regarding the availability of any tool that can do instrumentation in byte code level run-time, so that data dependency analysis can be carried out? Such tool ...
3
votes
2answers
12k views

How to set a conditional breakpoint on specific register value in OllyDbg?

I want to set a conditional breakpoint if the register is an unicode like 'm' or 'a' or '2' using ollydbg. How can i do that ? I have the latest version of Ollydbg '2.01'. OllyStepNSearch plugin is ...
2
votes
1answer
576 views

How to view the content of a file before it is written?

I've got a process that writes to a file (database). In process monitor I see WriteFile. After this I see the file is about to be either written or updated (offset:length). How can I reveal the ...
-4
votes
1answer
5k views

Set a breakpoint before WriteFile operation in OllyDbg [closed]

In the process monitor, I see a WriteFile operation. How can I set a breakpoint and view everything about this operation in OllyDbg? If this is not possible with OllyDbg, what other tools can I use?
0
votes
2answers
181 views

How to modify a file from the process context of iexplore.exe? [closed]

When I use Process Monitor to check iexplore.exe, I see some operations like lock/read/write from iexplore.exe to a specific file. How can I do a modification to this specific file as iexplore.exe? ...
1
vote
2answers
1k views

How to debug Windows Media Player without attach mode?

When I try to debug Windows Media Player and play a movie this error message is shown: Running this process under a debugger while using DRM content is not allowed. But with drmdbg it can debug ...
8
votes
1answer
10k views

How to debug DLL imported from an application?

I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
6
votes
1answer
356 views

Attaching gdb to hidden library/process

On OSX I'm trying to debug/attach to a framework that the application unarchives at runtime. The frame work normally resides in the /Resources folder within the application bundle as .gz file. The ...
6
votes
2answers
2k views

What is difference between Digital Forensic and Reverse Engineering

I am not able to understand exact difference in Digital Forensic and Reverse Engineering. Will Digital Forensic has anything to do with decompilation, assembly code reading or debugging?
3
votes
0answers
379 views

How to quickly/easily make an analysis (reverse engineering) of the code of unknown CMS or framework on PHP? [closed]

I would like to know what tools and techniques do you use for rapid analyze of unknown code CMS or framework. If more specifically that for the following tasks: 1. To locate the file (s) html ...
3
votes
3answers
5k views

Check DEP , ASLR and SafeSEH enabled or not , immlib

How to check if DEP, ASLR and SafeSEH defense mechanism are enabled or not in a program using immlib library of Python in Immunity Debugger ? Actually I am looking for small code snippet for each.
3
votes
0answers
305 views

IDA Pro Symbian Debugger 'general OS related' Error [closed]

I am using remote symbian: c5-03 (Application TRK 3.2.7 for all S60 5.0 devices with production images). However, whenever I start the debugger, I get this error: general OS-related error What went ...
9
votes
1answer
3k views

How to handle exceptions in a debugger when reversing malware?

I came across some malware that raised an exception while I was single stepping through it. IDA gives me the option to pass the exception to the application or not. What exactly is going on here? When ...
5
votes
2answers
2k views

Ollydbg target runs automatically

I have a target that automatically runs after I load it in to Ollydbg. This form, doesn't stop at the entry point (but continues to execute and at a point it pauses, I have to press shift+f9.) Is ...
2
votes
1answer
2k views

How to debug using OpenWatcom's debugger?

OpenWatcom's debugger just executes the binary instead of single-stepping through it, when I attempt the following steps: File->Open, select executable Run->Trace Into This attempt is on ...
2
votes
2answers
432 views

How to get all the references to function using PyDBG?

I'd like to get all the addresses in the binary that some function is called from using PyDbg. The address of the function will be supplied as a parameter. Do I have actually to scan all the code, ...
12
votes
2answers
15k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
13
votes
4answers
6k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
3
votes
1answer
487 views

OS X Power PC RE tool (debugger/disassembler)

So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I ...
14
votes
4answers
4k views

Debugging malware that will only run as a service

I'm trying to debug a malware sample that installs to a system as service and then will only start if it starts as a service. Other functions are still available without the service start, like ...
6
votes
1answer
904 views

Annotating the Stack in GDB?

Is there a GUI (or even a script for the CLI) for GDB that will annotate views of the stack with saved registers, each of the frames, etc? It should be possible to gather this information on each ...
111
votes
1answer
85k views

How to handle stripped binaries with GDB? No source, no symbols and GDB only shows addresses?

I have GDB but the binary I want reverse engineer dynamically has no symbols, that is when I run the file utility it shows me stripped: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), ...
13
votes
4answers
6k views

Creating IDA Pro debugger plugins - API documentation and examples?

Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
6
votes
3answers
3k views

Debugging NewExecutable binaries

I'm trying to debug a 16-bit Windows executable (format: New Executable). The problem is that all the standard tools (W32DASM, IDA, Olly) don't seem to support 16-bit debugging. Can you suggest any ...
7
votes
1answer
8k views

WinDbg fails to connect to IDA Pro debugger server

Environment: Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg Guest: Win7 SP1 x64 I have VirtualKD setup correctly in my guest and host. I say this because ...
10
votes
3answers
14k views

How can I prevent Immunity Debugger / OllyDbg from breaking on attach?

When I attach OllyDbg or ImmunityDebugger to a process, it automatically breaks execution. I'm attaching to a user-mode service running as SYSTEM and only need to catch exceptions, so this is not ...
6
votes
1answer
419 views

How can I check I've moved outside the stack without triggering a protection fault?

I'm adding a feature to my Linux debugger (I'm using Ptrace to manipulate the traced process as well as libbfd/libopcodes) to unwind the stack and determine if discrepancies exist between each CALL's ...
30
votes
5answers
52k views

How do I acquire SoftICE?

I have seen mentions of SoftICE on various questions throughout this site. However, the Wikipedia article on SoftICE implies that the tool is abandoned. Searching google, I see many links claiming to ...
15
votes
1answer
2k views

Malware Hooking INT 1 and INT 3

I understand that on x86, INT 1 is used for single-stepping and INT 3 is used for setting breakpoints, and some other interrupt (usually 0x80 for Linux and 0x2E for Windows) used to be used for system ...
93
votes
19answers
120k views

Decent GUI for GDB

Learning the GDB commands is on my bucket-list, but in the meantime is there a graphical debugger for *nix platforms that accepts Windbg commands, and has similar functionality? For example, the ...
6
votes
1answer
129 views

Which format/tool to store 'basic' informations?

It's really a productivity bottleneck when various analysis tools can't share information. What's an efficient way to store symbols+comments+structures, so that they can be easily imported into other ...
8
votes
1answer
582 views

How does GDB's process recording work?

A curious and useful feature of GDB is process recording, allowing an analyst to step forwards and backwards through execution, writing a continuous log of the changes to program state that allow for ...
9
votes
2answers
609 views

How can I analyze a program that uses a JIT compiled code?

A lot of code I encounter today has a considerable amount of code generated at runtime, making analysis extremely laborious and time consuming. Is there any way I can create symbolic names for the ...

1 2 3
4