Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
526
questions
0
votes
0answers
38 views
Bypass Javascript Debug Prevention in Firefox
I've looked around, and can't find an answer for my specific question. The closest I could find was this.
I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
1
vote
0answers
28 views
Can i follow the invoke function?
im trying to debug some C# app.
Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called).
Im using dnspy.
1
vote
1answer
61 views
Is there a way to attach x86dbg with ida pro?
IDA has the option to use debuggers but the debuggers are quite limited. Is there a way that I can use to use x86dbg with IDA Pro?
1
vote
1answer
28 views
Kernel debug two physical MacBook pro devices
I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?):
I'm trying to kernel debug a physical Macbook pro device.
When my setup ...
0
votes
2answers
102 views
Get Zip password used by application
I bought a game, "They are billions", and I'm trying to edit a savegame on my singleplayer campaign to change some vars (cheating because im very bad player). But the file is a password ...
1
vote
1answer
52 views
How to load modules symbols to IDA while debugging a process
I am debugging a program that I compiled.
This program calls SetWindowTextW.
When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there:
If I will load ...
0
votes
0answers
43 views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
1
vote
1answer
61 views
Reverse engineer sticky notes to allow external script to open new notes
For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from a external script - preferably python. Although I'm not good at reverse ...
2
votes
2answers
70 views
Changing value of parameter with gdb
I have a file named exploit.c inside which:
#include <stdbool.h>
#include <stdio.h>
const char y1 = 'a';
const char y2 = 'b';
const char y3 = 'x';
const char y4 = 'y';
const char y5 = 'i';...
1
vote
1answer
32 views
analyze how data is read in android usb device
I've a huawei envizion 360, which doesn't provide any API for other application. But I want to read raw data from this device, to an android or to a raspberry-pi for debugging and development purpose. ...
0
votes
1answer
52 views
Program goes to suspend when buffer overflow occurs
Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer.
I need to exploit it to get a ...
0
votes
0answers
36 views
Debug multithreaded program in X32dbg
I am still quite inexperienced in reverse engineering. I have a small program that establishes an HTTP connection to a server and send data via POST method to the servert. I see strings like Winhttp....
0
votes
0answers
57 views
EXCEPTION_ACCESS_VIOLATION in x32dbg
What is EXCEPTION_ACCESS_VIOLATION and how can i handle it?
I am a complete beginner and could not understand. Thanks in advance.
Edit: as I learned EXCEPTION_ACCESS_VIOLATION occurs when either ...
0
votes
1answer
49 views
How much of the kernel does remote kernel debugging allow you to debug?
This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have.
What ...
0
votes
1answer
61 views
What does “???” mean in x32dbg?
I see such things but I just couldn't understand. Do you have any ideas?
Thank you!
0
votes
0answers
17 views
Tools for tracing down a Windows-specific UUID generation?
I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID.
It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
1
vote
1answer
36 views
Switch between debuggers while paused on a breakpoint
Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
0
votes
0answers
27 views
Debugging kernel modul with IDA
I have shell at linux-arm-embedded and running gdb-server, There is kernel module(ko) that I want to debugging .
How can I do that with IDA ?
1
vote
1answer
44 views
GDB inserting breakpoint cause Segmentation Fault
I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
0
votes
2answers
63 views
kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works
Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes.
The first process is winword.exe and the second process is calc.exe
The virtual address in the first case ...
0
votes
0answers
27 views
Saving a breakpoint in radare2 loses the format string
Good day to you all.
I'm new to radare2 and reverse engineering in general.
Debugging a small crackme.
I want to save breakpoints.
Initially, everything is fine: db* > bps and load breakpoints: ...
0
votes
0answers
15 views
Run ltrace to avoid detection (on a different PID?)
I am trying to run ltrace on this file:
./launcher: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]...
0
votes
0answers
96 views
Windbg vs x64dbg for network analysis
I have a program that I want to perform malware analysis on. The program seems to use HTTPs with SSL pinning (my theory) and some other proprietary protocol. I want to understand what is the best tool ...
0
votes
0answers
35 views
Access violation writing location
I am currently playing with C# and detours/trampolines using a library I found here:
https://github.com/xcvd/Detours
I am attempting to hook a known function in a game and then call the original ...
0
votes
0answers
65 views
SSL pinning and bypass
I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
0
votes
1answer
88 views
Program prevents x64dbg from starting or kills it if it's already running. What to do?
I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows.
It looks like the program has some sort of anti-debug protection. I have the following behavior:
...
0
votes
1answer
55 views
IDA Unknown Exception Code 6F4
So basically I had set a breakpoint on a WINAPI function call. When I tried to run the program and step over the breakpoint, the program exits with the popup window: unknown exception code 6F4 (exc....
0
votes
1answer
74 views
Why compiler is doing this?
While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
0
votes
0answers
15 views
Load an IDB file when debugging kernel to get the function names in IDA?
I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files.
Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded ...
0
votes
0answers
17 views
How to pause a kernel debugee instead of stopping in IDA pro?
While debugging windows kernel with IDA, the problem is i cannot pause it like Windbg, when its running and i click on suspend, 50% of times it just freezes/crashes, and other times it just gets stuck ...
0
votes
1answer
85 views
Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?
I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
0answers
47 views
Using GDB to find the address of a buffer in a stripped C binary
I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
1
vote
2answers
101 views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
2
votes
2answers
64 views
How to test and debug x86 Assembly exceptions in NASM?
I have seen all the exception "IDs" in the Intel Manuals, and just came across sandpile's exception guide, which actually shows some hexcodes. For example, "divide by zero error":
...
0
votes
1answer
160 views
Debug 3rd-party apk with .so-files missing debug symbols
Apologies, if this has been asked before. I am reverse engineering a chinese app that connects to a BLE device, so I can inspect how it transmits the data. Using this official guide I decompiled my ...
2
votes
1answer
145 views
How to debug an application (exe) freeze and crash?
I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
2
votes
0answers
29 views
QEMU with GDB: Stepping Instruction causes Windows VM BSOD
I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing.
I have ...
1
vote
1answer
253 views
With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?
I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra.
I'...
5
votes
1answer
149 views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
2
votes
1answer
177 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
1
vote
1answer
116 views
How to let SIGTRAP get caught by sighandler in GDB?
I have a program that I am trying to reverse, which contains an int3 (0xCC) which emits a SIGTRAP signal, which is then handled by a sighandler defined in sigaction.
The handler performs calculations ...
2
votes
3answers
119 views
Where Can I Get .PDB files for Windows OS Components?
I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
0
votes
1answer
48 views
Is it possible for a process to debug itself?
What happens if you try to debug yourself ? I mean, does the process crash ?
If it is possible, how would you implement it ?
I have tried launching x64dbg and I can't attach to my own x64dbg process.
...
0
votes
0answers
51 views
How to use aarch64 call convention to understand an unknown function?
I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World!...
1
vote
1answer
58 views
how can ı debug encrypted dll with x32dbg and look getregistery request
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass ...
0
votes
0answers
232 views
Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container
My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using
sudo docker ...
1
vote
1answer
174 views
Analyse structure from memory dump
I'm trying to extract master key from OpenSSL 1.0.2l (statically linked without debug symbols).
I'm using x64dbg, I was able to locate int SSL_connect(SSL *s) method, so I have a breakpoint there (the ...
0
votes
0answers
38 views
Use IDAPython to automatically attach to a remote GDB server
I would like to automate the process of connecting to a remote debug server.
The following code worked for the remote win32 debugger:
from ida_dbg import *
set_remote_debugger(addr, port)
...
0
votes
0answers
69 views
How to debug a shared library with radare2?
I am currently trying to pick up radare2 but I am struggling on a little hurdle..
I am given a shared library, let's call it shared.so.
I managed to perform some static analysis using
$ r2 shared.so
...
1
vote
1answer
521 views
How can I debug Ghidra plugin Python scripts in IDE?
I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin)...
