Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
1
vote
1answer
40 views
IDA PRO does miss calls when tracing
I am following this tutorial:
enter link description here
Though it uses Olly I am following with IDA.
Basically i am tying to catch where a popup decision is taking place in the program.
I though ...
0
votes
1answer
45 views
How to use API monitor on specific process
I want to monitor specific process with API monitor but I didn't understand how do I do it please.
I will happy to understand that.
By the way, can I monitor process while I debugging it with ida?
0
votes
0answers
65 views
How to debug 1 step after click on button?
I am debugging an executable file with IDA and put a breakpoint at the place that I see 2 buttons.
I want to know which function is executed when I click on one of the buttons and witch one is ...
0
votes
1answer
40 views
How to breakpoint atached process with ida when move on
In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the ...
2
votes
2answers
84 views
What is the difference between IDA and OllyDbg?
When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA?
In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
79 views
getting the static address/offset of a variable
I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself.
So I've written the following program in C++,...
1
vote
1answer
53 views
How debug process that not started with ida? [duplicate]
I am trying to debug two different exe files,in windows.
The first exe launches the second, and the second exe doesn't work well unless the first starts it.
I want to be able to debug the second exe....
2
votes
0answers
17 views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
2
votes
0answers
22 views
(iOS lldb) Unable to debug past a splash/loading screen
I'm trying to lldb debug this certain iOS application.
Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity.
However, whenever I try to debug ...
3
votes
1answer
65 views
Radare2 debugging - How to get into lazy imported functions?
I have a linux binary that imports functions from an external library (shared object). The functions are lazy loaded and not available when rip is at @main or @entry. When i step into such a function (...
1
vote
0answers
20 views
Is there any way to get value from bytecode under JDWP without access to source?
When I debug android app through jdwp using jdb, it seems I can't get anything from the bytecode level. I know normally it's fine as long as we have the source line info and use a decompiler, but the ...
0
votes
1answer
36 views
Find out where the string comes from (in Browser)
i.e. on a page, I see that after i.e. 5 seconds of page load, there appears a message:
Hello Akubatula, you are wonderful.
Lets say, i want to find out, from where does the word wonderful comes from....
1
vote
2answers
86 views
How to stop debugging while a specific value is on the stack?
I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF .
That value interests me, I want to know where this value comes from, how it gets pushed onto ...
1
vote
1answer
50 views
IDA - Remote debug on linux
I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink).
Because the exploit is via gets() I try to pass input through the "...
2
votes
1answer
19 views
What does this mean in OllyDbg: function+hex value
Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function.
eg: CRYPTSP.CryptDuplicateHash+0C
What does the '0C' mean ...
1
vote
2answers
41 views
How do I create an ASCII string in OllyDBG?
During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
1
vote
1answer
180 views
gdb debug show error “not in executable format: file format not recognized”
[root@localhost Relay]# file RelayD
RelayD: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped
[root@localhost Relay]# ./start
: no process ...
1
vote
1answer
51 views
How to move one step back in a debugger
When I debug a .exe file on Windows with IDA, I do it step by step.
Can I move one step back and reset all the registers and stack to what they were one instruction ago?
By the way, when I'm looking ...
2
votes
2answers
82 views
What is the difference between Windbg and local debugger in IDA
When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
47 views
How to identify when a function is being called using IDA?
I'm debugging a .exe file on Windows with IDA's debugger.
How can I identify when the code calls the random() function?
0
votes
0answers
26 views
Automating data structures
Is there any way I could possible automate the structure identifying process in ReClass. As far as I know, ReClass is one of the best when it comes to data structure identifying and researching. In ...
2
votes
2answers
93 views
Can I set more than 4 memory access breakpoints in WinDbg?
I can set a DWORD memory read/write access breakpoint in WinDbg with the following command:
ba r 4 0x0307F42C
But is there a way to set more than 4 of those?
11
votes
3answers
385 views
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
4
votes
0answers
297 views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
1
vote
0answers
36 views
how can i get real hex values of vdso outputs [closed]
I'm trying to get an algorithm in a program but i can't see the hex codes.
At the moment i break all debug checks it fully debugging but i can't see how it creates the request.
1
vote
0answers
41 views
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.
So, for example, I placed a breakpoint for a process - let's ...
4
votes
1answer
113 views
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments.
Ideally I would like to ...
1
vote
0answers
40 views
Reverse engineering IE thick client
Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO).
In trying to reverse one such thick client I noticed that the website downloads about ...
0
votes
0answers
25 views
Getting console output on a SDL2 game
Alright, so I got this game that uses SDL2. From a quick glance in a disassembler, it uses a lot of printf functions behind the scenes. The problem is, SDL2 seems to redirect all stdout to null on ...
0
votes
1answer
119 views
Radare2 cannot debug on windows 7
I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following:
radare2 -d a.exe
fork_and_ptraceme/CreateProcess: The request is not supported.
...
0
votes
1answer
90 views
Empty Parameter an MessagerBox
I am trying to learn to reverse Engineering , i am very new and my English is very Poor... .I wanting to make this exercise , but can't it , because not receive the hWnd identified from the MessageBox ...
1
vote
0answers
49 views
Cannot debug some drivers with IDA
For some drivers I can use the following WinDBG command:
bu driver!DriverEntry
However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
0
votes
0answers
32 views
IDA Android debug: SP address out of memory range of the stack view
I use IDA to debug android so lib, the SP address is 0xBEBD9B08, but it is out of the memory range of the stack view and Hex view. So I can't see the value of the local variables. I know there is one ...
1
vote
1answer
79 views
What are guidelines to find COM functions definition through a proxy DLL? [duplicate]
I've successfully reverse a DLL file which uses a COM interface and found the Class ID (CLSID) and Interface ID (IID). In Visual Studio debugging memory, it shows S_OK with CoCreateInstance() and all ...
-1
votes
1answer
61 views
RFLAGS info and Radare?
Stepping through instructions I can see the result of rflags change,
rflags C1PSI
rflags 1PZI
Is there anything that expands this into the appropriate flags. I know Z is Zero-flag, and P is Parity, ...
0
votes
0answers
35 views
Save changed memory string statically to binary
I am a real noob when it comes to reverse engineering, so forgive me if this is either basic, stupid, or already answered and i just searched stupidly.
I have a program which was not communicating ...
0
votes
0answers
64 views
checksum cracking
I was wondering if someone could lend a hand figuring this out. Trying to find out how they calculate these checksum values. I'm assuming its based of the time it is sent as this is the only data sent ...
-1
votes
1answer
166 views
Dynamic Analysis on ELF using IDA
On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
2
votes
1answer
444 views
Got `Source Code does not match bytecode` debug a Reversed Android app
Reverse an .apk file following This Article
Open ApkStudio, edit AndroidManifest.xml to allow debug and Build a new Apk file
Got source code with dex2jar and jd-gui
Create an project in Android ...
-1
votes
1answer
264 views
VMProtect keygen, turn off the anti-debugging
who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
0
votes
0answers
144 views
IDA remote debugger on linux “input is a dynamic library…”
I am trying to understand how to debug with the remote debugger of IDA on linux.
I tried to debug the bof challenge of pwnable.kr (http://pwnable.kr/bin/bof).
It is a 32-bit ELF, so I could not run ...
1
vote
0answers
246 views
View static field values in dnSpy
I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields.
However, per this ...
-1
votes
1answer
79 views
how to find the strings values in a comparision using ollydbg
In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings
The program compare if a user input string is equal a internal string.
When I debug the program, I can't find the ...
3
votes
0answers
106 views
running iOS debugserver on non-jailbroken devices
There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
1
vote
2answers
420 views
Does IDA support remote debugging in their Freeware Version?
I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
2
votes
1answer
92 views
Can I step through a binary with IDA (eval version), reading registers step-wise?
I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)).
I'm used ...
-2
votes
1answer
120 views
What are modern techniques of reverse engineering? [closed]
I read an article on x64dbg blog(https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html) which mentions modern techniques of reverse ...
0
votes
1answer
122 views
Radare step into and step over, outside of visual pane mode
The Radare book says
Use F7 or s to step into and F8 or S to step over current instruction.
But, I don't see it telling you how to do this with the d command. When I run d? I see
ds[?] ...
1
vote
2answers
423 views
How do you use the Radare debugger with command line arguments (parameters)?
If I want to debug ls I can run,
radare -d /bin/ls
But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
0
votes
1answer
163 views
Find function's caller locations
I am debugging a program and searching to see when the program is calling WinHttpOpenRequest.
I searched using for the function with Ctrl+G
I pressed on Follow expression and it put me on the ...
