Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
610
questions
0
votes
0
answers
28
views
Debug the DLL of an EXE using IDA Freeware
I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
- 1
0
votes
1
answer
51
views
IDA Pro: JDWP error:ABSENT_INFORMATION desired information is not avaiable
I am trying to debug a dex file in ida pro from an apk file.I set some breakpoint on launcing activity.When I start the proces the application wait for debugger.After some time Ida pro shows this JDWP:...
0
votes
1
answer
37
views
IDA Pro Debugging GDB SendDbgCommand
I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging.
Setting up the debug environment with IDA Pro using ...
- 49
0
votes
1
answer
95
views
Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing
Goal:
Trying to reverse encrypter to decrypter that successfully decrypts.
This is the pseudo-code of the disassembled encrypting program. There are no function calls, and I've been able to somewhat ...
0
votes
1
answer
65
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
- 11
1
vote
0
answers
25
views
Retrieve functionality to button - game patching
I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have.
In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
- 21
0
votes
0
answers
32
views
How can I make a quick tracer for a PE file?
INTRODUCTION:
I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
- 11
1
vote
2
answers
88
views
How can I jump to the start/end of a function in x64dbg?
I'm currently debugging a program using x64dbg, and I'm wondering how to quickly jump to the start or end (prologue/epilogue) of a function while I'm in the middle of it. I couldn't find this ...
- 103
0
votes
1
answer
54
views
Debugging of any x86(_64) executable producing strange results under Parallels + Windows on Arm
Recently, I have been experimenting with using an M1 (Arm64) Mac full-time for RE work, including Windows on Arm under Parallels with x86(_64) binaries. From several online sources discussing this use ...
0
votes
1
answer
60
views
How can I debug a UWP application on startup?
I'm trying to debug a UWP application, and break on startup. However, when I start the application with windbg, the breakpoint didn't work.
After further digging I found the process is started by ...
- 123
0
votes
1
answer
68
views
Rename a program's button using x64dbg?
I'm trying to change the name of a button, but I can't find anything that references it. I looked for the CreateWindow function in the intermodular calls, but I only found a reference to the main ...
1
vote
0
answers
40
views
How to debug armel and armhf binaries on x86-64 Ubuntu simultaneously?
I'm working on the challenges on ROP Emporium. For the ARMv5 version of the callme challenge, we are given two binaries and two shared libraries: callme_armv5 with libcallme_armv5.so and callme_armv5-...
- 151
1
vote
0
answers
32
views
JEB pro is not showing xrefs for native code (arm)
i have this problem when analyzing arm shared object.
when working with IDA pro, it finds all xrefs but in jeb, most of xrefs are missing.
when JEB finfishes, the final analysis lacks most of xrefs. I ...
- 51
2
votes
1
answer
68
views
What triggers RIP_EVENT?
The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
- 137
0
votes
1
answer
75
views
How to reverse a USB firmware patching tool for another device?
I have a USB device from a vendor (TRENDnet) that has the exact same chipset as a QNAP device with an available firmware patching tool.
It's my belief that this firmware patching tool should work ...
- 101
1
vote
0
answers
41
views
Radare2: How to Create a Custom Scripted Panel?
TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script?
e.g. afvd | python var_displayer.py
This is my current view. Multiple panels, ...
- 11
0
votes
1
answer
50
views
Should shell32.dll be in executable search path for winword.exe with WinDBG?
I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
1
vote
0
answers
52
views
How to develop an anti-debug library which allow users to debug their own programs but not the library?
I'm going to publish a library which guarded by anti-debug ,(ptrace_trackme for Linux and isDebuggerPresent for windows).
The down side of this library is: users would be abled to debug their own ...
- 81
3
votes
0
answers
105
views
What is the best emulator/environment for android debugging?
I know the question smells like I want a ready solution but I have been trying many things and after a lot of headaches, still I can't do what I want.
There are fast emulators but they don't provide ...
- 51
3
votes
0
answers
55
views
How to unpack emotet with x64dbg and do dynamic analysis?
I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
- 31
2
votes
0
answers
52
views
i want to know how to tracing a exe's http responses and log them
I want to "crack" this cheat loader protected by thermedia and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way ...
- 21
4
votes
2
answers
159
views
Malware analysis - Debugger hangs at HttpSendRequestA
I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC.
I was able to replicate this behaviour with a small ...
- 298
3
votes
0
answers
135
views
How to do live debugging of ARM64 binaries on macOS with M1/M2 chips?
I'm trying to figure out why NSSavePanel fails in my SwiftUI app. I tried every possible documentation, or asking on the Swift programming forums - to no avail.
I'm originally a Windows programmer, ...
- 1,517
3
votes
1
answer
39
views
Can radare2 skip syscall when `db main;dts+;dc`
more detailed see this
In short, I want to skip syscall when recording program, but it seems that the program would always stop after ths syscall.
Hope someone can help me. Thanks.
below is running ...
- 33
3
votes
0
answers
56
views
x32dbg version causes crash on breakpoint
i'm a newbie to this whole shindig, and have started with https://gamehacking.academy. i'm finding this fun, but am getting stuck here: when i try to apply a breakpoint using x32dbg, as in https://...
3
votes
0
answers
110
views
PEStudio DLL analysis: flag in export section
I start to use PEStudio for DLL analysis; I understand (more or less) everything, except the "exports (flag)" section:
What does it mean the X in the flag column? So, what is a/the flag?
...
- 131
4
votes
0
answers
71
views
API Breakpoints not hitting while debugging a malware using x32dbg
I have been having a really strange issue which I have tried all ways to troubleshoot from my end but was not successful.
I am going through a malware analysis course and following the debugging ...
- 41
1
vote
1
answer
146
views
Xdbg64 Unable to find string.. Need help cracking a program
Ive been trying to crack my friends program for quite some time. He gave me permission and we are trying to see if his mod menu is ready to hit the market. Ive watched a couple youtube videos and I am ...
- 11
2
votes
0
answers
29
views
How we capture serial data on wirshark
I have capture this data but I am not understanding this data
- 21
3
votes
0
answers
258
views
Decoding the Apple vendor tag in the 802.11 beacon
Background
Looking to answer Is there a way to detect if you're connected via a shared WiFi Hotspot? on apple.stackexchange.com lead me to How does iOS and OS X detect when a Wi-Fi network is a ...
- 31
1
vote
0
answers
106
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to Solve this.
I have seen sandbox reports in those the ...
- 31
2
votes
1
answer
137
views
What are the prerequisite knowledge needed to start solving crackmes?
I started by reading a book on C language and then moved on to "Programming From Ground Up," which teaches basic programming in x86.
School just ended, I'm working on cracking a game called ...
4
votes
0
answers
175
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 151
1
vote
0
answers
132
views
Debugging 32 bit MS DOS program
I have 32 bit MS DOS programs (used DOS extender DOS4GW.EXE). Program compiled with WATCOM C++ 32 bit, I am looking for debugger and disassembler for Win7, Win10 or WinME. Who knows?
- 323
2
votes
0
answers
65
views
Problems trying to debug a running application on my PC
I've been reverse engineering an application out of necessity, meaning I'm a beginner on the subject. After days analyzing decompiled code from ILSpy I noticed that debugging the application would ...
2
votes
0
answers
48
views
Manipulating Raw Stack Data without Local Variables and Function Parameters
Imagine a scenario where a program's stack data is corrupt and you need to diagnose the issue. How would you go about manipulating and analyzing the raw stack data without the use of any local ...
- 171
5
votes
1
answer
344
views
How to use dnSpyEx or some other .NET debugger to attach to a .NET process started with a process-hollowing technique?
I have a .NET executable that is started using the process-hollowing technique. Here's how it looks from the Detect-It-Easy tool:
I can open the image file for that process (from disk) with dnSpyEx, ...
- 1,517
3
votes
0
answers
33
views
How to view a QJsonValue while debuging exe with IDA
I'm step by step debugging a program in IDA.
The program uses the Qt-toolkit.
The function that I'm stepping through is handling a json document.
For example here it is accessing the key workgroup and ...
- 31
2
votes
0
answers
62
views
Buffer overflow gets() weird parsing
I'm attempting to do a buffer overflow with gets(). I've figured out how to write over the return address and I'm able to do so, however, I cannot write in the address I need because the 0x7F at the ...
- 21
-1
votes
1
answer
121
views
Anti-patching checksum [closed]
I'm busy with debugging a program in x64dbg and it has some kind of anti-patching mechanism so can someone please advise me on how I would go about finding the functions which are calculating the ...
- 49
2
votes
0
answers
33
views
Finding a check in Chrome
Chrome doesn't allow switching on extensions which are not from the Chrome store.
There is no this limitation in Chromium. So it is only in Chrome.
It checks verified_contents.json (in which content ...
- 163
2
votes
0
answers
45
views
Greenpacket OH-735 onboard header
I got myself a Greenpacket OH-735 LTE outdoor unit. On the outside it has a SIM slot and an ethernet interface. Access to the web interface is pretty restricted, not much to set and it is branded with ...
- 21
2
votes
0
answers
224
views
Find caller function by DLL loading in x64dbg
First of all I'm noob at debugging task and I'm try to self-study to learn how to debug exe using x64dbg.
I have EXE file packed by themida. i bypassed themida packing using themida plugin in x64dbg....
2
votes
0
answers
37
views
I am trying to develop a second version of SkiFree using OllyDbg. How can I add a new enemy or obstacle without the source code?
I am a programmer and reverse engineer. I am interested in reverse engineering SkiFree since it is free to use.
However I have been wondering how to add a new enemy or obstacle since I do not have the ...
- 31
2
votes
1
answer
458
views
How to hide Remote Windows Debugger in IDA Pro?
Whenever I try to debug a 3D game through VMware and IDA Pro, an "access violation" pops up.
The error occurs in the body of the program after memory is allocated by the operator New.
...
user42316
1
vote
0
answers
189
views
x32dbg : exe with different code address when running
I have a 32 bits exe that works only when there is a specific usb flash disk inserted. On my new laptop, I only have a single USB port, so I want to make it works without the original key, or from a &...
- 141
0
votes
1
answer
184
views
ida pro: scripting debugger with python fails on step_over/run_to
So I am trying to run an app and collect information at certain points.
No biggie, right? Wrong. Check this simple example:
import ida_dbg
ida_dbg.step_over() #or runto()
eax = ida_dbg.get_reg_val(&...
- 453
1
vote
1
answer
373
views
How to debug a malware that does DLL injection into explorer.exe?
What steps would you suggest for debugging a malware that injects a DLL into explorer.exe?
using X32dbg
have already attached explorer.exe to x32dbg
- 11
0
votes
1
answer
92
views
Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering
I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
- 33
1
vote
2
answers
998
views
How to attach and step through a running .NET process?
This is quite easy to do with a low-level debugger, like x64dbg (for instance). Say, if I have a running native process I can attach to it, set a breakpoint, and then step through native code with it.
...
- 1,517