Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
0
votes
0answers
13 views
Debugging multiple threads
I have a PE executable which uses threads to handle most of its functionality. The code that gets run when the thread is created is obfuscated and it's hard for me to extract information just from the ...
0
votes
0answers
15 views
How to figure out what happens during <ModuleEntryPoint> in OLLYDBG
So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
41 views
How to set a breakpoint in an execve'd program in radare2?
If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A?
After a certain point in the execve routine, program B ...
1
vote
2answers
86 views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
-1
votes
0answers
30 views
IDA Dalvik debugger on Andoid Device JDWP error: INVALID_OBJECT
IDA Dalvik debugger on Android Emulator throws JDWP error: INVALID_OBJECT, and then IDA hangs and not able to figure out why its happening.
-1
votes
0answers
23 views
Error Exception EOLeSysError class, When execute delphi program
I ran into a error and get the following message and just have EXE Files:
Error EOLeSysError class not registered Class Not Registered.
How I can find the name of the class which is not registered?...
0
votes
1answer
33 views
Remote debugger for Linux from one VM (IDA) to another (running the debuggee)
I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM).
So, is it possible to debug if both ...
1
vote
1answer
56 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
1
vote
0answers
23 views
Motorola Freescale mpc564 microcontroller
Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
0
votes
1answer
54 views
Show arguments while debugging
I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program.
Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
2
votes
1answer
49 views
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
I'm using the newest version of Radare2 to analyze the Windows application.
As can be seen ...
0
votes
2answers
61 views
Issue with debugger - black screen and freeeze after loading game executable
I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
1
vote
1answer
75 views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...
2
votes
1answer
94 views
How to save (trace) the execution route/sequences in debugger and Replay?
is it possible to save the step-by-step execution route of the program?
i.e. lets say in x64dbg the program executes one handle after another
and so on, probably hundreds of calls...
But according ...
2
votes
1answer
67 views
How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?
How to make Radare2 automatically disassemble next instruction after each ds debug single-step?
I thought that e asm.bytes=1 would achieve this, but that doesn't help.
In particular, GDB supports ...
1
vote
1answer
47 views
Radare2 doesn't update current address, when single-step debugging using `ds`?
Radare2 doesn't update current address, when single-step debugging using ds?
I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
1
vote
2answers
133 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
1
vote
1answer
109 views
Analyzing and deobfuscating complex JS code [duplicate]
I am looking to reverse engineer a very ugly piece of JS found here.
As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
0
votes
1answer
126 views
IDA remote linux Debugger attach to a running process
I usually use remote linux debugger as shown below:
./linux_server bin
And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
0
votes
1answer
75 views
How to see all functions that called with debugger
I debugging with IDA, and I want to see/print all the functions that get called.
In the functions window I see over than 1000 functions.
So I want to see which functions are called when I press ...
0
votes
1answer
145 views
How to run ida in windows xp
I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application.
I search and found that IDA is not supported with Windows XP.
How can I run IDA ...
0
votes
1answer
48 views
How to identify different memory regions of an elf binary in radare2?
I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
1
vote
0answers
66 views
How to find which event is bound to which GUI part
let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ):
that program has a button xyz:
1) how to find out ...
1
vote
1answer
105 views
Run any line/command in x64dbg
Is it possible, to run whichever line I want?
For example, if it is at black position, and i want to run the RED CIRCLED command:
I couldn't find a way to do that, neither in right click or etc......
2
votes
1answer
80 views
Reconstructing Unity APK
Note: I am only doing this for educational purposes with no intent to redistribute
I have decompiled an APK built with Unity successfully (Somewhat).
Using an array of programs, I managed to extract ...
0
votes
1answer
68 views
Where to find address of registers populated in a binary
This question might sound very naive, however, I got stuck when one of my friends asked me where can I find the address of an initialized register in the stack.
For e.g., info registers in gdb gives ...
3
votes
0answers
84 views
IDA Pro's debugging - Stack view , Register values and ASCII decoding
Below questions are related to IDA Pro debugging:
1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
7
votes
2answers
274 views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
2
votes
2answers
1k views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
1
vote
0answers
49 views
How to dump firmware from R5F71424 MCU
I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware.
It has a limited boot mode that only allows writing to the MCU.
Any pointers or ideas would be helpful....
1
vote
3answers
135 views
IDA Debug DLL with non exported function
I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that?
Thanks so much./
3
votes
1answer
208 views
Extract firmware images from COTS embedded devices
I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points.
Is it in general possible to ...
0
votes
2answers
136 views
IDA PRO - compare running process
I have a software which writes some data to specific location in memory depending on user choices.
Say i can have 2 choices, A & B.
I want to run IDA, set option A and save all the data, then run ...
2
votes
2answers
383 views
OllyDBG - Game Hacking
I am trying to reverse game called Assault Cube where I am gonna be making game hacks for. I using Ollydbg to reverse though I have no theoretical understanding of asm at all. I just follow online ...
1
vote
1answer
74 views
How to set hardware breakpoint by value?
I want to set in IDA breakpoint when a specific value is written on the stack.
I know how to set hardware breakpoint, but I can set it only by address.
0
votes
2answers
106 views
Proxy debugging tool doesn't capture traffic from some online games
I'm analyzing Android games with Fiddler 2 to see how the game collects data.
There is a problem, both Fiddler 2 and Charles Proxy doesn't capture any traffic from some online games. All i got are ads ...
1
vote
1answer
88 views
How to debug a crash in wow64.dll in 32bit process
I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
2
votes
1answer
118 views
Trying to hook DirectX9 using C++ - Keeps crashing
I posted a thread on StackOverflow a few days ago, and it's got little attention, so i though it's possible this might be a better place for it.
As the title says, i'm trying to hook/detour DirectX9 ...
1
vote
1answer
86 views
IDA PRO does miss calls when tracing
I am following this tutorial:
enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program.
I though ...
0
votes
2answers
201 views
How to use API monitor on specific process
I want to monitor specific process with API Monitor but I didn't understand how do I do it please.
I will happy to understand that.
By the way, can I monitor process while I debugging it with ida?
-1
votes
0answers
165 views
How to debug 1 step after click on button?
I am debugging an executable file with IDA and put a breakpoint at the place that I see 2 buttons.
I want to know which function is executed when I click on one of the buttons and witch one is ...
0
votes
1answer
79 views
How to breakpoint atached process with ida when move on
In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the ...
2
votes
2answers
527 views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
218 views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
1
vote
1answer
119 views
How debug process that not started with ida? [duplicate]
I am trying to debug two different exe files,in windows.
The first exe launches the second, and the second exe doesn't work well unless the first starts it.
I want to be able to debug the second exe....
3
votes
0answers
118 views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
2
votes
0answers
69 views
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.
Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.
However, whenever I try to debug ...
3
votes
1answer
394 views
Radare2 debugging - How to get into lazy imported functions?
I have a linux binary that imports functions from an external library (shared object). The functions are lazy loaded and not available when rip is at @main or @entry. When i step into such a function (...
1
vote
0answers
40 views
Is there any way to get value from bytecode under JDWP without access to source?
When I debug android app through jdwp using jdb, it seems I can't get anything from the bytecode level. I know normally it's fine as long as we have the source line info and use a decompiler, but the ...
0
votes
1answer
42 views
Find out where the string comes from (in Browser)
i.e. on a page, I see that after i.e. 5 seconds of page load, there appears a message:
Hello Akubatula, you are wonderful.
Lets say, i want to find out, from where does the word wonderful comes from....
