Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
207
questions
2
votes
1
answer
2k
views
how watchpoint on register works
GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ?
Is there a way to make it work for lldb also ?
*...
- 273
2
votes
1
answer
1k
views
On ollydbg how do I find a string in code that I find on memory map?
The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
2
votes
3
answers
5k
views
IDA Pro Debugging Window Closes in a Second!
Starting my RE adventures with IDA Pro, I'm opening a windows .exe file in it. While debugging the file, the debugger runs fine and exits with a return 1 value:
Debugger: process has exited (exit code ...
- 277
2
votes
1
answer
315
views
x64dbg : TraceInto only in user code
The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
- 23
2
votes
1
answer
365
views
Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application
I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
2
votes
1
answer
453
views
Debugging Native Lib using IDA Pro Fails to Load Registers and other Information
Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
- 121
2
votes
1
answer
2k
views
Getting pydbg working on windows 10
I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
- 187
2
votes
0
answers
719
views
Recommended plugins for x64dbg
I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks.
The more you can ...
- 86
2
votes
0
answers
711
views
Seeking front end for MinGW gdb debugger
We are unit testing with Vectorcast, which uses the MinGW tool chain on Windows.
It launches the command line gdb, but some of the newer engineers are having problems getting to grips with something ...
2
votes
0
answers
249
views
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.
Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.
However, whenever I try to debug ...
- 121
2
votes
0
answers
310
views
How can I fix an unpacked binary which calls out-of-bounds memory?
I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
- 1,830
2
votes
0
answers
2k
views
Error: the file can't be loaded by debugger plupin IDA PRO 64 bit
I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
- 323
2
votes
1
answer
326
views
BinNavi Debugging Executable with Arguments
It is about debugging some executable by using Zynamics BinNavi 5.0. And there's no problem if I want to start debugging without any command line parameters (i.e. "my.exe"), but I cannot find a way to ...
- 169
1
vote
2
answers
5k
views
How to find how global variables defined in binary
In Visual Studio I have written simple code,
int pranit = 2;
int& sumit = pranit;
int main(int argc, char** argv) {
sumit++;
return sumit;
}
I used OllyDbg to Disassamble, but I am not ...
- 927
1
vote
2
answers
8k
views
How to print from pointers in radare2 in debug session
when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction
0x08048498 8b4508 mov eax, dword [ebp+arg2]
...
- 335
1
vote
2
answers
312
views
Which condition has to be met to execute this if branch
Right now I am playing around with a little training application I found on OpenSecurityTraining.
So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is ...
- 443
1
vote
2
answers
996
views
Generate software breakpoint other than int3
Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example?
If so, I was wondering why debuggers don't support generating ...
- 185
1
vote
2
answers
6k
views
Getting past a whole lot of anti-debug measures for a windows exe
I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
- 13
1
vote
2
answers
377
views
How to debug binwalk tool?
My lecturers have requested that I debug binwalk in order to understand how it works and develop new features so that it can extract more. I tried to use gdb to debug binwalk but it results in the ...
- 323
1
vote
2
answers
1k
views
Using USB JTAG probe with ARM & MIPS
Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
- 203
1
vote
2
answers
1k
views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
1
answer
413
views
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
1
vote
2
answers
1k
views
Difference between 32 bit and 64 bit disassemblers
As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
- 15
1
vote
1
answer
4k
views
x64dbg how to watch all changes after one step
We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?
x64dbg 32bit version trace:
NEW UPDATE
...
- 135
1
vote
2
answers
121
views
What is the relationship between .NET and x86-64 assembly?
I'm gathering that it's nearly a waste of time to try to reverse .NET applications in a native debugger. But why? Of course the computer is executing machine code in the end, not CIL. So what clutters ...
- 1,830
1
vote
1
answer
233
views
How do you change the stack width/offset in radare2?
Currently, my stack view is 0x10 (16) bytes long.
How do I change it so that the stack view is 8 bytes long?
Edit:
I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
- 63
1
vote
2
answers
898
views
How to search for process by name with WinDBG
I know how to list all the processes in the system by running:
0: kd>dx -r1 Debugger.Sessions[0].Processes
OR
0: kd>.tlist
But how can I search for a process by name?
I tried to use the ...
- 573
1
vote
1
answer
105
views
Switch between debuggers while paused on a breakpoint
Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
- 113
1
vote
2
answers
492
views
Changing page permissions at runtime under a debugger
Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
- 111
1
vote
1
answer
513
views
Is there watchpoints in radare2?
Is there any way to put breakpoints in radare2 that trigger when an address is read/write?
In GDB those are call watchpoints ('rwatch' or 'awatch")
I got this from radare2
[0xB7F08810]> !dr?
...
- 476
1
vote
1
answer
1k
views
Installed IDA 7.0 Freeware -- no debugger, is that installed separately? [duplicate]
After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured ...
- 13
1
vote
2
answers
2k
views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
- 23
1
vote
2
answers
396
views
Identifying DeviceIoControl argument
I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls.
I found a reference to CreateFileA("\\.\Commsb96", GENERIC_READ | ...
- 271
1
vote
2
answers
318
views
pydbg: Disassemble at $exentry and relative offset from $exentry
I am attempting to disassemble a test binary I compiled written in masm. Here are the follwing bytes:
Microsoft (R) COFF/PE Dumper Version 10.00.40219.01
Copyright (C) Microsoft Corporation. All ...
- 368
1
vote
1
answer
137
views
Chrome Vulnerability Issue
My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
- 368
1
vote
1
answer
2k
views
Windows debugger with ltrace functionality
I recently found the program: ltrace. And was wondering if it's possible to achieve the same using one of the gui debuggers for windows: ida, immunity, etc. The only thing I've found is a port of the ...
- 13
1
vote
1
answer
157
views
What is the difference between application level DEP and OS level DEP?
I am trying to teach myself some ROP programming. And I have tried
to do some training exploits from different sites. So, right now, I have this
little application where GS, safeSEH ALSR and DEP are ...
- 443
1
vote
2
answers
192
views
Tracing ("logging") the stack without setting a breakpoint?
I'm familiar with the concept of backtracing the stack after breaking on a specific instruction.
What I wonder about is this: theoretically, a great way to aid oneself in analyzing an application ...
- 585
1
vote
1
answer
413
views
How to debug a malware that does DLL injection into explorer.exe?
What steps would you suggest for debugging a malware that injects a DLL into explorer.exe?
using X32dbg
have already attached explorer.exe to x32dbg
- 11
1
vote
1
answer
176
views
Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender
In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
- 188
1
vote
3
answers
1k
views
x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection
I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
1
vote
1
answer
389
views
Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"
I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:
0: kd> !process 0 0 WindowsProject1.exe
...
- 573
1
vote
1
answer
180
views
Is `movq rax, xmm0` buggy in Radare2?
Why doesn't rax get loaded from xmm0 here? radare2 bug?
GitHub issue `movq rax, xmm0` doesn't work in native debugger filed.
[0x0003b0e0]> drr
role reg value ref
―――――――――――――――――――...
- 121
1
vote
1
answer
877
views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
- 11
1
vote
1
answer
473
views
IDA PRO does miss calls when tracing
I am following this tutorial:
enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program.
I though ...
- 275
1
vote
1
answer
2k
views
Simple Debugger and Hardware BreakPoints in x64 Windows 10
I have coded a very simple Debugger for x64, I am using currently Win10.
I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows:
inline void SETBITS(DWORD64 *dw, ...
- 319
1
vote
1
answer
424
views
Getting MSRs from Windows Crash Dump
I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is ...
- 1,022
1
vote
0
answers
51
views
Process stuck on the entry point
I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11.
The current problem with it is that when running the exe file nothing seems to ...
- 21
1
vote
0
answers
64
views
debug native code and net code
I have a .net dll with a lot of calculations and formulas.
From this dll, I want to set breakpoints to see the calculated results for a specific field.
The main program is written in native code. So, ...
- 11
1
vote
0
answers
431
views
x64dbg isn't running the program I'm looking at
I'm almost definitely being an idiot but I have opened up an .exe file in x64dbg and I can run the file just fine when looking at the assembly but it doesn't open a second window so I can see the ...
- 11