Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

0
votes
1answer
249 views

How to debug Portable executable for AMD64 in IDA PRO?

How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
0
votes
1answer
135 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
1
vote
1answer
326 views

how to find memory objects using immunity debugger

I am trying to exploit a program where I have to reuse a socket. recv looks like this: int recv( _In_ SOCKET s, // socket ID _Out_ char *buf, _In_ int len, _In_ int flags ); I want to ...
2
votes
1answer
153 views

Log EIP while in a certain memory range?

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
3
votes
2answers
2k views

How can I receive DbgPrint messages in windbg on windows 10

I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. I am ...
0
votes
1answer
45 views

Android debugging, stop before app starts on third party app

I'm trying to dump a few pieces of info that happen at the very beginning of the start up of a third party app and not after the app is running. I have debugged on other platforms and there is usually ...
0
votes
1answer
477 views

Debugging third party apk without modifying apk

I have seen the ways to modify an apk using apktools and adding android:debugging="true" but I have an apk that check for changes and crashes if any changes are made. Is it possible to capture the ...
1
vote
1answer
229 views

Overriding the second argument with conditional breakpoints

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function ...
4
votes
3answers
890 views

Faster Kernel debugging for Windows

I am Kernel debugging in Windbg and it's slow , very slow stepping through. My current setup is using VMWARE and Windbg through a com port on the Virtual Machine. Is there a faster way to debug the ...
1
vote
2answers
581 views

Where should I put my breakpoint? (USB dongle protected software, probably marx)

I'm trying to bypass the license validation process of a very old program called COSIMIR. It uses a USB dongle (which we have) however I don't have access to it, because it belongs to my university. ...
0
votes
0answers
95 views

Kernel Debugging With Virtualbox on Linux host (ERROR: Win32 error 0n2)

I have a problem with my kernel debugging setup. First of all, I have the following VM configurations: Host: Linux 17.04 (x64) Debugger VM: Win 7 SP1 (x32) with Guest additions installed + WinDBG ...
0
votes
2answers
335 views

Understanding the output of Windbg's `dds esp`

I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
0
votes
2answers
65 views

Tracing the last written value of a memory location without slowdown

I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and ...
1
vote
1answer
74 views

Pydbg List imported API

I am currently writing a small utility leveraging pydbg. One of the features I am trying to implement is as follows: For each DLL imported, I want to list the api functions that the module exports ...
0
votes
1answer
849 views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
2
votes
1answer
160 views

How to debug a hang application with radare2?

Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang? I know this question may sound a bit broad but I don't know ...
12
votes
1answer
2k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
1
vote
1answer
61 views

In a native debugger, what must be done in order to resolve ntdll/other API symbols manually?

I'm reversing a Windows binary using x32Dbg and I have the following instruction: call ntdll.776C695A. What steps should I take in order to find out which function this is and/or what it does? The ...
4
votes
2answers
1k views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...
4
votes
2answers
205 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
1
vote
1answer
61 views

Powermac gdbserver wrapper/How to attach IDA to powermac application?

How do I debug a powermac application using gdbserver provided there is no gdbserver I've tried compiling various version of gdb found in apple opensource -specifically the gdbserver part but it ...
0
votes
1answer
571 views

Opening Windows 10 DMP file

Which program would you success to open a Windows 10 .DMP file. I've tried OllyDbg110(32Bit) but this is the result: Do I have to use a 64bit debugger or am I on a totally wrong route?
2
votes
0answers
117 views

Anti-debug that can broke programm links (branches)?

I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image: ...
0
votes
0answers
60 views

Is it possible to find user created processor commands for Xtensa processors in ELF file?

Recently I started to debug programs for Xtensa processor. It was a little unexpectedly to find, that user can create additional commands via TIE. Is it possible to find these commands in the ELF file?...
3
votes
2answers
723 views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
8
votes
1answer
2k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
2
votes
1answer
318 views

IDA PRO: Monitor variable during execution

I'm new with IDA. Say I have a variable which is created in some function and it is argument to other functions. My question is how to monitor this variable? In monitor I mean is there any way to set ...
4
votes
2answers
2k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
1
vote
1answer
315 views

ESP out of range of “Stack View” in IDA

A very similar (or exact) question was asked here, though it was not answered properly. I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
1
vote
1answer
512 views

Reverse Packet Encryption with server side checks

My problem is the packets are encrypted. And, the server checks every packet sent from the client. If the packet that the server expect does not match from what the client sent, the server will ...
6
votes
3answers
2k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
2
votes
2answers
259 views

Running machine code that I need to execute with arguments. How?

There is a program which I expect to run to generate a seed, but I don't know how to proceed and I am new to reversing. I have the machine code of a program which is built for x86 architecture. I ...
1
vote
2answers
113 views

strange instruction in IDA when debugging malware

What does mov edi, ds:RegCloseKey actually do ? Does it call RegCloseKey and the registry is "closed"? The whole function looks like call ds:RegOpenKeyEXW test eax,eax jnz loc_12345 ...
0
votes
1answer
75 views

Translate addresses on stack to the exported function names

I'm investigating a bug that happens in proprietary DLL that doesn't have PDB symbols. The callstack looks like this: KernelBase.dll!7710c54f() [Frames below may be incorrect and/or missing, no ...
3
votes
1answer
2k views

my question is what means proc near?

sub_123434 proc near mov esi, [ebp-1Ch] sub_123434 endp What means proc near? Can someone possibly explain also the whole function?
1
vote
3answers
1k views

Can apk files have protection against being debugged?

As part of a bug bounty program, I am trying to reverse engineer the bumble android mobile application via dynamic analysis. I find that if I use apktool to disassemble the apk and reassemble it again ...
0
votes
0answers
148 views

JTAG pinout for Linksys E4200v2/EA4500

Can anyone specify an actual JTAG pinout for Linksys E4200v2/EA4500 router? The EA4500 and the EA4200v2 are actually identical hardware. There is unpopulated 8-pin JTAG header on PCB, 4x2 rows. s10....
0
votes
1answer
450 views

How to debug DLL injection in IDA?

Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked. However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
0
votes
1answer
112 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
3
votes
1answer
510 views

Debugger always paused in ntdll

I'm a beginner at reverse engineering so any help would be appreciated. I apologise if a similar question has already been asked or if this is a dumb question, but I couldn't find anything. I have ...
3
votes
2answers
319 views

Window application - Does the debugger stop the window thread?

Playing with the debugger x64dbg, I noticed that my application uses multiple threads as shown below: Among them, one thread is certainly used for the window, as the application is a window ...
3
votes
2answers
534 views

Obtain .exe/.dll/.sys for a given .pdb file

If I have an executable file (let's say ntoskrnl.exe) I can obtain it's .pdb file from Microsoft. Is it possible to do the reverse? If I have a .pdb can I obtain the .exe? Or the only method is to ...
1
vote
1answer
2k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
4
votes
3answers
7k views

x64dbg how to debug a DLL called from an application

I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
0
votes
1answer
493 views

Debug a .dll file within powershell

I have given a .ps1 file which loads a .dll via: Import-Module ".\decrypter.dll" After that, a call to that module is performed by: get-decrypt(" *Some Base64 Encoded string* ") Only the .dll is ...
1
vote
1answer
1k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
1
vote
1answer
569 views

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

Issuing some commands for the dumped firmware: $ du -h fw.bin 4.0 M $ file fw.bin fw.bin: data $ file -i fw.bin fw.bin: application/octet-stream; charset=binary $ binwalk fw.bin - $ enca -L none ...
0
votes
1answer
565 views

Ollydbg: Function name list like in IDA

I'm new with reverse engineering and especially with Ollydbg, I have little experience with IDA and currently trying to get used to Olly. My questions are: 1.Is there any window which would show ...
1
vote
1answer
361 views

windows kernel debugging on Mac host (using VirtualBox)

I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22). 1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10) 2- Target ...
2
votes
2answers
752 views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...