Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

1
vote
2answers
106 views

How to stop debugging while a specific value is on the stack?

I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF . That value interests me, I want to know where this value comes from, how it gets pushed onto ...
1
vote
1answer
435 views

IDA - Remote debug on linux

I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink). Because the exploit is via gets() I try to pass input through the "...
2
votes
1answer
26 views

What does this mean in OllyDbg: function+hex value

Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function. eg: CRYPTSP.CryptDuplicateHash+0C What does the '0C' mean ...
1
vote
2answers
190 views

How do I create an ASCII string in OllyDBG?

During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
1
vote
1answer
3k views

gdb debug show error “not in executable format: file format not recognized”

[root@localhost Relay]# file RelayD RelayD: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped [root@localhost Relay]# ./start : no process ...
1
vote
1answer
106 views

How to move one step back in a debugger

When I debug a .exe file on Windows with IDA, I do it step by step. Can I move one step back and reset all the registers and stack to what they were one instruction ago? By the way, when I'm looking ...
2
votes
2answers
295 views

What is the difference between Windbg and local debugger in IDA

When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger. What is the difference? By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
65 views

How to identify when a function is being called using IDA?

I'm debugging a .exe file on Windows with IDA's debugger. How can I identify when the code calls the random() function?
2
votes
2answers
288 views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
12
votes
3answers
496 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
4
votes
0answers
700 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
1
vote
0answers
44 views

how can i get real hex values of vdso outputs [closed]

I'm trying to get an algorithm in a program but i can't see the hex codes. At the moment i break all debug checks it fully debugging but i can't see how it creates the request.
1
vote
0answers
59 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...
4
votes
1answer
234 views

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments. Ideally I would like to ...
1
vote
0answers
74 views

Reverse engineering IE thick client

Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO). In trying to reverse one such thick client I noticed that the website downloads about ...
0
votes
1answer
403 views

Radare2 cannot debug on windows 7

I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following: radare2 -d a.exe fork_and_ptraceme/CreateProcess: The request is not supported. ...
0
votes
1answer
93 views

Empty Parameter an MessagerBox

I am trying to learn to reverse Engineering , i am very new and my English is very Poor... .I wanting to make this exercise , but can't it , because not receive the hWnd identified from the MessageBox ...
2
votes
0answers
98 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
1
vote
1answer
131 views

What are guidelines to find COM functions definition through a proxy DLL? [duplicate]

I've successfully reverse a DLL file which uses a COM interface and found the Class ID (CLSID) and Interface ID (IID). In Visual Studio debugging memory, it shows S_OK with CoCreateInstance() and all ...
-1
votes
1answer
170 views

RFLAGS info and Radare?

Stepping through instructions I can see the result of rflags change, rflags C1PSI rflags 1PZI Is there anything that expands this into the appropriate flags. I know Z is Zero-flag, and P is Parity, ...
-1
votes
1answer
341 views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
2
votes
1answer
864 views

Got `Source Code does not match bytecode` debug a Reversed Android app

Reverse an .apk file following This Article Open ApkStudio, edit AndroidManifest.xml to allow debug and Build a new Apk file Got source code with dex2jar and jd-gui Create an project in Android ...
-1
votes
1answer
654 views

VMProtect keygen, turn off the anti-debugging

who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
-1
votes
0answers
269 views

IDA remote debugger on linux “input is a dynamic library…”

I am trying to understand how to debug with the remote debugger of IDA on linux. I tried to debug the bof challenge of pwnable.kr (http://pwnable.kr/bin/bof). It is a 32-bit ELF, so I could not run ...
1
vote
0answers
813 views

View static field values in dnSpy

I'm using dnSpy (version: 4.5.3) to debug a .NET binary. I can successfully view the values of Local variables in the Locals window but I cannot view the values of static fields. However, per this ...
-1
votes
1answer
129 views

how to find the strings values in a comparision using ollydbg

In OllyDbg 1.10 (assembler level deubugger) I can find all referenced text strings The program compare if a user input string is equal a internal string. When I debug the program, I can't find the ...
3
votes
0answers
148 views

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
2
votes
2answers
2k views

Does IDA support remote debugging in their Freeware Version?

I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
2
votes
1answer
108 views

Can I step through a binary with IDA (eval version), reading registers step-wise?

I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)). I'm used ...
-2
votes
1answer
135 views

What are modern techniques of reverse engineering? [closed]

I read an article on x64dbg blog(https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html) which mentions modern techniques of reverse ...
1
vote
1answer
756 views

Commands to step into and step over, outside of visual pane mode

The Radare book says Use F7 or s to step into and F8 or S to step over current instruction. But, I don't see it telling you how to do this with the d command. When I run d? I see ds[?] ...
2
votes
2answers
1k views

How do you use the Radare debugger with command line arguments (parameters)?

If I want to debug ls I can run, radare -d /bin/ls But, how do I provide an argument or parameter to ls? Like I would do if I wanted to run radare -d /bin/ls -1. I've tried it like that without ...
0
votes
1answer
440 views

Find function's caller locations

I am debugging a program and searching to see when the program is calling WinHttpOpenRequest. I searched using for the function with Ctrl+G I pressed on Follow expression and it put me on the ...
0
votes
1answer
71 views

How to get back to program's main code (user-space) while attaching to de bugger

I have a small program that I wanted to debug. I run OllyDbg version 2 and attached the program to the debugger. I received this window: You can see that the addresses are from the Kernel memory. ...
0
votes
1answer
141 views

Reversing C# exe,Questions.Help

I am trying to debugging c# .NET application which receives a set of doubles and keep it as DataSeries every second. I want to rewrite its dataseries before the new data comes with my own dataset. ...
-2
votes
1answer
387 views

Reversing PE - which tools should beginner use?

As a beginner i want to ask u some questions. Well , i'm not talking about all kinds of programs... i'm just asking for PE ( executables ) for windows -> (.exe) extension so , i don't know which ...
17
votes
4answers
3k views

How to reverse engineer a Windows 10 UWP app?

I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10: Somehow the results are not the same what is available via ...
-1
votes
2answers
81 views

Working backwards from window API's [closed]

My program often ends up at the kernel32.TerminateProcess API, now I've tried looking at the callstack in x32dbg but there's nothing. I've tried looking intermodular calls from my module and I've put ...
3
votes
1answer
330 views

debugging a graphical msdos game

There is a DOS game I want to run through a debugger. I tried using (FreeDos) DEBUG.COM over DosBox. But the problem is that this game uses graphics, and this messes up the output of DEBUG.COM. Is ...
0
votes
0answers
108 views

Set a Breakpoint in an executable type dynamic (ET_DYN)

I am trying to debug an executable marked as a shared object. I know the trick of run it in GDB and stop with CTRL+C, and other tricks from the question How to handle stripped binaries with GDB? No ...
3
votes
0answers
76 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
3
votes
1answer
81 views

Debugging and profiling directx 9 calls?

Lets say I'm debugging a game which I don't have the src code. This game was built with directx 9 and I want to dig into the more low-level stuff around it. I already did some hooks in some dx9 calls ...
5
votes
3answers
381 views

Changing a windows name by patching create window function call

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
2
votes
1answer
89 views

ARM system crashes after changing stack address

-- Edit with latest update on the problem, it is not solved yet :( -- While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module. ...
0
votes
1answer
252 views

How to debug Portable executable for AMD64 in IDA PRO?

How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
0
votes
1answer
135 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
1
vote
1answer
332 views

how to find memory objects using immunity debugger

I am trying to exploit a program where I have to reuse a socket. recv looks like this: int recv( _In_ SOCKET s, // socket ID _Out_ char *buf, _In_ int len, _In_ int flags ); I want to ...
2
votes
1answer
154 views

Log EIP while in a certain memory range?

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
3
votes
2answers
2k views

How can I receive DbgPrint messages in windbg on windows 10

I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. I am ...
0
votes
1answer
45 views

Android debugging, stop before app starts on third party app

I'm trying to dump a few pieces of info that happen at the very beginning of the start up of a third party app and not after the app is running. I have debugged on other platforms and there is usually ...