Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

0
votes
1answer
53 views

Show arguments while debugging

I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program. Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
0
votes
0answers
11 views

Debugging multiple threads

I have a PE executable which uses threads to handle most of its functionality. The code that gets run when the thread is created is obfuscated and it's hard for me to extract information just from the ...
1
vote
1answer
41 views

How to set a breakpoint in an execve'd program in radare2?

If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A? After a certain point in the execve routine, program B ...
0
votes
0answers
14 views

How to figure out what happens during <ModuleEntryPoint> in OLLYDBG

So I have an interesting problem. I have two traces of the same executable, one with an unmodified version of a file and one with a modified version. My hope was to use these traces to identify the ...
1
vote
2answers
86 views

Jump in the middle trick

I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
2answers
136 views

IDA PRO - compare running process

I have a software which writes some data to specific location in memory depending on user choices. Say i can have 2 choices, A & B. I want to run IDA, set option A and save all the data, then run ...
0
votes
2answers
61 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
-1
votes
0answers
30 views

IDA Dalvik debugger on Andoid Device JDWP error: INVALID_OBJECT

IDA Dalvik debugger on Android Emulator throws JDWP error: INVALID_OBJECT, and then IDA hangs and not able to figure out why its happening.
0
votes
1answer
33 views

Remote debugger for Linux from one VM (IDA) to another (running the debuggee)

I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM). So, is it possible to debug if both ...
-1
votes
0answers
23 views

Error Exception EOLeSysError class, When execute delphi program

I ran into a error and get the following message and just have EXE Files: Error EOLeSysError class not registered Class Not Registered. How I can find the name of the class which is not registered?...
1
vote
1answer
56 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
1
vote
0answers
23 views

Motorola Freescale mpc564 microcontroller

Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
1
vote
1answer
47 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
2
votes
1answer
94 views

How to save (trace) the execution route/sequences in debugger and Replay?

is it possible to save the step-by-step execution route of the program? i.e. lets say in x64dbg the program executes one handle after another and so on, probably hundreds of calls... But according ...
1
vote
2answers
133 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
2
votes
1answer
80 views

Reconstructing Unity APK

Note: I am only doing this for educational purposes with no intent to redistribute I have decompiled an APK built with Unity successfully (Somewhat). Using an array of programs, I managed to extract ...
2
votes
1answer
49 views

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?

Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2? I'm using the newest version of Radare2 to analyze the Windows application. As can be seen ...
4
votes
1answer
1k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
0
votes
2answers
106 views

Proxy debugging tool doesn't capture traffic from some online games

I'm analyzing Android games with Fiddler 2 to see how the game collects data. There is a problem, both Fiddler 2 and Charles Proxy doesn't capture any traffic from some online games. All i got are ads ...
1
vote
1answer
75 views

Can't find debugger in IDA PRO menu

I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files. This is an example when I didn't load any .exe: This is another example when ...
0
votes
1answer
75 views

How to see all functions that called with debugger

I debugging with IDA, and I want to see/print all the functions that get called. In the functions window I see over than 1000 functions. So I want to see which functions are called when I press ...
3
votes
1answer
670 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
7
votes
2answers
274 views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
1
vote
1answer
709 views

Commands to step into and step over, outside of visual pane mode

The Radare book says Use F7 or s to step into and F8 or S to step over current instruction. But, I don't see it telling you how to do this with the d command. When I run d? I see ds[?] ...
2
votes
1answer
67 views

How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?

How to make Radare2 automatically disassemble next instruction after each ds debug single-step? I thought that e asm.bytes=1 would achieve this, but that doesn't help. In particular, GDB supports ...
0
votes
2answers
1k views

How to set a breakpoint on a 64 bit process button with x64dbg?

I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, ...
1
vote
1answer
109 views

Analyzing and deobfuscating complex JS code [duplicate]

I am looking to reverse engineer a very ugly piece of JS found here. As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
0
votes
1answer
126 views

IDA remote linux Debugger attach to a running process

I usually use remote linux debugger as shown below: ./linux_server bin And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
0
votes
1answer
145 views

How to run ida in windows xp

I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application. I search and found that IDA is not supported with Windows XP. How can I run IDA ...
0
votes
1answer
48 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
1
vote
2answers
582 views

Where should I put my breakpoint? (USB dongle protected software, probably marx)

I'm trying to bypass the license validation process of a very old program called COSIMIR. It uses a USB dongle (which we have) however I don't have access to it, because it belongs to my university. ...
1
vote
0answers
66 views

How to find which event is bound to which GUI part

let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ): that program has a button xyz: 1) how to find out ...
0
votes
1answer
68 views

Where to find address of registers populated in a binary

This question might sound very naive, however, I got stuck when one of my friends asked me where can I find the address of an initialized register in the stack. For e.g., info registers in gdb gives ...
1
vote
1answer
105 views

Run any line/command in x64dbg

Is it possible, to run whichever line I want? For example, if it is at black position, and i want to run the RED CIRCLED command: I couldn't find a way to do that, neither in right click or etc......
0
votes
2answers
201 views

How to use API monitor on specific process

I want to monitor specific process with API Monitor but I didn't understand how do I do it please. I will happy to understand that. By the way, can I monitor process while I debugging it with ida?
12
votes
1answer
2k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
3
votes
0answers
84 views

IDA Pro's debugging - Stack view , Register values and ASCII decoding

Below questions are related to IDA Pro debugging: 1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
1
vote
1answer
88 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
16
votes
3answers
19k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
2
votes
2answers
1k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
2
votes
1answer
2k views

WinDbg Debugging without symbols

So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
1
vote
3answers
135 views

IDA Debug DLL with non exported function

I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that? Thanks so much./
1
vote
0answers
49 views

How to dump firmware from R5F71424 MCU

I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware. It has a limited boot mode that only allows writing to the MCU. Any pointers or ideas would be helpful....
5
votes
1answer
1k views

Using a VMM/hypervisor to monitor guest OS execution?

I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...
3
votes
1answer
207 views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
-1
votes
1answer
642 views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
1
vote
2answers
3k views

How to load a script in ollydbg

I decided to start learning Reverse Engineering and picked Ollydbg to start my path. Figured out how to install plugins, but I want to run a script for specific program to help me with the reverse. It ...
2
votes
2answers
382 views

OllyDBG - Game Hacking

I am trying to reverse game called Assault Cube where I am gonna be making game hacks for. I using Ollydbg to reverse though I have no theoretical understanding of asm at all. I just follow online ...
11
votes
2answers
11k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
1
vote
1answer
74 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.