Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
571
questions
0
votes
0
answers
9
views
debug native code and net code
I have a .net dll with a lot of calculations and formulas.
From this dll, I want to set breakpoints to see the calculated results for a specific field.
The main program is written in native code. So, ...
1
vote
1
answer
45
views
Ollydbg - How to find the code of the method OnChange of text field delphi?
I have an application programmed with delphi. I want to find the section of code of the function OnChange of a text field. How to find it on Ollydbg?
Also, how can I set breakpoint on any window show ...
- 11
0
votes
1
answer
34
views
VMware Dynamic Analysis on Chosen Executable within VM
I am trying to use vmware for debugging. What I am trying to achieve is once an executable has been opened inside a vm which runs on Windows, I would like to extract the runtime traces for that ...
- 11
2
votes
1
answer
69
views
How to debug cfg80211.ko
I have an Linux embedded device that I want to debug the cfg80211.ko
I have full root SSH on that device.
How can I debug cfg80211.ko?
- 71
0
votes
2
answers
45
views
Radare2 - changing stdin during binary debugging
I'd like to know how to change stdin multiple times for the given binary for debugging purposes.
I know I can launch the application with
r2 -r profile.r2 -d binary
Where, inside the profile.r2 file ...
- 33
3
votes
1
answer
44
views
Radare2 - Saving information/metadata from a debugging session
I'd like to know how I can save/restore comments or possibly other metadata during a debugging session.
I know how to save this data when running radare without the -d flag but I often need to debug ...
- 33
0
votes
0
answers
70
views
Is there a debugger that will trace into ring-0 code?
Is there a debugger these days that will trace beyond a syscall or sysenter into ring-0 code? Or is there a technique using a debugger like Windbg? I have read that if you get close enough to the ...
- 1
1
vote
2
answers
204
views
Examining memory without attaching to the process by using /proc/$PID/mem?
I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.
#include <stdio.h>
#include <unistd.h>
...
- 1,664
3
votes
1
answer
42
views
How to use software watchpoints in LLDB?
After trying to use watch command, LLDB said the device had 0 available hardware watchpoints. In GDB you can use
set can-use-hw-watchpoints 0
How do you disable hardware watchpoints in LLDB?
- 144
0
votes
1
answer
16
views
Gdb hardware watchpoint error on android
After failing to find a solution to this I have started using Gdb and have encountered another error.
Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
- 144
2
votes
1
answer
80
views
LLDB debugging on android?
I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
- 144
0
votes
1
answer
71
views
Hex editing an IP address of a different length
I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
- 113
0
votes
0
answers
39
views
Finding function called when button is clicked
I am trying to find what function was called from the main application upon the button click in the specific game. In particular, there is a starting UI, where I can select Load option and then click ...
- 146
0
votes
0
answers
34
views
Is it possible to copy a video game and edit the copied version?
Sorry if this is a "dumb" question, but I couldn't find anywhere else to ask this. I want to "copy" my game of Super Smash Bros. Ultimate and edit/change in-game features. I also ...
0
votes
0
answers
32
views
Better debug output with IDA
I don't have much knowledge and experience with assembly so I value more or less readable IDA's pseudocode output. I want to examine stack and locals of the specific functions I set breakpoint in, ...
- 33
0
votes
0
answers
24
views
Call function only when check box is checked
Which function is responsible whether the check box is checked or not in disassembler's intermodular calls window?
2
votes
1
answer
336
views
Ghidra Debugger not working
When I try to debug one of hackadayu exercises (or any other file) using "debug c1 in dbgeng locally via GADP" I get following errors:
Launch failed for {args=/C:/Users/abc/Desktop/...
- 21
1
vote
1
answer
112
views
Instructions to compare two strings
I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
0
votes
1
answer
271
views
Why 0x90 byte is always at top of my file?
Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest.
Back to the topic, I have a python file which I obfuscated it and anytime I ...
- 11
0
votes
1
answer
137
views
Ghidra: Reading all registers contents at chosen instruction
Remembering all register contents may be exhausting so I would like to find a solution to be able to see all register contents at a chosen instruction in the Listing. I know debuggers got this ...
0
votes
1
answer
39
views
Radare2 only printing out the last byte at RSP when using pxq @ rsp
According to documentation,
px[?][owq] [len] hexdump of N bytes (o=octal, w=32bit, q=64bit)
and
pr[?][glx] [len] print N raw bytes (in lines or hexblocks,
'g'unzip)
These two ...
- 23
1
vote
1
answer
33
views
How to make the default stack width/offset 8 bytes when debgging in radare2
If you start radare2 in debugging mode like:
r2 -d /usr/bin
you'll be prompted with something similar to:
If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
- 23
0
votes
1
answer
45
views
How to determine the data type of a register
I'm learning reverse engineering and I'm trying to understand what process people use to identify a variable type.
For example, I'm looking at an argument being passed to a function and I'm trying to ...
0
votes
1
answer
80
views
Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender
In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
- 156
0
votes
0
answers
52
views
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.
I did small debugging. While doing it, the ...
0
votes
0
answers
37
views
IDA debugger register string pointer in conditional breakpoints
When debugging in IDA, it’s possible to use an IDC script as the breakpoint condition. I want to break if EAX points to a null terminated string which contains “substring”. I can’t seem to find a ...
0
votes
0
answers
16
views
Print CMarkupSTL object with GDB
CMarkupSTL is contain XML. How can I print that XML with GDB while I debug process?
I run on Arm Linux
0
votes
0
answers
153
views
How to resolve illegal instruction for this ARM stack exploitation?
Summary
I am trying to write a stack overflow exploit for ARM Cortex-A72 running
Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to
the ARMv7 (32-bit) instruction set.
I have ...
1
vote
1
answer
94
views
help me to debug file packed with molebox and proteced with obsidium
I have a exe file that packed with molebox and protected with obsidium.
I try to unpack it with demoleition but it has some problem. when I want to open the unpacked file
it says "Component '...
- 11
2
votes
0
answers
91
views
Strange exception thrown while debugging in Win10, but not Win7
I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
- 121
1
vote
0
answers
76
views
IDA tracing not working
I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called.
I have tried to use IDA Tracing, but it doesn't print to file.
- 183
1
vote
0
answers
25
views
Using rbreak without import functions
While debugging with GDB I want to break for each function and print the PC register.
rbreak .
define hook-stop
i r $PC
c
end
The problem is that is stop on functions that imported like printf ...
1
vote
1
answer
51
views
How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]
I have this class with constructor offsets and attributes:
public class example
{
// Fields
public float Attribute_1 = 1.5f; // 0x8
public int Attribute_2 = 102 ; // 0xC
// RVA: ...
- 21
1
vote
0
answers
65
views
Counting how many times a function is called
I want to change context (Rdx, Rax etc.) everytime a specific function gets called.
My solution: I seted up a breakpoint at function event.get_thread().set_context({"Rdx" : "bla bla&...
- 11
1
vote
0
answers
47
views
Scraping data from an audio analyzer application
Briefly:
I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start?
...
1
vote
0
answers
187
views
Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)
I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it").
I found that user to have the most ...
- 11
0
votes
0
answers
152
views
How to debug a .NET windows service: "Cannot start service from the command line or a debugger"
I have a .NET windows service which I can stop and run through Process Hacker.
I can also view it's code with dnSPY.
I tried to debug it without a success by trying to attach to the process.
I wanted ...
- 471
2
votes
1
answer
355
views
Debug shared library in Android application
There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug .
When I look at /proc/PID/maps I don't see that library (I do see the ...
- 23
0
votes
2
answers
195
views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
- 49
1
vote
1
answer
42
views
Adding ltrace information to gdb
I'd like to run gdb (or gdb-peda) with ltrace like info on each syscall. How can I do that?
I know that, as per ltrace and gdb attach to same process , you can't actually attach ltrace and gdb to the ...
- 187
1
vote
1
answer
255
views
How can I find out the size of heap allocations?
While I debug with GDB I see the address of a buffer that's located on the heap.
How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated?
When I ...
1
vote
1
answer
129
views
Connect remotely with GDBSERVER to pid
When I run gdbserver to listen for port and connect remotely with gdb:
Gdbserver command:
gdbserver --multi 0.0.0.0:4444
Gdb command:
target remote 192.168.1.99 4444
In gdb . How can I connect to pid ...
- 11
0
votes
0
answers
140
views
How to decrypt/decode the strings found in desktop application with x64dbg?
I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
- 101
0
votes
1
answer
96
views
PEDA: Don't show context
gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
- 187
0
votes
0
answers
149
views
Remote debugging with Binary Ninja on Windows possible?
Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
- 101
1
vote
1
answer
445
views
How to debug a .net DLL?
I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues:
First one:
(...
- 35
0
votes
0
answers
117
views
Trying to debug with IDA Pro + Windbg on remote VM: It won't break or step
I'm new to remote debugging so plz bare with me.
I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is ...
- 51
0
votes
0
answers
72
views
IDA + Windbg does not break on sxe commands
I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running ...
- 51
2
votes
1
answer
823
views
How to get offset of specific function in exe?
Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
- 23
0
votes
0
answers
63
views
Memory Viewer/Debugger for VBA
I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc.
I want something like this:
I.e. a GUI that has some of the ...
- 101