Questions tagged [debuggers]
Debuggers allow the user to view and change the running state of a program.
207
questions
1
vote
2
answers
610
views
Why IDA debugger on android doesn't show all threads?
My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file.
Here's what I've done:
download a x86_64 system image android emulator from android studio
install that .apk ...
- 131
1
vote
0
answers
2k
views
In X64dbg, how can I script a string write to memory?
I find that I can write to memory as
[addr] = value
As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html
And while I could work around my problem as dividing ...
- 11
1
vote
0
answers
259
views
Issues with Symbols when running windbg on windows xp sp3
I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
1
vote
0
answers
1k
views
Ida permission error
I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
- 19
1
vote
0
answers
412
views
UTF8, UTF16 encoding string search
I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them..
P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
0
answers
347
views
How to find function called by instantaneous event (like mouse press for exemple)
I'm sorry if my question isn't very clear, I have trouble phrasing it so please bear with me.
I was playing around with Cheat Engine lately and found myself in a situation where I needed to find what ...
- 83
1
vote
0
answers
109
views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
- 11
1
vote
1
answer
160
views
Log modified memory locations when tracing with Ollydbg
When you trace with Ollydbg it prints the register values near commands that modify them. Is there any way to get it to print some memory locations, of my choice, when modified?
- 113
1
vote
0
answers
983
views
Immunity Debugger Unable to set Breakpoint
I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try.
The first error is that Immunity is 'Unable ...
- 11
1
vote
0
answers
724
views
OllyDbg step over command not behaving exactly as the Immunity Debugger
I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching.
In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
- 111
1
vote
0
answers
916
views
Ignore Path and Extension in OllyDBG 2?
I have an exe on my desktop that i began debugging a while ago, so i have a lot of notes/breakpoints stored in the udd file. I now need to move that exe to a different directory but Olly sees it as a ...
- 11
1
vote
1
answer
905
views
[ARM]How does this checksum code works and how to revert it in C?
I am trying to reverse a simple code that gets a string and calculates it's checksum. I've been trying to understand every instruction, but they look different from what is said in arm documentation.
...
- 154
1
vote
0
answers
302
views
immunity debugger MSVCR90.dll R6034
I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit ...
- 155
1
vote
0
answers
690
views
How to decrypt this file?
I have to decrypt a file that is used by an app built using VB5. The file itself contains some data that is decrypted when the app is run and the decrypted data is text data that is displayed in a ...
- 11
0
votes
3
answers
864
views
How To Identify Which Process Is Being Written To With WriteProcessMemory?
Basically, I cannot find which process is being written to when WriteProcessMemory is being called.
Currently I'm Setting Breakpoints on WriteProcessMemory and OpenProcess. However, the process handle ...
- 11
0
votes
2
answers
185
views
How to modify a file from the process context of iexplore.exe? [closed]
When I use Process Monitor to check iexplore.exe, I see some operations like lock/read/write from iexplore.exe to a specific file.
How can I do a modification to this specific file as iexplore.exe?
...
- 317
0
votes
1
answer
785
views
Using PyDBG how to find in which loaded module callee functions is present
Is there any quick/ faster way to find , any address resides in which loaded module.
For example from stack if I have ret address of any api. I want to check from which module actually that function ...
- 205
0
votes
2
answers
648
views
ASM Debuggers that visualize the stack (beginner friendly)
(Cross-posted from Stack Overflow)
Are there any debuggers that constantly show a visual of the stack and where everything is within it? For example, taking some random image:
I use gdb for most ...
- 103
0
votes
2
answers
5k
views
How do I log a string in x64dbg?
This one should be simple, but I can't figure it out. How do I log a string in x64dbg? I can log the address with a breakpoint but wasn't able to log the actual text.
- 53
0
votes
1
answer
174
views
Get DLL name with PyDBG and System_dll.py?
Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just:
dbg.set_callback(...
- 345
0
votes
2
answers
2k
views
Tricore debugging tools
I am new in the reverse engineering, I have a good experience in programming MCUs like c51 and ARM.
Now I would like to learn about Tricore reverse engineering... ECUs mainly.
I can obtain the ECU ...
- 1
0
votes
2
answers
577
views
Automating a crackme solving process
Let's say we have a simple crackme, which asks for a password. After verifying it, eax will contain 1 if it is correct, and 0 otherwise. Is there a way (I am interested both in Linux and Windows) for ...
- 887
0
votes
1
answer
188
views
Is it possible to change/disable the keybindings for a game by modifying the exe using x64db or a similar program? [closed]
So I have a game I've been making mods for. I'd rather not reference the title here to avoid it showing up in google searches and leading people to exploits.
By, default, it doesn't allow keybind ...
0
votes
1
answer
115
views
Where is the code for ollytlscatch?
I've been trying to get antiResHacker.exe as mentioned in this question:
How to prevent use of Resource editors
However, the codebase for ollytlscatch (https://code.google.com/p/ollytlscatch/) ...
- 233
0
votes
1
answer
77
views
How can I ringfence an EXE to know what system resources it is accessing?
I do not want to debug the code within the program, I simply want to know what external resources it accesses - files, connections, registry, etc... Is there an easy way to do this in Windows?
0
votes
1
answer
186
views
Is it possible for a process to debug itself?
What happens if you try to debug yourself ? I mean, does the process crash ?
If it is possible, how would you implement it ?
I have tried launching x64dbg and I can't attach to my own x64dbg process.
...
- 3
0
votes
1
answer
1k
views
Evan's debugger (edb) - Failed to open and attach to process: execv() failed: No such file or directory
Problem:
When I try to open an executable (in this case exploit exercises protostar stack0), then the following message appears in a pop-up box:
Failed to open and attach to process: execv() failed: ...
- 239
0
votes
1
answer
1k
views
Remote debugging using IDA, connecting to windbg server (kernel mode)
I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
- 228
0
votes
1
answer
482
views
Advanced Anti-Debugging Techniques
I was wondering what are some advanced AntiDebugging techniques that more advanced than the basic ones like IsDebuggerPresent and CheckRemoteDebuggerPresent?
- 103
0
votes
1
answer
112
views
Does the Radare Debugger support STABS?
From the wiki on Stabs
stabs (sometimes written STABS) is a debugging data format for storing information about computer programs for use by symbolic and source-level debuggers.
Does Radare ...
- 1,769
0
votes
1
answer
542
views
GDB MI output vs. stdout
I am using GDBs machine interface (mi) to write some simple tracers/loggers.
Now I ran into the problem of telling apart GDB output from text the target-program itself wrote to stdout.
If I look ...
- 463
0
votes
2
answers
223
views
Techniques for marking memory changes
i'm using IDA to reverse some crypto code that seems to derive its key from some hashing functions. I have recognized the algoritm based on magic numbers, but i want to see its changes in memory ...
0
votes
1
answer
191
views
Detecting user<->kernel transitions with hypervisor
Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
0
votes
1
answer
1k
views
I'd like to ask about unpacking aspack 2.12
I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
0
votes
1
answer
2k
views
Calling DLL exports in x64dbg
I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
- 191
0
votes
1
answer
3k
views
Reversing a program with dongle
So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start.
From looking through the disassembly ...
0
votes
1
answer
88
views
Where can I get systematic problems and solutions for debugging?
I know PEFile headers, assembly language, and other basic stuff.
I am looking for some site or book which systematically teaches me debugging and reversing. Something like "Let us C" for C language.
...
- 21
0
votes
1
answer
461
views
create a string in ollydbg, x32dbg, immunity or similar
I have found a code cave in an executable and want to call winapi functions.
What do i have to write in the assembly window to create a string which can later be referenced?
For learning i changed ...
- 101
0
votes
1
answer
167
views
What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?
In Core Debugger Concepts What is the difference between Intrusive Attaching and Non-Intrusive Attaching when debugging?
- 134
0
votes
1
answer
766
views
Turbo Debugger - output cpu pane to file
I was asked for a special debugger which prints out the name of original calls used by author. I know the original exe was packed with Borland Turbo C (v.3) and the only debugger which output function ...
- 101
0
votes
0
answers
56
views
Is there a debugger for the entire x86 architecture?
When learning about the topic that includes processes, threads and image files it helped immensely to use x86dbg. However, it only shows things from the "view" of a single process.
I am ...
- 3
0
votes
1
answer
327
views
Can't add tracing in IDA, showing it in gray
I added read/write trace to a program. I was able to record the trace with IDA for the first time.
When I run it again, it didn't work.
I tried to do what I did on the first time, adding the read/...
- 573
0
votes
1
answer
436
views
open decompiler view of current module (dll) in dynamic analysis
I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
- 123
0
votes
0
answers
232
views
x64dbg show some text in Chinese
While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why.
This happened after I moved to a new computer but both of them were Windows 10.
In my old computer I ...
- 573
0
votes
0
answers
1k
views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
- 1
0
votes
0
answers
454
views
Using IDA pro 7.2 and android server breakpoints problem
i have been trying to use IDA to make a breakpoints on a 4 byte memory address
to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
- 1
0
votes
0
answers
114
views
Immunity Debuggger Inconsistent Results
Question for people using Immunity Debugger.
Just started using Immunity Debugger, using 1.85 on Win 7 Pro.
Doing some labs on vulnserver.exe and I am getting inconsistent results from Immunity ...
- 1
0
votes
0
answers
382
views
OllyDbg - After restarting program, breakpoints lost
I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
0
votes
0
answers
118
views
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.
I ...
- 476
0
votes
1
answer
5k
views
How to find functions in IDA Pro/x64dbg
i created a program for testing, very simple in c++.
is ask for password if it is match is print correct, if no it is print "bad".
i try to find with ida where is the function of what i made.
but i ...
- 59