Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
522
questions
0
votes
0answers
37 views
Can someone unpack a themida 3 exe for me ( I will pay ) [closed]
I need someone who can unpack a themida 3 packed exe. You can reply here with your informations.
0
votes
1answer
50 views
Program goes to suspend when buffer overflow occurs
Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer.
I need to exploit it to get a ...
0
votes
0answers
25 views
Debug multithreaded program in X32dbg
I am still quite inexperienced in reverse engineering. I have a small program that establishes an HTTP connection to a server and send data via POST method to the servert. I see strings like Winhttp....
0
votes
0answers
43 views
EXCEPTION_ACCESS_VIOLATION in x32dbg
What is EXCEPTION_ACCESS_VIOLATION and how can i handle it?
I am a complete beginner and could not understand. Thanks in advance.
Edit: as I learned EXCEPTION_ACCESS_VIOLATION occurs when either ...
0
votes
1answer
35 views
How much of the kernel does remote kernel debugging allow you to debug?
This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have.
What ...
0
votes
1answer
58 views
What does “???” mean in x32dbg?
I see such things but I just couldn't understand. Do you have any ideas?
Thank you!
0
votes
0answers
15 views
Tools for tracing down a Windows-specific UUID generation?
I'm have a kind of "Crackme" program that generates a 4-byte Windows system-specific UUID.
It doesn't seem to be hardware-dependent - I have created 2 identical Windows 7 virtualboxes - same ...
0
votes
1answer
30 views
Switch between debuggers while paused on a breakpoint
Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
0
votes
0answers
26 views
Debugging kernel modul with IDA
I have shell at linux-arm-embedded and running gdb-server, There is kernel module(ko) that I want to debugging .
How can I do that with IDA ?
0
votes
1answer
23 views
GDB inserting breakpoint cause Segmentation Fault
I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
0
votes
2answers
54 views
kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works
Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes.
The first process is winword.exe and the second process is calc.exe
The virtual address in the first case ...
0
votes
0answers
23 views
Saving a breakpoint in radare2 loses the format string
Good day to you all.
I'm new to radare2 and reverse engineering in general.
Debugging a small crackme.
I want to save breakpoints.
Initially, everything is fine: db* > bps and load breakpoints: ...
0
votes
0answers
13 views
Run ltrace to avoid detection (on a different PID?)
I am trying to run ltrace on this file:
./launcher: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]...
0
votes
0answers
30 views
Windbg vs x64dbg for network analysis
I have a program that I want to perform malware analysis on. The program seems to use HTTPs with SSL pinning (my theory) and some other proprietary protocol. I want to understand what is the best tool ...
0
votes
0answers
29 views
Access violation writing location
I am currently playing with C# and detours/trampolines using a library I found here:
https://github.com/xcvd/Detours
I am attempting to hook a known function in a game and then call the original ...
0
votes
0answers
49 views
SSL pinning and bypass
I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
0
votes
1answer
67 views
Program prevents x64dbg from starting or kills it if it's already running. What to do?
I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows.
It looks like the program has some sort of anti-debug protection. I have the following behavior:
...
0
votes
1answer
43 views
IDA Unknown Exception Code 6F4
So basically I had set a breakpoint on a WINAPI function call. When I tried to run the program and step over the breakpoint, the program exits with the popup window: unknown exception code 6F4 (exc....
0
votes
1answer
71 views
Why compiler is doing this?
While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
0
votes
0answers
15 views
Load an IDB file when debugging kernel to get the function names in IDA?
I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files.
Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded ...
0
votes
0answers
14 views
How to pause a kernel debugee instead of stopping in IDA pro?
While debugging windows kernel with IDA, the problem is i cannot pause it like Windbg, when its running and i click on suspend, 50% of times it just freezes/crashes, and other times it just gets stuck ...
0
votes
1answer
63 views
Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?
I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
0answers
42 views
Using GDB to find the address of a buffer in a stripped C binary
I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
1
vote
2answers
98 views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
2
votes
2answers
55 views
How to test and debug x86 Assembly exceptions in NASM?
I have seen all the exception "IDs" in the Intel Manuals, and just came across sandpile's exception guide, which actually shows some hexcodes. For example, "divide by zero error":
...
0
votes
1answer
63 views
Debug 3rd-party apk with .so-files missing debug symbols
Apologies, if this has been asked before. I am reverse engineering a chinese app that connects to a BLE device, so I can inspect how it transmits the data. Using this official guide I decompiled my ...
2
votes
1answer
80 views
How to debug an application (exe) freeze and crash?
I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
2
votes
0answers
28 views
QEMU with GDB: Stepping Instruction causes Windows VM BSOD
I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing.
I have ...
0
votes
1answer
129 views
With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?
I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra.
I'...
5
votes
1answer
130 views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
2
votes
1answer
174 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
1
vote
1answer
56 views
How to let SIGTRAP get caught by sighandler in GDB?
I have a program that I am trying to reverse, which contains an int3 (0xCC) which emits a SIGTRAP signal, which is then handled by a sighandler defined in sigaction.
The handler performs calculations ...
2
votes
3answers
80 views
Where Can I Get .PDB files for Windows OS Components?
I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
0
votes
1answer
47 views
Is it possible for a process to debug itself?
What happens if you try to debug yourself ? I mean, does the process crash ?
If it is possible, how would you implement it ?
I have tried launching x64dbg and I can't attach to my own x64dbg process.
...
0
votes
0answers
43 views
How to use aarch64 call convention to understand an unknown function?
I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World!...
1
vote
1answer
51 views
how can ı debug encrypted dll with x32dbg and look getregistery request
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass ...
0
votes
0answers
149 views
Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container
My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using
sudo docker ...
0
votes
1answer
136 views
Analyse structure from memory dump
I'm trying to extract master key from OpenSSL 1.0.2l (statically linked without debug symbols).
I'm using x64dbg, I was able to locate int SSL_connect(SSL *s) method, so I have a breakpoint there (the ...
0
votes
0answers
33 views
Use IDAPython to automatically attach to a remote GDB server
I would like to automate the process of connecting to a remote debug server.
The following code worked for the remote win32 debugger:
from ida_dbg import *
set_remote_debugger(addr, port)
...
0
votes
0answers
53 views
How to debug a shared library with radare2?
I am currently trying to pick up radare2 but I am struggling on a little hurdle..
I am given a shared library, let's call it shared.so.
I managed to perform some static analysis using
$ r2 shared.so
...
1
vote
1answer
423 views
How can I debug Ghidra plugin Python scripts in IDE?
I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin)...
1
vote
0answers
77 views
Dynamic Analysis with gdb on ELF binaries with no compilation/linking information
I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
0
votes
3answers
96 views
How to find the address (offset) of specific driver function
I am reversing Capcom driver and in IDA I have this list of functions:
I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0
votes
1answer
34 views
How to run a process with high privileges using remote debugging
I am using remote debugging with IDA. The target and host machine are Windows.
I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
0
votes
0answers
32 views
Radare2: Running executable from a specific point
I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0answers
55 views
Unable to debug with Debuggers
I can't debug Screen Recorders on any debugger. I tried every possible way including anti debugging plugins, editing up the instructions but every time I failed. Mostly they land on pushad (which ...
1
vote
1answer
288 views
How to open new window of decompiler or resize the decompiler of Ghidra?
This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize.
Any help?
EDIT: Oh thanks Shane Riley, i clicked the blue button ...
1
vote
1answer
31 views
are address for instructions specified during compilation?
when following certain youtube tutorials, the address in memory for the instructions are same in my machine and the youtuber's machine. How is that possible? Are instructions provided with memory ...
1
vote
0answers
50 views
Ways of creating a new thread on Windows
I'd like to know about every possible way how a thread can be created in a process at the lowest possible level.
There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
0
votes
1answer
52 views
Append to environment variable in LLDB
It is relatively easy to set environment variables in LLDB, via
settings set target.env-vars DEBUG=1
However, I can't seem to find a way to append to an environment variable. The following doesn't ...
