Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
0
votes
2answers
86 views
crackme disassembly - are these local variables ever initialized?
I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
0
votes
0answers
56 views
Cellebrite Products Keygen [closed]
I have the current versions of cellebrite ufed 4pc (7.16) and physical analyzer (7.17). If possible can someone create a keygen for the software. The software uses a .dat license file.
0
votes
0answers
48 views
Do all games have static base addresses for values like gold and energy?
I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base ...
0
votes
0answers
18 views
Can't use J-Link with ADuC7126 evaluation board
I'm new to embedded, and would like your help.
Using uVision/Keil I successfully flashed my ADuC7126 Evaluation Board using the micro-USB.
I tried to use a mIDAS-Link JTAG (recognized as J-Link) ...
0
votes
1answer
85 views
Finding the correct emulator for programming a renesas sh7722 processor
I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I ...
4
votes
1answer
45 views
How do I type in hex input into radare2 debug mode?
#include<stdio.h>
#include<stdlib.h>
int main() {
puts("Enter input: ");
char buf[100];
fgets(buf, 100, stdin);
printf("%s", buf);
}
Suppose I am debugging a program, such ...
1
vote
0answers
37 views
How does Ida suspend threads?
I know that Ida uses ptrace function to attach and debug process.
How Ida can suspend thread? how is that possible?
0
votes
0answers
41 views
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.
I ...
2
votes
0answers
23 views
Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm
I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far.
qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
0
votes
1answer
57 views
IDA PRO Tracing stopps
I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
2
votes
0answers
46 views
Does pwntools provide any Radare2 integration?
I want to use pwntools with Radare2, since this is my debugger of choice.
However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb).
Anyone with experience in ...
1
vote
0answers
25 views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
0
votes
0answers
31 views
OPENOCD Error codes: How do I fix this?
I have a chip I am trying to use JTAG communications with using openOCD. However, I get the following error:
openocd -f ocd.cfg
Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports,...
0
votes
0answers
39 views
What is causing handles to be opened to crypto/RSA files when debugging with IDA?
When I debug an exe file in IDA and watch what happens in Procmon, I see a couple of calls to CreateFile
C:\Users\UserName\AppData\Roaming\Microsoft
C:\Users\UserName\AppData\Roaming\Microsoft\Crypto\...
0
votes
1answer
29 views
Is there a way to see & keep track of registers in dnSpy?
Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
2
votes
0answers
50 views
Radare2 cannot place a breakpoint on a MIPS code
I am doing a crack-me challenge, I would like to execute it to see v0 and v1 values.
This is the file command's output :
./ch27.bin: ELF 32-bit LSB executable, MIPS, MIPS32 rel2 version 1 (SYSV), ...
2
votes
1answer
107 views
How to print eax value with Radare2?
I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
1
vote
1answer
79 views
How to use aaa in radare2 while in -d (debug) mode?
This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here ...
0
votes
0answers
17 views
How to change iOS registers automatically?
Let's say that there is an app that always passes integer 1 to a register, x1. I reverse engineered it, so I found its address, function, and everything.
Is there a tool out there that allows me to ...
-1
votes
2answers
87 views
CreateThread returns true but thread doesn't run [closed]
I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions.
The call to the CreateThread returns a valid handle ...
0
votes
0answers
33 views
How to figure out what happens during <ModuleEntryPoint> in OLLYDBG
So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
1answer
74 views
How to set a breakpoint in an execve'd program in radare2?
If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A?
After a certain point in the execve routine, program B ...
1
vote
2answers
120 views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
1answer
43 views
Remote debugger for Linux from one VM (IDA) to another (running the debuggee)
I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM).
So, is it possible to debug if both ...
1
vote
1answer
70 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
1
vote
0answers
28 views
Motorola Freescale mpc564 microcontroller
Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
0
votes
1answer
65 views
Show arguments while debugging
I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program.
Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
2
votes
1answer
65 views
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
I'm using the newest version of Radare2 to analyze the Windows application.
As can be seen ...
0
votes
2answers
71 views
Issue with debugger - black screen and freeeze after loading game executable
I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
1
vote
1answer
130 views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...
2
votes
1answer
114 views
How to save (trace) the execution route/sequences in debugger and Replay?
is it possible to save the step-by-step execution route of the program?
i.e. lets say in x64dbg the program executes one handle after another
and so on, probably hundreds of calls...
But according ...
2
votes
1answer
112 views
How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?
How to make Radare2 automatically disassemble next instruction after each ds debug single-step?
I thought that e asm.bytes=1 would achieve this, but that doesn't help.
In particular, GDB supports ...
1
vote
1answer
60 views
Radare2 doesn't update current address, when single-step debugging using `ds`?
Radare2 doesn't update current address, when single-step debugging using ds?
I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
1
vote
2answers
147 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
1
vote
1answer
236 views
Analyzing and deobfuscating complex JS code [duplicate]
I am looking to reverse engineer a very ugly piece of JS found here.
As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
0
votes
1answer
256 views
IDA remote linux Debugger attach to a running process
I usually use remote linux debugger as shown below:
./linux_server bin
And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
0
votes
1answer
90 views
How to see all functions that called with debugger
I debugging with IDA, and I want to see/print all the functions that get called.
In the functions window I see over than 1000 functions.
So I want to see which functions are called when I press ...
0
votes
1answer
272 views
How to run ida in windows xp
I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application.
I search and found that IDA is not supported with Windows XP.
How can I run IDA ...
0
votes
1answer
78 views
How to identify different memory regions of an elf binary in radare2?
I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
1
vote
0answers
69 views
How to find which event is bound to which GUI part
let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ):
that program has a button xyz:
1) how to find out ...
1
vote
1answer
129 views
Run any line/command in x64dbg
Is it possible, to run whichever line I want?
For example, if it is at black position, and i want to run the RED CIRCLED command:
I couldn't find a way to do that, neither in right click or etc......
2
votes
2answers
244 views
Reconstructing Unity APK
Note: I am only doing this for educational purposes with no intent to redistribute
I have decompiled an APK built with Unity successfully (Somewhat).
Using an array of programs, I managed to extract ...
0
votes
1answer
70 views
Where to find address of registers populated in a binary
This question might sound very naive, however, I got stuck when one of my friends asked me where can I find the address of an initialized register in the stack.
For e.g., info registers in gdb gives ...
3
votes
0answers
132 views
IDA Pro's debugging - Stack view , Register values and ASCII decoding
Below questions are related to IDA Pro debugging:
1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
7
votes
2answers
324 views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
2
votes
2answers
2k views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
1
vote
0answers
57 views
How to dump firmware from R5F71424 MCU
I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware.
It has a limited boot mode that only allows writing to the MCU.
Any pointers or ideas would be helpful....
1
vote
3answers
182 views
IDA Debug DLL with non exported function
I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that?
Thanks so much./
4
votes
1answer
367 views
Extract firmware images from COTS embedded devices
I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points.
Is it in general possible to ...
0
votes
2answers
160 views
IDA PRO - compare running process
I have a software which writes some data to specific location in memory depending on user choices.
Say i can have 2 choices, A & B.
I want to run IDA, set option A and save all the data, then run ...
