Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

debug native code and net code

I have a .net dll with a lot of calculations and formulas. From this dll, I want to set breakpoints to see the calculated results for a specific field. The main program is written in native code. So, ...
user avatar
1 vote
1 answer
45 views

Ollydbg - How to find the code of the method OnChange of text field delphi?

I have an application programmed with delphi. I want to find the section of code of the function OnChange of a text field. How to find it on Ollydbg? Also, how can I set breakpoint on any window show ...
user avatar
0 votes
1 answer
34 views

VMware Dynamic Analysis on Chosen Executable within VM

I am trying to use vmware for debugging. What I am trying to achieve is once an executable has been opened inside a vm which runs on Windows, I would like to extract the runtime traces for that ...
user avatar
  • 11
2 votes
1 answer
69 views

How to debug cfg80211.ko

I have an Linux embedded device that I want to debug the cfg80211.ko I have full root SSH on that device. How can I debug cfg80211.ko?
user avatar
0 votes
2 answers
45 views

Radare2 - changing stdin during binary debugging

I'd like to know how to change stdin multiple times for the given binary for debugging purposes. I know I can launch the application with r2 -r profile.r2 -d binary Where, inside the profile.r2 file ...
user avatar
3 votes
1 answer
44 views

Radare2 - Saving information/metadata from a debugging session

I'd like to know how I can save/restore comments or possibly other metadata during a debugging session. I know how to save this data when running radare without the -d flag but I often need to debug ...
user avatar
0 votes
0 answers
70 views

Is there a debugger that will trace into ring-0 code?

Is there a debugger these days that will trace beyond a syscall or sysenter into ring-0 code? Or is there a technique using a debugger like Windbg? I have read that if you get close enough to the ...
user avatar
1 vote
2 answers
204 views

Examining memory without attaching to the process by using /proc/$PID/mem?

I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example. #include <stdio.h> #include <unistd.h> ...
user avatar
  • 1,664
3 votes
1 answer
42 views

How to use software watchpoints in LLDB?

After trying to use watch command, LLDB said the device had 0 available hardware watchpoints. In GDB you can use set can-use-hw-watchpoints 0 How do you disable hardware watchpoints in LLDB?
user avatar
  • 144
0 votes
1 answer
16 views

Gdb hardware watchpoint error on android

After failing to find a solution to this I have started using Gdb and have encountered another error. Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
user avatar
  • 144
2 votes
1 answer
80 views

LLDB debugging on android?

I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
user avatar
  • 144
0 votes
1 answer
71 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
user avatar
0 votes
0 answers
39 views

Finding function called when button is clicked

I am trying to find what function was called from the main application upon the button click in the specific game. In particular, there is a starting UI, where I can select Load option and then click ...
user avatar
  • 146
0 votes
0 answers
34 views

Is it possible to copy a video game and edit the copied version?

Sorry if this is a "dumb" question, but I couldn't find anywhere else to ask this. I want to "copy" my game of Super Smash Bros. Ultimate and edit/change in-game features. I also ...
user avatar
0 votes
0 answers
32 views

Better debug output with IDA

I don't have much knowledge and experience with assembly so I value more or less readable IDA's pseudocode output. I want to examine stack and locals of the specific functions I set breakpoint in, ...
user avatar
  • 33
0 votes
0 answers
24 views

Call function only when check box is checked

Which function is responsible whether the check box is checked or not in disassembler's intermodular calls window?
user avatar
2 votes
1 answer
336 views

Ghidra Debugger not working

When I try to debug one of hackadayu exercises (or any other file) using "debug c1 in dbgeng locally via GADP" I get following errors: Launch failed for {args=/C:/Users/abc/Desktop/...
user avatar
  • 21
1 vote
1 answer
112 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
user avatar
0 votes
1 answer
271 views

Why 0x90 byte is always at top of my file?

Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest. Back to the topic, I have a python file which I obfuscated it and anytime I ...
user avatar
0 votes
1 answer
137 views

Ghidra: Reading all registers contents at chosen instruction

Remembering all register contents may be exhausting so I would like to find a solution to be able to see all register contents at a chosen instruction in the Listing. I know debuggers got this ...
user avatar
0 votes
1 answer
39 views

Radare2 only printing out the last byte at RSP when using pxq @ rsp

According to documentation, px[?][owq] [len]    hexdump of N bytes (o=octal, w=32bit, q=64bit) and pr[?][glx] [len]    print N raw bytes (in lines or hexblocks, 'g'unzip) These two ...
user avatar
1 vote
1 answer
33 views

How to make the default stack width/offset 8 bytes when debgging in radare2

If you start radare2 in debugging mode like: r2 -d /usr/bin you'll be prompted with something similar to: If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
user avatar
0 votes
1 answer
45 views

How to determine the data type of a register

I'm learning reverse engineering and I'm trying to understand what process people use to identify a variable type. For example, I'm looking at an argument being passed to a function and I'm trying to ...
user avatar
0 votes
1 answer
80 views

Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender

In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
user avatar
  • 156
0 votes
0 answers
52 views

Which encryption returns 192 hash value it means 96 in bytes?

I am reversing an APK and there is a signature that needs to be found. The function from where the signature is generated is present in the .so file. I did small debugging. While doing it, the ...
user avatar
0 votes
0 answers
37 views

IDA debugger register string pointer in conditional breakpoints

When debugging in IDA, it’s possible to use an IDC script as the breakpoint condition. I want to break if EAX points to a null terminated string which contains “substring”. I can’t seem to find a ...
user avatar
0 votes
0 answers
16 views

Print CMarkupSTL object with GDB

CMarkupSTL is contain XML. How can I print that XML with GDB while I debug process? I run on Arm Linux
user avatar
0 votes
0 answers
153 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
user avatar
1 vote
1 answer
94 views

help me to debug file packed with molebox and proteced with obsidium

I have a exe file that packed with molebox and protected with obsidium. I try to unpack it with demoleition but it has some problem. when I want to open the unpacked file it says "Component '...
user avatar
  • 11
2 votes
0 answers
91 views

Strange exception thrown while debugging in Win10, but not Win7

I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
user avatar
1 vote
0 answers
76 views

IDA tracing not working

I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called. I have tried to use IDA Tracing, but it doesn't print to file.
user avatar
  • 183
1 vote
0 answers
25 views

Using rbreak without import functions

While debugging with GDB I want to break for each function and print the PC register. rbreak . define hook-stop i r $PC c end The problem is that is stop on functions that imported like printf ...
user avatar
1 vote
1 answer
51 views

How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]

I have this class with constructor offsets and attributes: public class example { // Fields public float Attribute_1 = 1.5f; // 0x8 public int Attribute_2 = 102 ; // 0xC // RVA: ...
user avatar
  • 21
1 vote
0 answers
65 views

Counting how many times a function is called

I want to change context (Rdx, Rax etc.) everytime a specific function gets called. My solution: I seted up a breakpoint at function event.get_thread().set_context({"Rdx" : "bla bla&...
user avatar
1 vote
0 answers
47 views

Scraping data from an audio analyzer application

Briefly: I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start? ...
user avatar
1 vote
0 answers
187 views

Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)

I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it"). I found that user to have the most ...
user avatar
  • 11
0 votes
0 answers
152 views

How to debug a .NET windows service: "Cannot start service from the command line or a debugger"

I have a .NET windows service which I can stop and run through Process Hacker. I can also view it's code with dnSPY. I tried to debug it without a success by trying to attach to the process. I wanted ...
user avatar
  • 471
2 votes
1 answer
355 views

Debug shared library in Android application

There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug . When I look at /proc/PID/maps I don't see that library (I do see the ...
user avatar
  • 23
0 votes
2 answers
195 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
user avatar
  • 49
1 vote
1 answer
42 views

Adding ltrace information to gdb

I'd like to run gdb (or gdb-peda) with ltrace like info on each syscall. How can I do that? I know that, as per ltrace and gdb attach to same process , you can't actually attach ltrace and gdb to the ...
user avatar
1 vote
1 answer
255 views

How can I find out the size of heap allocations?

While I debug with GDB I see the address of a buffer that's located on the heap. How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated? When I ...
user avatar
1 vote
1 answer
129 views

Connect remotely with GDBSERVER to pid

When I run gdbserver to listen for port and connect remotely with gdb: Gdbserver command: gdbserver --multi 0.0.0.0:4444 Gdb command: target remote 192.168.1.99 4444 In gdb . How can I connect to pid ...
user avatar
  • 11
0 votes
0 answers
140 views

How to decrypt/decode the strings found in desktop application with x64dbg?

I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
user avatar
0 votes
1 answer
96 views

PEDA: Don't show context

gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
user avatar
0 votes
0 answers
149 views

Remote debugging with Binary Ninja on Windows possible?

Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
user avatar
  • 101
1 vote
1 answer
445 views

How to debug a .net DLL?

I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues: First one: (...
user avatar
  • 35
0 votes
0 answers
117 views

Trying to debug with IDA Pro + Windbg on remote VM: It won't break or step

I'm new to remote debugging so plz bare with me. I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is ...
user avatar
  • 51
0 votes
0 answers
72 views

IDA + Windbg does not break on sxe commands

I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running ...
user avatar
  • 51
2 votes
1 answer
823 views

How to get offset of specific function in exe?

Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
user avatar
  • 23
0 votes
0 answers
63 views

Memory Viewer/Debugger for VBA

I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc. I want something like this: I.e. a GUI that has some of the ...
user avatar
  • 101

1
2 3 4 5
12