Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

13
votes
2answers
9k views

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR. break start and similar ...
11
votes
2answers
11k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
7
votes
2answers
458 views

Trace assisted code identification?

I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists. I'd like to find a specific part of code in the binary. Searching for ...
16
votes
3answers
19k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
18
votes
6answers
26k views

Decompiling a 1990 DOS application

I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
3
votes
1answer
7k views

how to setup IDA pro linux GDB server

I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
2
votes
2answers
1k views

Does IDA support remote debugging in their Freeware Version?

I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
4
votes
3answers
7k views

x64dbg how to debug a DLL called from an application

I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
2
votes
2answers
753 views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
1
vote
1answer
1k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
7
votes
1answer
18k views

How to debug the DLL of an EXE using IDA Pro?

I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge. Currently, I'm trying to reverse a ...
8
votes
2answers
670 views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
12
votes
1answer
2k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
12
votes
2answers
2k views

How can I find the source of a string in an old DOS game?

I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players. In the past it hasn't been too hard to pull off such a task on post-DOS games ...
9
votes
3answers
7k views

Jump back to the caller

I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app. I load the exe from file menu with input arguments Set breakpoint on msvcr71.printf function After this ...
6
votes
3answers
2k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
3
votes
2answers
2k views

lldb: break at start of actual code, not entrypoint

I want lldb to break at the start of the actual code of an OS X application (which might be called main if symbols are existing). I am currently looking this up by hand, but as I want to script some ...
7
votes
2answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
6
votes
1answer
1k views

Handling INT 2D anti-debugger technique in IDA Pro

I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging: CODE:00455050 push ebp CODE:00455051 mov ebp, esp CODE:00455053 push ecx CODE:00455054 push ebx ...
5
votes
1answer
2k views

DOS program debug in IDA?

Does anybody know something hack to debug 16bit DOS program in IDA 6.1?
2
votes
2answers
949 views

Extracting HTTPS packets before encryption

Say we have a Windows application, which sends some packets over HTTPS. We need to extract the content of this packets (unencrypted of course). There is no way to get hands on server private ...
1
vote
1answer
750 views

ImpRec invalid thunks seem valid

I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just ...
0
votes
1answer
338 views

Dumpbin: Correlating thunk jumps in .reloc to disassembly

I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said ...
7
votes
2answers
2k views

“Debugged application has modified the debugging registers” with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
6
votes
1answer
1k views

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
3
votes
2answers
724 views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
2
votes
3answers
3k views

How to go into thread function knowing only the thread handle

How do I go into the thread function (so I can do step by step tracing), knowing only the handle to the thread. I am using OllyDbg for tracing and the thread is created through the API ZwCreateProcess(...
2
votes
1answer
256 views

How to detect only external-module calls?

I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
2
votes
1answer
495 views

Analyzing a Login Process

I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process: Client takes input for username and password, then sends username to the auth server. Auth ...
2
votes
1answer
2k views

How to change address in the hex view in IDA debugger?

I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
2
votes
1answer
751 views

Set QWORD with a constant value in IDA Pro

At line #3 of a function, I have a QWORD at address 7FE875F3FE0 which resolves to a value of 85857490416 for which the function returns true. If not, the value is set to 0. I would like to know how ...
1
vote
1answer
2k views

Unable to view stack and memory addresses in IDA Pro [duplicate]

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328 ...
1
vote
1answer
338 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...
1
vote
1answer
315 views

ESP out of range of “Stack View” in IDA

A very similar (or exact) question was asked here, though it was not answered properly. I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
1
vote
2answers
705 views

How to set breakpoint on C++ symbols?

How to set breakpoint on this C++ symbol? bp qmgr!TokenHandle::operator-: Could not resolve error at 'qmgr!TokenHandle::operator-:' in windbg?
1
vote
1answer
47 views

Radare2 doesn't update current address, when single-step debugging using `ds`?

Radare2 doesn't update current address, when single-step debugging using ds? I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...