Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
547
questions
0
votes
0answers
12 views
Cutter Mac OS Debugging
I am just stuck at OSX code signing requirement to debug others' apps. (I'm new debugging on OSX)
Can someone please explain the steps in order to use Cutter correctly (with rizin)?
Or any other ...
0
votes
0answers
13 views
How to debug a .NET windows service: "Cannot start service from the command line or a debugger"
I have a .NET windows service which I can stop and run through Process Hacker.
I can also view it's code with dnSPY.
I tried to debug it without a success by trying to attach to the process.
I wanted ...
2
votes
1answer
39 views
Debug shared library in Android application
There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug .
When I look at /proc/PID/maps I don't see that library (I do see the ...
0
votes
2answers
45 views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
1
vote
1answer
22 views
Adding ltrace information to gdb
I'd like to run gdb (or gdb-peda) with ltrace like info on each syscall. How can I do that?
I know that, as per ltrace and gdb attach to same process , you can't actually attach ltrace and gdb to the ...
1
vote
1answer
44 views
How can I find out the size of heap allocations?
While I debug with GDB I see the address of a buffer that's located on the heap.
How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated?
When I ...
1
vote
1answer
96 views
Connect remotely with GDBSERVER to pid
When I run gdbserver to listen for port and connect remotely with gdb:
Gdbserver command:
gdbserver --multi 0.0.0.0:4444
Gdb command:
target remote 192.168.1.99 4444
In gdb . How can I connect to pid ...
0
votes
0answers
41 views
How to decrypt/decode the strings found in desktop application with x64dbg?
I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
0
votes
1answer
66 views
PEDA: Don't show context
gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
0
votes
0answers
42 views
Remote debugging with Binary Ninja on Windows possible?
Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
1
vote
1answer
107 views
How to debug a .net DLL?
I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues:
First one:
(...
0
votes
0answers
61 views
Trying to debug with IDA Pro + Windbg on remote VM: It won't break or step
I'm new to remote debugging so plz bare with me.
I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is ...
0
votes
0answers
31 views
IDA + Windbg does not break on sxe commands
I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running ...
2
votes
1answer
293 views
How to get offset of specific function in exe?
Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
0
votes
0answers
22 views
Memory Viewer/Debugger for VBA
I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc.
I want something like this:
I.e. a GUI that has some of the ...
0
votes
0answers
36 views
is it possible to get code out of chipset through reverse engineering?
for example, encryption/decryption mechanism was inbuilt in a chip, to get the code that performs this mechanisms, is there some ways you can get this code through reverse engineering? what tools and ...
1
vote
2answers
187 views
How to debug / analyze a Themida protected binary
Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation:
STACK_TEXT:
03799f54 00f91cfa 24d1ae78 0000000f ...
0
votes
1answer
40 views
Debugging Native Lib using IDA Pro Fails to Load Registers and other Information
Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
0
votes
0answers
38 views
How can I find out where relocated functions are in a Win16 executable in SoftICE?
Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
0
votes
1answer
41 views
print format in radare2 cannot output all my string
I was doing a CTF challenge and I need to see the value of RAX register in radare2.
I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
1
vote
0answers
23 views
'... Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript
I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error
Unable to get property 'Debugger' of undefined or null reference.
Line was simply var ctl = host....
0
votes
0answers
13 views
Immunity Debugger Trace of Vulnerable Application
I'm trying to trace a vulnerable application while it is being exploited. I'm testing it on the application and exploit pair found at (https://www.exploit-db.com/exploits/36826). the exploit works ...
1
vote
1answer
57 views
IDA Pro Debbuger is debugging the original code and not the patched code
Using IDA Pro, I tried to patch int 2Dh to nop.
However, with the debugger, it seems that the original code is being loaded.
What may be the reason for that? This might be related for some protections?...
0
votes
0answers
33 views
How to debug an unknown Tricore binary
I want to analyze a binary from a automotive ECU with an Infineon TC1797 Tricore processor. I can load it in Ghidra, and have analyzed and reverse-engineered a bit of code at the starting address. I ...
1
vote
1answer
59 views
Debug bFLT in qemu-arm-static
I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static .
I want to debug that binary dynamically with GDB.
I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
1
vote
1answer
68 views
Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?
I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
1
vote
1answer
109 views
Why IDA debugger on android doesn't show all threads?
My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file.
Here's what I've done:
download a x86_64 system image android emulator from android studio
install that .apk ...
0
votes
0answers
81 views
Bypass Javascript Debug Prevention in Firefox
I've looked around, and can't find an answer for my specific question. The closest I could find was this.
I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
1
vote
0answers
32 views
Can i follow the invoke function?
im trying to debug some C# app.
Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called).
Im using dnspy.
1
vote
1answer
79 views
Is there a way to attach x86dbg with ida pro?
IDA has the option to use debuggers but the debuggers are quite limited. Is there a way that I can use to use x86dbg with IDA Pro?
1
vote
1answer
43 views
Kernel debug two physical MacBook pro devices
I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?):
I'm trying to kernel debug a physical Macbook pro device.
When my setup ...
0
votes
2answers
138 views
Get Zip password used by application
I bought a game, "They are billions", and I'm trying to edit a savegame on my singleplayer campaign to change some vars (cheating because im very bad player). But the file is a password ...
1
vote
1answer
82 views
How to load modules symbols to IDA while debugging a process
I am debugging a program that I compiled.
This program calls SetWindowTextW.
When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there:
If I will load ...
0
votes
0answers
71 views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
1
vote
1answer
82 views
Reverse engineer sticky notes to allow external script to open new notes
For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse ...
2
votes
2answers
84 views
Changing value of parameter with gdb
I have a file named exploit.c inside which:
#include <stdbool.h>
#include <stdio.h>
const char y1 = 'a';
const char y2 = 'b';
const char y3 = 'x';
const char y4 = 'y';
const char y5 = 'i';...
1
vote
1answer
51 views
analyze how data is read in android usb device
I've a huawei envizion 360, which doesn't provide any API for other application. But I want to read raw data from this device, to an android or to a raspberry-pi for debugging and development purpose. ...
0
votes
1answer
54 views
Program goes to suspend when buffer overflow occurs
Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer.
I need to exploit it to get a ...
0
votes
0answers
79 views
Debug multithreaded program in X32dbg
I am still quite inexperienced in reverse engineering. I have a small program that establishes an HTTP connection to a server and send data via POST method to the servert. I see strings like Winhttp....
0
votes
0answers
99 views
EXCEPTION_ACCESS_VIOLATION in x32dbg
What is EXCEPTION_ACCESS_VIOLATION and how can i handle it?
I am a complete beginner and could not understand. Thanks in advance.
Edit: as I learned EXCEPTION_ACCESS_VIOLATION occurs when either ...
0
votes
1answer
61 views
How much of the kernel does remote kernel debugging allow you to debug?
This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have.
What ...
0
votes
1answer
68 views
What does "???" mean in x32dbg?
I see such things but I just couldn't understand. Do you have any ideas?
Thank you!
0
votes
0answers
22 views
Tools for tracing down a Windows-specific UUID generation?
I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID.
It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
1
vote
1answer
44 views
Switch between debuggers while paused on a breakpoint
Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
0
votes
0answers
37 views
Debugging kernel modul with IDA
I have shell at linux-arm-embedded and running gdb-server, There is kernel module(ko) that I want to debugging .
How can I do that with IDA ?
1
vote
1answer
150 views
GDB inserting breakpoint cause Segmentation Fault
I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
0
votes
2answers
103 views
kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works
Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes.
The first process is winword.exe and the second process is calc.exe
The virtual address in the first case ...
0
votes
0answers
29 views
Saving a breakpoint in radare2 loses the format string
Good day to you all.
I'm new to radare2 and reverse engineering in general.
Debugging a small crackme.
I want to save breakpoints.
Initially, everything is fine: db* > bps and load breakpoints: ...
1
vote
2answers
85 views
Run ltrace to avoid detection (on a different PID?)
I am trying to run ltrace on this file:
./launcher: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]...
0
votes
0answers
226 views
Windbg vs x64dbg for network analysis
I have a program that I want to perform malware analysis on. The program seems to use HTTPs with SSL pinning (my theory) and some other proprietary protocol. I want to understand what is the best tool ...
