Skip to main content

Questions tagged [debuggers]

Debuggers allow the user to view and change the running state of a program.

Filter by
Sorted by
Tagged with
2 votes
1 answer
2k views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
whoopdedoo's user avatar
2 votes
1 answer
1k views

On ollydbg how do I find a string in code that I find on memory map?

The license is saved in a txt and I can't find the string. The code is protected as it calls to encodepointer and some modules are hidden. I'm using ollydbg 2.01 with olly ext1.8 every option ...
Carlos Mendez's user avatar
2 votes
3 answers
5k views

IDA Pro Debugging Window Closes in a Second!

Starting my RE adventures with IDA Pro, I'm opening a windows .exe file in it. While debugging the file, the debugger runs fine and exits with a return 1 value: Debugger: process has exited (exit code ...
Newbie's user avatar
  • 277
2 votes
1 answer
426 views

x64dbg : TraceInto only in user code

The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
HK47's user avatar
  • 23
2 votes
1 answer
430 views

Windows UI freezes except the debugger itself when a breakpoint is hit in every debuggers I tried on a particular application

I'm trying to "trace" (just setting breakpoint, step in, step over to know how certain things work) an application. But if the application enters suspended state by using breakpoint, every ...
Meigyoku Thmn's user avatar
2 votes
1 answer
693 views

Debugging Native Lib using IDA Pro Fails to Load Registers and other Information

Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
Display's user avatar
  • 121
2 votes
1 answer
2k views

Getting pydbg working on windows 10

I downloaded the paimei tool and dropped the pydbg package files inside .../paimai/pydbg then installed paimei but I can't seem to get pydbg to work. I keep getting an error with pydasm when trying to ...
Nitro's user avatar
  • 187
2 votes
0 answers
859 views

Recommended plugins for x64dbg

I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks. The more you can ...
beginner's user avatar
2 votes
0 answers
744 views

Seeking front end for MinGW gdb debugger

We are unit testing with Vectorcast, which uses the MinGW tool chain on Windows. It launches the command line gdb, but some of the newer engineers are having problems getting to grips with something ...
Mawg's user avatar
  • 131
2 votes
0 answers
252 views

(iOS lldb) Unable to debug past a splash/loading screen

I'm trying to lldb debug this certain iOS application. Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity. However, whenever I try to debug ...
Carol Ward's user avatar
2 votes
0 answers
324 views

How can I fix an unpacked binary which calls out-of-bounds memory?

I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
the_endian's user avatar
  • 1,870
2 votes
0 answers
2k views

Error: the file can't be loaded by debugger plupin IDA PRO 64 bit

I use IDA PRO 64bits on windows 10 64 bit, I want use it remote debug a file 64bit by linux. When I run linux_serverx64 in linux and connect then i error: the file can't be loaded by debugger plupin ...
QChí Nguyễn's user avatar
2 votes
1 answer
328 views

BinNavi Debugging Executable with Arguments

It is about debugging some executable by using Zynamics BinNavi 5.0. And there's no problem if I want to start debugging without any command line parameters (i.e. "my.exe"), but I cannot find a way to ...
Aleksandar Pesic's user avatar
1 vote
2 answers
5k views

How to find how global variables defined in binary

In Visual Studio I have written simple code, int pranit = 2; int& sumit = pranit; int main(int argc, char** argv) { sumit++; return sumit; } I used OllyDbg to Disassamble, but I am not ...
Pranit Kothari's user avatar
1 vote
2 answers
8k views

How to print from pointers in radare2 in debug session

when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction 0x08048498 8b4508 mov eax, dword [ebp+arg2] ...
u185619's user avatar
  • 335
1 vote
2 answers
313 views

Which condition has to be met to execute this if branch

Right now I am playing around with a little training application I found on OpenSecurityTraining. So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is ...
Dirk's user avatar
  • 443
1 vote
2 answers
1k views

Generate software breakpoint other than int3

Is it possible to generate a software breakpoint other than int3 to be catched by the debugger, like a division by zero for example? If so, I was wondering why debuggers don't support generating ...
Jorayen's user avatar
  • 185
1 vote
2 answers
6k views

Getting past a whole lot of anti-debug measures for a windows exe

I'm trying to debug a windows exe that is really full of anti-debug measures. It has pretty much everything you can think of DBGuiremotebreakin, Ntsetinformationthread, NtQueryInformationProcess, the ...
codechao's user avatar
1 vote
2 answers
390 views

How to debug binwalk tool?

My lecturers have requested that I debug binwalk in order to understand how it works and develop new features so that it can extract more. I tried to use gdb to debug binwalk but it results in the ...
QChí Nguyễn's user avatar
1 vote
2 answers
5k views

How do I log a string in x64dbg?

This one should be simple, but I can't figure it out. How do I log a string in x64dbg? I can log the address with a breakpoint but wasn't able to log the actual text.
pokerguy's user avatar
1 vote
2 answers
2k views

Using USB JTAG probe with ARM & MIPS

Can someone advice USB JTAG probe designed for both ARM and MIPS target boards, and which works with the OpenOCD and UrJTAG? I know Flyswatter2..
Lexx Luxx's user avatar
  • 203
1 vote
2 answers
2k views

Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"

I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
TensionRising's user avatar
1 vote
1 answer
512 views

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
programming_is_bae's user avatar
1 vote
2 answers
2k views

Difference between 32 bit and 64 bit disassemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
J.Doe's user avatar
  • 15
1 vote
1 answer
5k views

x64dbg how to watch all changes after one step

We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows? x64dbg 32bit version trace: NEW UPDATE ...
A.J's user avatar
  • 135
1 vote
2 answers
123 views

What is the relationship between .NET and x86-64 assembly?

I'm gathering that it's nearly a waste of time to try to reverse .NET applications in a native debugger. But why? Of course the computer is executing machine code in the end, not CIL. So what clutters ...
the_endian's user avatar
  • 1,870
1 vote
1 answer
318 views

How do you change the stack width/offset in radare2?

Currently, my stack view is 0x10 (16) bytes long. How do I change it so that the stack view is 8 bytes long? Edit: I have tried tabbing into the stack window, pressing e, and then typing pxr 256@r:SP ...
user40683's user avatar
1 vote
2 answers
1k views

How to search for process by name with WinDBG

I know how to list all the processes in the system by running: 0: kd>dx -r1 Debugger.Sessions[0].Processes OR 0: kd>.tlist But how can I search for a process by name? I tried to use the ...
E235's user avatar
  • 583
1 vote
1 answer
120 views

Switch between debuggers while paused on a breakpoint

Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
korri123's user avatar
  • 113
1 vote
2 answers
651 views

Changing page permissions at runtime under a debugger

Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
0-0's user avatar
  • 111
1 vote
1 answer
543 views

Is there watchpoints in radare2?

Is there any way to put breakpoints in radare2 that trigger when an address is read/write? In GDB those are call watchpoints ('rwatch' or 'awatch") I got this from radare2 [0xB7F08810]> !dr? ...
Ricardo's user avatar
  • 501
1 vote
1 answer
1k views

Installed IDA 7.0 Freeware -- no debugger, is that installed separately? [duplicate]

After setting up a home lab and installing the latest IDA 7.0 freeware, I don't see the debugger submenu I was expecting -- I've only used it in an academic setting before and it came pre-configured ...
Aegis's user avatar
  • 13
1 vote
2 answers
2k views

How do I create an ASCII string in OllyDBG?

During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
sif's user avatar
  • 23
1 vote
2 answers
422 views

Identifying DeviceIoControl argument

I am reversing an application that uses the serial interface (COM1 port) and am using API Monitor to trace through the API calls. I found a reference to CreateFileA("\\.\Commsb96", GENERIC_READ | ...
Farhan Yusufzai's user avatar
1 vote
2 answers
318 views

pydbg: Disassemble at $exentry and relative offset from $exentry

I am attempting to disassemble a test binary I compiled written in masm. Here are the follwing bytes: Microsoft (R) COFF/PE Dumper Version 10.00.40219.01 Copyright (C) Microsoft Corporation. All ...
grepNstepN's user avatar
1 vote
1 answer
137 views

Chrome Vulnerability Issue

My fuzzer recently crashed chrome and dumped what appears to be an exploitable vulnerability. I'm having an issue debugging it, as the referenced source appears incompatible with the version of chrome ...
grepNstepN's user avatar
1 vote
1 answer
2k views

Windows debugger with ltrace functionality

I recently found the program: ltrace. And was wondering if it's possible to achieve the same using one of the gui debuggers for windows: ida, immunity, etc. The only thing I've found is a port of the ...
hust921's user avatar
  • 13
1 vote
1 answer
158 views

What is the difference between application level DEP and OS level DEP?

I am trying to teach myself some ROP programming. And I have tried to do some training exploits from different sites. So, right now, I have this little application where GS, safeSEH ALSR and DEP are ...
Dirk's user avatar
  • 443
1 vote
2 answers
197 views

Tracing ("logging") the stack without setting a breakpoint?

I'm familiar with the concept of backtracing the stack after breaking on a specific instruction. What I wonder about is this: theoretically, a great way to aid oneself in analyzing an application ...
user4520's user avatar
  • 595
1 vote
1 answer
469 views

How to debug a malware that does DLL injection into explorer.exe?

What steps would you suggest for debugging a malware that injects a DLL into explorer.exe? using X32dbg have already attached explorer.exe to x32dbg
purple.jar's user avatar
1 vote
1 answer
223 views

Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender

In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
Edw590's user avatar
  • 188
1 vote
3 answers
1k views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
Charles Weerawansa's user avatar
1 vote
1 answer
463 views

Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"

I have a WinForm project in C++. I attached a kernel debugger to my VMware machine. I set a breakpoint on the kernel and switched context to my application: 0: kd> !process 0 0 WindowsProject1.exe ...
E235's user avatar
  • 583
1 vote
1 answer
182 views

Is `movq rax, xmm0` buggy in Radare2?

Why doesn't rax get loaded from xmm0 here? radare2 bug? GitHub issue `movq rax, xmm0` doesn't work in native debugger filed. [0x0003b0e0]> drr role reg value ref ―――――――――――――――――――...
rickhg12hs's user avatar
1 vote
2 answers
5k views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...
yoni's user avatar
  • 69
1 vote
1 answer
1k views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
Deb's user avatar
  • 11
1 vote
1 answer
495 views

IDA PRO does miss calls when tracing

I am following this tutorial: enter link description here Though it uses Olly I am following with IDA. Basically i am tying to catch where a popup decision is taking place in the program. I though ...
dandan's user avatar
  • 275
1 vote
1 answer
2k views

Simple Debugger and Hardware BreakPoints in x64 Windows 10

I have coded a very simple Debugger for x64, I am using currently Win10. I am trying to set some Hardware Breakpoints to be trapped by my Debugger Loop as follows: inline void SETBITS(DWORD64 *dw, ...
fred26's user avatar
  • 319
1 vote
1 answer
439 views

Getting MSRs from Windows Crash Dump

I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is ...
Fewmitz's user avatar
  • 1,022
1 vote
0 answers
64 views

Process stuck on the entry point

I'm trying to patch an old game (1998-ish) that runs on windows 95 and windows XP to make it compatible with windows 11. The current problem with it is that when running the exe file nothing seems to ...
Yair Derry's user avatar