Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
504
questions
3
votes
1answer
40 views
How to debug an application (exe) freeze and crash?
I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
2
votes
0answers
21 views
QEMU with GDB: Stepping Instruction causes Windows VM BSOD
I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing.
I have ...
0
votes
1answer
41 views
With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?
I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra.
I'...
4
votes
1answer
104 views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
2
votes
1answer
158 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
2
votes
1answer
32 views
How to let SIGTRAP get caught by sighandler in GDB?
I have a program that I am trying to reverse, which contains an int3 (0xCC) which emits a SIGTRAP signal, which is then handled by a sighandler defined in sigaction.
The handler performs calculations ...
2
votes
3answers
64 views
Where Can I Get .PDB files for Windows OS Components?
I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
0
votes
1answer
44 views
Is it possible for a process to debug itself?
What happens if you try to debug yourself ? I mean, does the process crash ?
If it is possible, how would you implement it ?
I have tried launching x64dbg and I can't attach to my own x64dbg process.
...
0
votes
0answers
27 views
How to use aarch64 call convention to understand an unknown function?
I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World!...
1
vote
1answer
42 views
how can ı debug encrypted dll with x32dbg and look getregistery request
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass ...
0
votes
0answers
60 views
Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container
My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using
sudo docker ...
0
votes
1answer
112 views
Analyse structure from memory dump
I'm trying to extract master key from OpenSSL 1.0.2l (statically linked without debug symbols).
I'm using x64dbg, I was able to locate int SSL_connect(SSL *s) method, so I have a breakpoint there (the ...
0
votes
0answers
28 views
Use IDAPython to automatically attach to a remote GDB server
I would like to automate the process of connecting to a remote debug server.
The following code worked for the remote win32 debugger:
from ida_dbg import *
set_remote_debugger(addr, port)
...
0
votes
0answers
38 views
How to debug a shared library with radare2?
I am currently trying to pick up radare2 but I am struggling on a little hurdle..
I am given a shared library, let's call it shared.so.
I managed to perform some static analysis using
$ r2 shared.so
...
1
vote
1answer
225 views
How can I debug Ghidra plugin Python scripts in IDE?
I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin)...
1
vote
0answers
72 views
Dynamic Analysis with gdb on ELF binaries with no compilation/linking information
I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
0
votes
3answers
71 views
How to find the address (offset) of specific driver function
I am reversing Capcom driver and in IDA I have this list of functions:
I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0
votes
1answer
34 views
How to run a process with high privileges using remote debugging
I am using remote debugging with IDA. The target and host machine are Windows.
I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
0
votes
0answers
31 views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0answers
55 views
Unable to debug with Debuggers
I can't debug Screen Recorders on any debugger. I tried every possible way including anti debugging plugins, editing up the instructions but every time I failed. Mostly they land on pushad (which ...
1
vote
1answer
139 views
How to open new window of decompiler or resize the decompiler of Ghidra?
This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize.
Any help?
EDIT: Oh thanks Shane Riley, i clicked the blue button ...
1
vote
1answer
31 views
are address for instructions specified during compilation?
when following certain youtube tutorials, the address in memory for the instructions are same in my machine and the youtuber's machine. How is that possible? Are instructions provided with memory ...
1
vote
0answers
47 views
Ways of creating a new thread on Windows
I'd like to know about every possible way how a thread can be created in a process at the lowest possible level.
There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
0
votes
1answer
34 views
Append to environment variable in LLDB
It is relatively easy to set environment variables in LLDB, via
settings set target.env-vars DEBUG=1
However, I can't seem to find a way to append to an environment variable. The following doesn't ...
0
votes
0answers
63 views
capture traffic of an android app
I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
1answer
86 views
Can I force GDB breakpoints and disassemble?
Sorry English isn't my first language.
I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded.
I have found it weird how GDB behaves when there ...
1
vote
1answer
62 views
Rust string capacity lower than string lenght
According to RUST documentation, strings are stored this way :
This is a statement I can verify while reversing rust binaries.
The thing is that when I am reversing rust binaries, I likely encounter ...
0
votes
1answer
91 views
How can I modify these?
So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation
So here it is, how would I go about editing these the same way I would go ...
0
votes
0answers
46 views
Change value of memory in a debugger?
So I got this app loaded in x64, there is a function, let's say
"HeatGainedPerShot", which is basically the value which an object gains everytime it fires,
Such a value would normally exist ...
0
votes
0answers
34 views
N64 ROM file index hacking issue
Alright, I downloaded the N64 SDK and compiled one of the samples provided by the SDK and dissembled the ROM with IDA and found the asset data is stored some way using index's so my question is.
What ...
0
votes
0answers
78 views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
0
votes
0answers
65 views
How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)
I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
0
votes
0answers
34 views
Finding RAM value in IDA Pro
At line #9 of a function, I have a variable that points to a RAM Cell. Actually I have a WORD at address E1C4.
I would like to know how can I get value of this variable?
I find a location where used ...
0
votes
0answers
12 views
reaching unexpected breakpoint (defined by file/line) when debugging objc code with lldb
'm using lldb to debug objc based service. several breakpoints (which is set have been placed in the code, and I see that one of them is reached unexpectedly according to the stack trace.
The method ...
1
vote
0answers
174 views
Instruction trace using frida in android emulator
i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
0
votes
1answer
66 views
Debugging Encrypted Malware with Multiple Threads
What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
1
vote
1answer
100 views
Bypassing IsDebuggerPresent [closed]
I am currently trying to attach a debugger to a program with a callback for IsDebuggerPresent. Normally, i would patch the program to pass over this check, but patching the program is not an option. ...
1
vote
0answers
21 views
pick dump from a specific process from virtualbox coredump
i'm interested in reverse engineering and assembly stuff i have started to do some research and im still a complete beginner
what i have learned so far that we could use virtualbox to dump the RAM ...
2
votes
0answers
46 views
x64dbg break when hex string is loaded
I'm trying to break execution when a string is loaded in memory.
I can´t find the string by using the search for -> string references
So I press Alt + M and press Ctrl + B to search my string ...
2
votes
1answer
130 views
How to debugging activeX with Ida
When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well.
How can I see this ActiveX code(where ...
0
votes
2answers
60 views
How to retrieve name of a variable defined in the data segment in IDA when no process is attached?
I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS).
push word ptr ds:8401h
Since I have ...
0
votes
0answers
47 views
Debug x64dbgpy scripts in vscode?
i've tried to debug a x64dbgpy script using ptvsd and vscode. don't ask me how, but i was able to break into the script using a "remote python attach" session, setting breakpoints and stepping into ...
0
votes
0answers
30 views
Is it posible to break at string when it being use by program?
Like the title, i need to break at an url string when it being used by program.
I try memory break point but it will break at begin of the section.
I use x64dbg.
0
votes
1answer
38 views
How can I find the function that throws an error message in IDA Pro? [closed]
Let's suppose I want to use IDA Pro to debug a Windows PE64 application that always throws an error message at a specific point when being run. What steps would I have to take to find the specific ...
1
vote
0answers
54 views
PE Explorer vs. Debugger differences
I injected shellcode into an executable. Entrypoint is set to first shellcode instruction.
Shellcode: nop nop label: nop nop jmp label nopnop
which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90
...
1
vote
1answer
174 views
x64dbg throwing exception
I have been working on finding an overflow in wordpad and i was able to run an exception with an undefined behavior (my point of view). I am using x64dbg (I am not a pro x64dbg) and it shows ...
3
votes
1answer
112 views
Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message
I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
1
vote
1answer
177 views
How to setup VSCode with IDAPython?
Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
2
votes
0answers
49 views
Display open handle ids in IDA Pro
Is there a way to display all the open handles of a process in IDA Pro while debugging it?
I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server.
I want to ...
-2
votes
1answer
586 views
Debug and crack .NET executable PE
First of all, i'm trying to learn reverse engineering for testing my codes and that's all and i'm not stupid enough to do illegal things with my knowledge so please don't give me legal advises.
I'm ...
