Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
563
questions
0
votes
0
answers
31
views
Finding function called when button is clicked
I am trying to find what function was called from the main application upon the button click in the specific game. In particular, there is a starting UI, where I can select Load option and then click ...
- 146
0
votes
0
answers
33
views
Is it possible to copy a video game and edit the copied version?
Sorry if this is a "dumb" question, but I couldn't find anywhere else to ask this. I want to "copy" my game of Super Smash Bros. Ultimate and edit/change in-game features. I also ...
0
votes
0
answers
23
views
Better debug output with IDA
I don't have much knowledge and experience with assembly so I value more or less readable IDA's pseudocode output. I want to examine stack and locals of the specific functions I set breakpoint in, ...
- 33
0
votes
0
answers
22
views
Call function only when check box is checked
Which function is responsible whether the check box is checked or not in disassembler's intermodular calls window?
2
votes
1
answer
120
views
Ghidra Debugger not working
When I try to debug one of hackadayu exercises (or any other file) using "debug c1 in dbgeng locally via GADP" I get following errors:
Launch failed for {args=/C:/Users/abc/Desktop/...
- 21
1
vote
1
answer
92
views
Instructions to compare two strings
I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
0
votes
1
answer
108
views
Why 0x90 byte is always at top of my file?
Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest.
Back to the topic, I have a python file which I obfuscated it and anytime I ...
- 11
0
votes
1
answer
87
views
Ghidra: Reading all registers contents at chosen instruction
Remembering all register contents may be exhausting so I would like to find a solution to be able to see all register contents at a chosen instruction in the Listing. I know debuggers got this ...
0
votes
0
answers
22
views
Radare2 only printing out the last byte at RSP when using pxq @ rsp
According to documentation,
px[?][owq] [len] hexdump of N bytes (o=octal, w=32bit, q=64bit)
and
pr[?][glx] [len] print N raw bytes (in lines or hexblocks,
'g'unzip)
These two ...
- 23
1
vote
0
answers
20
views
How to make the default stack width/offset 8 bytes when debgging in radare2
If you start radare2 in debugging mode like:
r2 -d /usr/bin
you'll be prompted with something similar to:
If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
- 23
0
votes
1
answer
43
views
How to determine the data type of a register
I'm learning reverse engineering and I'm trying to understand what process people use to identify a variable type.
For example, I'm looking at an argument being passed to a function and I'm trying to ...
0
votes
1
answer
74
views
Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender
In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
- 156
0
votes
0
answers
49
views
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.
I did small debugging. While doing it, the ...
0
votes
0
answers
26
views
IDA debugger register string pointer in conditional breakpoints
When debugging in IDA, it’s possible to use an IDC script as the breakpoint condition. I want to break if EAX points to a null terminated string which contains “substring”. I can’t seem to find a ...
0
votes
0
answers
57
views
How to debug a DLL without rundll32
I'm currently looking at the sample mentioned in this article here, and it seems that it uses the SvcMain function prototype instead of the runnableExport function prototype used by rundll32. As a ...
- 1
0
votes
0
answers
15
views
Print CMarkupSTL object with GDB
CMarkupSTL is contain XML. How can I print that XML with GDB while I debug process?
I run on Arm Linux
0
votes
0
answers
86
views
How to resolve illegal instruction for this ARM stack exploitation?
Summary
I am trying to write a stack overflow exploit for ARM Cortex-A72 running
Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to
the ARMv7 (32-bit) instruction set.
I have ...
0
votes
1
answer
64
views
help me to debug file packed with molebox and proteced with obsidium
I have a exe file that packed with molebox and protected with obsidium.
I try to unpack it with demoleition but it has some problem. when I want to open the unpacked file
it says "Component '...
- 1
2
votes
0
answers
74
views
Strange exception thrown while debugging in Win10, but not Win7
I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
- 121
1
vote
0
answers
66
views
IDA tracing not working
I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called.
I have tried to use IDA Tracing, but it doesn't print to file.
- 73
1
vote
0
answers
24
views
Using rbreak without import functions
While debugging with GDB I want to break for each function and print the PC register.
rbreak .
define hook-stop
i r $PC
c
end
The problem is that is stop on functions that imported like printf ...
1
vote
1
answer
46
views
How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]
I have this class with constructor offsets and attributes:
public class example
{
// Fields
public float Attribute_1 = 1.5f; // 0x8
public int Attribute_2 = 102 ; // 0xC
// RVA: ...
- 21
1
vote
0
answers
56
views
Counting how many times a function is called
I want to change context (Rdx, Rax etc.) everytime a specific function gets called.
My solution: I seted up a breakpoint at function event.get_thread().set_context({"Rdx" : "bla bla&...
- 11
1
vote
0
answers
46
views
Scraping data from an audio analyzer application
Briefly:
I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start?
...
1
vote
0
answers
147
views
Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)
I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it").
I found that user to have the most ...
- 11
0
votes
0
answers
107
views
How to debug a .NET windows service: "Cannot start service from the command line or a debugger"
I have a .NET windows service which I can stop and run through Process Hacker.
I can also view it's code with dnSPY.
I tried to debug it without a success by trying to attach to the process.
I wanted ...
- 451
2
votes
1
answer
205
views
Debug shared library in Android application
There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug .
When I look at /proc/PID/maps I don't see that library (I do see the ...
- 23
0
votes
2
answers
126
views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
- 39
1
vote
1
answer
31
views
Adding ltrace information to gdb
I'd like to run gdb (or gdb-peda) with ltrace like info on each syscall. How can I do that?
I know that, as per ltrace and gdb attach to same process , you can't actually attach ltrace and gdb to the ...
- 185
1
vote
1
answer
138
views
How can I find out the size of heap allocations?
While I debug with GDB I see the address of a buffer that's located on the heap.
How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated?
When I ...
1
vote
1
answer
113
views
Connect remotely with GDBSERVER to pid
When I run gdbserver to listen for port and connect remotely with gdb:
Gdbserver command:
gdbserver --multi 0.0.0.0:4444
Gdb command:
target remote 192.168.1.99 4444
In gdb . How can I connect to pid ...
- 11
0
votes
0
answers
100
views
How to decrypt/decode the strings found in desktop application with x64dbg?
I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
- 101
0
votes
1
answer
82
views
PEDA: Don't show context
gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
- 185
0
votes
0
answers
120
views
Remote debugging with Binary Ninja on Windows possible?
Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
- 101
1
vote
1
answer
345
views
How to debug a .net DLL?
I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues:
First one:
(...
- 35
0
votes
0
answers
105
views
Trying to debug with IDA Pro + Windbg on remote VM: It won't break or step
I'm new to remote debugging so plz bare with me.
I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is ...
- 51
0
votes
0
answers
50
views
IDA + Windbg does not break on sxe commands
I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running ...
- 51
2
votes
1
answer
643
views
How to get offset of specific function in exe?
Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
- 23
0
votes
0
answers
51
views
Memory Viewer/Debugger for VBA
I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc.
I want something like this:
I.e. a GUI that has some of the ...
- 101
0
votes
0
answers
39
views
is it possible to get code out of chipset through reverse engineering?
for example, encryption/decryption mechanism was inbuilt in a chip, to get the code that performs this mechanisms, is there some ways you can get this code through reverse engineering? what tools and ...
- 179
1
vote
2
answers
607
views
How to debug / analyze a Themida protected binary
Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation:
STACK_TEXT:
03799f54 00f91cfa 24d1ae78 0000000f ...
- 2,908
2
votes
1
answer
88
views
Debugging Native Lib using IDA Pro Fails to Load Registers and other Information
Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
- 121
0
votes
0
answers
77
views
How can I find out where relocated functions are in a Win16 executable in SoftICE?
Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
- 101
1
vote
1
answer
70
views
print format in radare2 cannot output all my string
I was doing a CTF challenge and I need to see the value of RAX register in radare2.
I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
1
vote
0
answers
52
views
'... Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript
I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error
Unable to get property 'Debugger' of undefined or null reference.
Line was simply var ctl = host....
- 11
0
votes
0
answers
14
views
Immunity Debugger Trace of Vulnerable Application
I'm trying to trace a vulnerable application while it is being exploited. I'm testing it on the application and exploit pair found at (https://www.exploit-db.com/exploits/36826). the exploit works ...
- 1
1
vote
1
answer
127
views
IDA Pro Debbuger is debugging the original code and not the patched code
Using IDA Pro, I tried to patch int 2Dh to nop.
However, with the debugger, it seems that the original code is being loaded.
What may be the reason for that? This might be related for some protections?...
- 113
0
votes
0
answers
54
views
How to debug an unknown Tricore binary
I want to analyze a binary from a automotive ECU with an Infineon TC1797 Tricore processor. I can load it in Ghidra, and have analyzed and reverse-engineered a bit of code at the starting address. I ...
- 1
1
vote
1
answer
84
views
Debug bFLT in qemu-arm-static
I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static .
I want to debug that binary dynamically with GDB.
I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1
vote
1
answer
135
views
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
