Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
0
votes
0answers
18 views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
im preety much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
1
vote
1answer
85 views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with virtual machine : the problem is it's not opcode anymore it's bytecode which I don't have any idea about because it's a private virtual ...
1
vote
2answers
99 views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
0
votes
0answers
47 views
Reverse engineering .NET malware - iloveyou.exe
I have a .NET malware sample whose dynamic behavior I understand. It is also packed.
de4dot identified the obfuscator as .NET Reactor, so I used de4dot to de-obfuscate it. However, after de-...
1
vote
1answer
66 views
Call Stack vs Intermodular Calls in Ollydbg
What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
0
votes
1answer
85 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1
vote
1answer
50 views
eip register address not matching with address at breakpoint (breakpoint set at main function)
I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below
(gdb) disass main
Dump of ...
1
vote
0answers
35 views
gdb - searching for pointers to a given memory region
Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
1
vote
0answers
22 views
Unable to attach java sources to APK being debugged in Android Studio — Option not displayed
This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
0
votes
0answers
22 views
Changing a string pointer while debugging
I'm facing an issue, and I'm not sure what is the best way to handle it.
While debugging a program (x64, windows), the program copies certain string using
errno_t strncpy_s(char *restrict dest, ...
1
vote
1answer
54 views
radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char
Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
0
votes
0answers
11 views
Forwarding Debug messages to winDbg from specific processes
The command ed nt!Kd_Default_Mask 8 in winDbg will get all printouts that generate from OutputDebugStringW from remote machine to the console
But In my scenario there are significantly large number ...
-1
votes
1answer
69 views
Program closing even with IsDebuggerPresent Patched!
i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.
Steps i Followed ...
2
votes
0answers
35 views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
0
votes
2answers
104 views
crackme disassembly - are these local variables ever initialized?
I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
0
votes
0answers
58 views
Do all games have static base addresses for values like gold and energy?
I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base ...
0
votes
1answer
92 views
Finding the correct emulator for programming a renesas sh7722 processor
I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I ...
4
votes
1answer
84 views
How do I type in hex input into radare2 debug mode?
#include<stdio.h>
#include<stdlib.h>
int main() {
puts("Enter input: ");
char buf[100];
fgets(buf, 100, stdin);
printf("%s", buf);
}
Suppose I am debugging a program, such ...
1
vote
0answers
41 views
How does Ida suspend threads?
I know that Ida uses ptrace function to attach and debug process.
How Ida can suspend thread? how is that possible?
0
votes
0answers
44 views
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.
I ...
2
votes
0answers
36 views
Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm
I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far.
qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
0
votes
1answer
67 views
IDA PRO Tracing stopps
I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
2
votes
0answers
56 views
Does pwntools provide any Radare2 integration?
I want to use pwntools with Radare2, since this is my debugger of choice.
However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb).
Anyone with experience in ...
1
vote
0answers
28 views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
0
votes
0answers
51 views
OPENOCD Error codes: How do I fix this?
I have a chip I am trying to use JTAG communications with using openOCD. However, I get the following error:
openocd -f ocd.cfg
Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports,...
0
votes
1answer
34 views
Is there a way to see & keep track of registers in dnSpy?
Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
2
votes
0answers
83 views
Radare2 cannot place a breakpoint on a MIPS code
I am doing a crack-me challenge, I would like to execute it to see v0 and v1 values.
This is the file command's output :
./ch27.bin: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), ...
2
votes
1answer
150 views
How to print eax value with Radare2?
I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
1
vote
1answer
86 views
How to use aaa in radare2 while in -d (debug) mode?
This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here ...
-1
votes
2answers
111 views
CreateThread returns true but thread doesn't run [closed]
I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions.
The call to the CreateThread returns a valid handle ...
0
votes
0answers
48 views
How to figure out what happens during <ModuleEntryPoint> in OLLYDBG
So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
80 views
How to set a breakpoint in an execve'd program in radare2?
If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A?
After a certain point in the execve routine, program B ...
1
vote
2answers
145 views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
1answer
53 views
Remote debugger for Linux from one VM (IDA) to another (running the debuggee)
I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM).
So, is it possible to debug if both ...
1
vote
1answer
82 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
1
vote
0answers
30 views
Motorola Freescale mpc564 microcontroller
Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
0
votes
1answer
74 views
Show arguments while debugging
I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program.
Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
2
votes
1answer
66 views
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
I'm using the newest version of Radare2 to analyze the Windows application.
As can be seen ...
0
votes
2answers
89 views
Issue with debugger - black screen and freeeze after loading game executable
I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
1
vote
1answer
162 views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...
2
votes
1answer
143 views
How to save (trace) the execution route/sequences in debugger and Replay?
is it possible to save the step-by-step execution route of the program?
i.e. lets say in x64dbg the program executes one handle after another
and so on, probably hundreds of calls...
But according ...
2
votes
1answer
153 views
How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?
How to make Radare2 automatically disassemble next instruction after each ds debug single-step?
I thought that e asm.bytes=1 would achieve this, but that doesn't help.
In particular, GDB supports ...
1
vote
1answer
84 views
Radare2 doesn't update current address, when single-step debugging using `ds`?
Radare2 doesn't update current address, when single-step debugging using ds?
I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
1
vote
2answers
187 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
1
vote
1answer
303 views
Analyzing and deobfuscating complex JS code [duplicate]
I am looking to reverse engineer a very ugly piece of JS found here.
As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
0
votes
1answer
326 views
IDA remote linux Debugger attach to a running process
I usually use remote linux debugger as shown below:
./linux_server bin
And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
0
votes
1answer
126 views
How to see all functions that called with debugger
I debugging with IDA, and I want to see/print all the functions that get called.
In the functions window I see over than 1000 functions.
So I want to see which functions are called when I press ...
0
votes
1answer
359 views
How to run ida in windows xp
I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application.
I search and found that IDA is not supported with Windows XP.
How can I run IDA ...
0
votes
1answer
89 views
How to identify different memory regions of an elf binary in radare2?
I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
1
vote
0answers
71 views
How to find which event is bound to which GUI part
let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ):
that program has a button xyz:
1) how to find out ...
