Skip to main content

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
0 votes
0 answers
42 views

How to get which Tedit is referenced when retrieving text

Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv Now, the two parameters for the function are: LEA param_2=>local_8,[EBP + -0x4] MOV param_1,...
mark's user avatar
  • 1
0 votes
0 answers
42 views

Decoding API headers of unknown encoding?

I'm using mitmproxy to monitor facebook messenger app traffic on my android. Firstly I had to enable whitehat settings to use it. After that I found some request headers has some unknown value in body....
Wojciech Wolski's user avatar
1 vote
1 answer
99 views

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
Grandmaster's user avatar
0 votes
0 answers
51 views

How to use reverse engineering to get paginated threads id on facebook messenger

I'm trying to replicate websocket request in python. I want to get paginated results of threads id that appears after scrolling down the friends chats section. Seems messenger uses websocket for it. ...
Wippar's user avatar
  • 1
0 votes
0 answers
47 views

How to use reverse engineering to learn how facebook send messages?

I would like to know how I can use reverse engineering technique to learn how Facebook/messenger send messages? I were analyzing my developer tools network tab, but couldn't find anything. Fiddler ...
innocent98's user avatar
0 votes
0 answers
26 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
Unknown X's user avatar
0 votes
0 answers
35 views

How can I set up a conditional breakpoint for the CreateFileW function for when a specific file/path is read in x64dbg?

I'm currently debugging a program using x64dbg, and I'm struggling to set up a conditional breakpoint on the CreateFileW function: HANDLE CreateFileW( [in] LPCWSTR lpFileName,...
MendelG's user avatar
  • 53
0 votes
1 answer
57 views

Offset addressing

I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation: in code I ...
Andynvkz's user avatar
0 votes
0 answers
82 views

How to get decryption keys from an offline player?

I am just starting to learn reverse engineering from lena lectures. I have 2 encrypted sample vids and an offline player which is able to decrypt the videos and play them, is there any way,I can get ...
No One In particular's user avatar
0 votes
0 answers
46 views

Why a breakpoint works in x64dbg but not in IDA?

I've spent all morning trying to find a solution to debug with IDA the same function I'm debugging in x64dbg. In x64dbg, I just go to Symbols -> ws2_32.dll -> WSARecvFrom -> F2 (set ...
kuhi's user avatar
  • 161
0 votes
2 answers
138 views

How can I debug if the program closes directly?

I'm trying to debug a game and it's closing under few circumstances: When debugging (solved by hooking IsDebuggerPresent to return false when called by the game) When setting a memory/hardware ...
kuhi's user avatar
  • 161
0 votes
0 answers
49 views

Debugging [DebuggerHidden] method

My app uses DLL that calls another app with System.RuntimeType.InvokeMember. I decompiled all modules and got source code with VS2022 so I can see the code of System.RuntimeType.InvokeMember, but it's ...
morkovni's user avatar
0 votes
0 answers
40 views

How can I find the part of cmd.exe that processes windows batch commands before they're executed?

I'm able to find the ReadConsoleInputW commands for pause and reading input for commands but I'm unable to find the actual processing of the commands. I'm using x64dbg but I'm fairly new to Reverse ...
user19244091's user avatar
0 votes
0 answers
136 views

APK/Apktool If I decompile and recompile sources the app does not start

I'm trying to reverse an apk but there is a strange thing that happens, probably something new for me, basically if I decompile only the resources (not dex files) and recompile it zipalign/sign, the ...
zwave's user avatar
  • 1
0 votes
0 answers
37 views

how to set a BP on button in SunAwtCanvas in x96dbg

I'm trying to debug a program in x96dbg that I think this is written in Matlab. There is no string related to buttons or something interesting. Then I go to Handles tab to find buttons and set break ...
owl's user avatar
  • 1
1 vote
0 answers
80 views

Freeware x86 decompilers for Windows with debug? [closed]

I'm searching for a software that is capable of decompiling x86 code in C-like code and run a debug session within it with the possibility to see the content of the variables. That above was a quick ...
Alby87's user avatar
  • 111
1 vote
0 answers
123 views

Got access to SWD, but I need to identify the chip

I was able to connect to the chip via SWD/openocd, but I can't figure out what chip it is (says SM9PQ1 2322-52 on chip, googled but cant find anything). I'm hoping to download the firmware after I ...
Low Est's user avatar
  • 11
0 votes
0 answers
68 views

Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom

I hope you all are doing well and staying safe. I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
amoebame's user avatar
2 votes
1 answer
97 views

What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?

What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG? I found this command useful to debug with ASLR (w/o disabling it).
alond22's user avatar
  • 113
0 votes
0 answers
62 views

IDA Free Debugger slows down app substantially

I'm using IDA Free to decompile and debug an exectuable (a game, actually). When starting the debugger, the game runs really, really slow occasionally. Before, I have used Cheat Engine to debug the ...
Daniel's user avatar
  • 161
0 votes
0 answers
99 views

How to exclude "Process Monitor" from Themida's list of monitoring programs

Can Themida be made to whitelist a particular program of its list of "monitoring programs", whether through reversing or compile-flags? I want to exclude Sysinternals "Process Monitor&...
Coldblackice's user avatar
0 votes
0 answers
207 views

Need Help Cracking a Program

So I've got this .exe that I want to crack. It's an old management system for people in truck loading business. I kind of understand what's happening with window API calls but I'm unable to access the ...
The one word assaulter's user avatar
0 votes
0 answers
128 views

Debug the DLL of an EXE using IDA Freeware

I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
Luiz's user avatar
  • 1
0 votes
1 answer
75 views

IDA Pro: JDWP error: ABSENT_INFORMATION - Desired information is not available

I am trying to debug a dex file from an APK file in IDA Pro. I set some breakpoints when launching the activity. When I start the process, the application waits for the debugger. After some time, IDA ...
Quayyum Ali's user avatar
0 votes
1 answer
100 views

IDA Pro Debugging GDB SendDbgCommand

I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging. Setting up the debug environment with IDA Pro using ...
Ballers's user avatar
  • 49
0 votes
1 answer
102 views

Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing

Goal: Trying to reverse encrypter to decrypter that successfully decrypts. This is the pseudo-code of the disassembled encrypting program. There are no function calls, and I've been able to somewhat ...
Brandon Gregory's user avatar
1 vote
1 answer
315 views

Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?

In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
rasputin's user avatar
1 vote
0 answers
43 views

Retrieve functionality to button - game patching

I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have. In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
Yair Derry's user avatar
0 votes
0 answers
38 views

How can I make a quick tracer for a PE file?

INTRODUCTION: I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
Swoke's user avatar
  • 11
1 vote
2 answers
520 views

How can I jump to the start/end of a function in x64dbg?

I'm currently debugging a program using x64dbg, and I'm wondering how to quickly jump to the start or end (prologue/epilogue) of a function while I'm in the middle of it. I couldn't find this ...
MendelG's user avatar
  • 53
1 vote
2 answers
196 views

Debugging of any x86(_64) executable producing strange results under Parallels + Windows on Arm

Recently, I have been experimenting with using an M1 (Arm64) Mac full-time for RE work, including Windows on Arm under Parallels with x86(_64) binaries. From several online sources discussing this use ...
Benjamin Crawford Ctrl-Alt-Tut's user avatar
0 votes
1 answer
170 views

How can I debug a UWP application on startup?

I'm trying to debug a UWP application, and break on startup. However, when I start the application with windbg, the breakpoint didn't work. After further digging I found the process is started by ...
daisy's user avatar
  • 123
1 vote
1 answer
141 views

Rename a program's button using x64dbg?

I'm trying to change the name of a button, but I can't find anything that references it. I looked for the CreateWindow function in the intermodular calls, but I only found a reference to the main ...
William Marques's user avatar
1 vote
0 answers
69 views

How to debug armel and armhf binaries on x86-64 Ubuntu simultaneously?

I'm working on the challenges on ROP Emporium. For the ARMv5 version of the callme challenge, we are given two binaries and two shared libraries: callme_armv5 with libcallme_armv5.so and callme_armv5-...
jinscoe123's user avatar
1 vote
0 answers
50 views

JEB pro is not showing xrefs for native code (arm)

i have this problem when analyzing arm shared object. when working with IDA pro, it finds all xrefs but in jeb, most of xrefs are missing. when JEB finfishes, the final analysis lacks most of xrefs. I ...
shetal's user avatar
  • 51
2 votes
1 answer
160 views

What triggers RIP_EVENT?

The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
tomysshadow's user avatar
0 votes
1 answer
97 views

How to reverse a USB firmware patching tool for another device?

I have a USB device from a vendor (TRENDnet) that has the exact same chipset as a QNAP device with an available firmware patching tool. It's my belief that this firmware patching tool should work ...
Geruta's user avatar
  • 101
2 votes
0 answers
67 views

Radare2: How to Create a Custom Scripted Panel?

TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script? e.g. afvd | python var_displayer.py This is my current view. Multiple panels, ...
Khalid's user avatar
  • 21
1 vote
1 answer
82 views

Should shell32.dll be in executable search path for winword.exe with WinDBG?

I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
Invulnerable Immortal's user avatar
1 vote
0 answers
84 views

How to develop an anti-debug library which allow users to debug their own programs but not the library?

I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows). The down side of this library is: users would be abled to debug their own ...
prgbenz's user avatar
  • 81
3 votes
0 answers
186 views

What is the best emulator/environment for android debugging?

I know the question smells like I want a ready solution but I have been trying many things and after a lot of headaches, still I can't do what I want. There are fast emulators but they don't provide ...
shetal's user avatar
  • 51
3 votes
0 answers
78 views

How to unpack emotet with x64dbg and do dynamic analysis?

I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
KOT's user avatar
  • 31
2 votes
0 answers
54 views

i want to know how to tracing a exe's http responses and log them

I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
od8m's user avatar
  • 21
4 votes
2 answers
287 views

Malware analysis - Debugger hangs at HttpSendRequestA

I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC. I was able to replicate this behaviour with a small ...
Luca D'Amico's user avatar
4 votes
0 answers
544 views

How to do live debugging of ARM64 binaries on macOS with M1/M2 chips?

I'm trying to figure out why NSSavePanel fails in my SwiftUI app. I tried every possible documentation, or asking on the Swift programming forums - to no avail. I'm originally a Windows programmer, ...
c00000fd's user avatar
  • 1,691
3 votes
1 answer
46 views

Can radare2 skip syscall when `db main;dts+;dc`

more detailed see this In short, I want to skip syscall when recording program, but it seems that the program would always stop after ths syscall. Hope someone can help me. Thanks. below is running ...
An5Drama's user avatar
  • 133
3 votes
0 answers
87 views

x32dbg version causes crash on breakpoint

i'm a newbie to this whole shindig, and have started with https://gamehacking.academy. i'm finding this fun, but am getting stuck here: when i try to apply a breakpoint using x32dbg, as in https://...
Axolotl Kumar's user avatar
3 votes
0 answers
246 views

PEStudio DLL analysis: flag in export section

I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section: What does it mean the X in the flag column? So, what is a/the flag? ...
Gianluca's user avatar
  • 131
4 votes
0 answers
117 views

API Breakpoints not hitting while debugging a malware using x32dbg

I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful. I am going through a malware analysis course and following the debugging ...
Daksh Kapur's user avatar
2 votes
1 answer
414 views

xdbg64 Unable to find string.. Need help cracking a program

Ive been trying to crack my friends program for quite some time. He gave me permission and we are trying to see if his mod menu is ready to hit the market. Ive watched a couple youtube videos and I am ...
Alen 's user avatar
  • 21

1
2 3 4 5
13