Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

-2
votes
1answer
463 views

Reversing PE - which tools should beginner use?

As a beginner i want to ask u some questions. Well , i'm not talking about all kinds of programs... i'm just asking for PE ( executables ) for windows -> (.exe) extension so , i don't know which ...
17
votes
4answers
4k views

How to reverse engineer a Windows 10 UWP app?

I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10: Somehow the results are not the same what is available via ...
-1
votes
2answers
86 views

Working backwards from window API's [closed]

My program often ends up at the kernel32.TerminateProcess API, now I've tried looking at the callstack in x32dbg but there's nothing. I've tried looking intermodular calls from my module and I've put ...
3
votes
1answer
376 views

debugging a graphical msdos game

There is a DOS game I want to run through a debugger. I tried using (FreeDos) DEBUG.COM over DosBox. But the problem is that this game uses graphics, and this messes up the output of DEBUG.COM. Is ...
3
votes
0answers
81 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
3
votes
1answer
89 views

Debugging and profiling directx 9 calls?

Lets say I'm debugging a game which I don't have the src code. This game was built with directx 9 and I want to dig into the more low-level stuff around it. I already did some hooks in some dx9 calls ...
5
votes
3answers
452 views

Changing a windows name by patching create window function call

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
2
votes
1answer
93 views

ARM system crashes after changing stack address

-- Edit with latest update on the problem, it is not solved yet :( -- While playing with an ARM embedded Linux system (Version 3.8.13), out of curiosity, I created a small "debug" kernel module. ...
0
votes
1answer
281 views

How to debug Portable executable for AMD64 in IDA PRO?

How can I debug Portable executable for AMD64 in IDA PRO if I have Intel processor?
0
votes
1answer
154 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
1
vote
1answer
418 views

how to find memory objects using immunity debugger

I am trying to exploit a program where I have to reuse a socket. recv looks like this: int recv( _In_ SOCKET s, // socket ID _Out_ char *buf, _In_ int len, _In_ int flags ); I want to ...
2
votes
1answer
168 views

Log EIP while in a certain memory range?

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
3
votes
2answers
2k views

How can I receive DbgPrint messages in windbg on windows 10

I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. I am ...
0
votes
1answer
49 views

Android debugging, stop before app starts on third party app

I'm trying to dump a few pieces of info that happen at the very beginning of the start up of a third party app and not after the app is running. I have debugged on other platforms and there is usually ...
0
votes
1answer
529 views

Debugging third party apk without modifying apk

I have seen the ways to modify an apk using apktools and adding android:debugging="true" but I have an apk that check for changes and crashes if any changes are made. Is it possible to capture the ...
1
vote
1answer
282 views

Overriding the second argument with conditional breakpoints

With conditional breakpoints I'm able to alter the return value of a function. For example, when setting a breakpoint on the return instruction, the following IDC expression ensures that the function ...
4
votes
3answers
1k views

Faster Kernel debugging for Windows

I am Kernel debugging in Windbg and it's slow , very slow stepping through. My current setup is using VMWARE and Windbg through a com port on the Virtual Machine. Is there a faster way to debug the ...
1
vote
2answers
738 views

Where should I put my breakpoint? (USB dongle protected software, probably marx)

I'm trying to bypass the license validation process of a very old program called COSIMIR. It uses a USB dongle (which we have) however I don't have access to it, because it belongs to my university. ...
0
votes
2answers
380 views

Understanding the output of Windbg's `dds esp`

I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
0
votes
2answers
66 views

Tracing the last written value of a memory location without slowdown

I'm trying to debug the corruption of a linked list structure inside of a Win32 DLL with IDA Pro and Hexrays. The offending assembly traverses a doubly-linked list forwards checking a condition, and ...
1
vote
1answer
82 views

Pydbg List imported API

I am currently writing a small utility leveraging pydbg. One of the features I am trying to implement is as follows: For each DLL imported, I want to list the api functions that the module exports ...
0
votes
1answer
990 views

How can I dynamically debug a malicious DLL? [duplicate]

English isn't my first language, So I will do my best ) I am trying to analyze some malware NotPetya and I can run the malware by running : rundll32.exe notpetya.dll #1 I am using Olly and trying ...
2
votes
1answer
169 views

How to debug a hang application with radare2?

Could anyone tell me the basic steps and most used radare2 commands for debugging a hang x86 application to find the source of the hang? I know this question may sound a bit broad but I don't know ...
14
votes
1answer
2k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
1
vote
1answer
65 views

In a native debugger, what must be done in order to resolve ntdll/other API symbols manually?

I'm reversing a Windows binary using x32Dbg and I have the following instruction: call ntdll.776C695A. What steps should I take in order to find out which function this is and/or what it does? The ...
5
votes
2answers
1k views

How do I approach this CTF Debugging Program?

I have an ELF executable I'm working on (got it from a previous CTF competition). The executable simply asks for a password, and then it prints out "congrats". The code snippets and my annotations ...
4
votes
2answers
234 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
1
vote
1answer
82 views

Powermac gdbserver wrapper/How to attach IDA to powermac application?

How do I debug a powermac application using gdbserver provided there is no gdbserver I've tried compiling various version of gdb found in apple opensource -specifically the gdbserver part but it ...
0
votes
1answer
628 views

Opening Windows 10 DMP file

Which program would you success to open a Windows 10 .DMP file. I've tried OllyDbg110(32Bit) but this is the result: Do I have to use a 64bit debugger or am I on a totally wrong route?
2
votes
0answers
128 views

Anti-debug that can broke programm links (branches)?

I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image: ...
3
votes
2answers
854 views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
8
votes
1answer
2k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
2
votes
1answer
386 views

IDA PRO: Monitor variable during execution

I'm new with IDA. Say I have a variable which is created in some function and it is argument to other functions. My question is how to monitor this variable? In monitor I mean is there any way to set ...
4
votes
2answers
3k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
1
vote
1answer
347 views

ESP out of range of “Stack View” in IDA

A very similar (or exact) question was asked here, though it was not answered properly. I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
1
vote
1answer
553 views

Reverse Packet Encryption with server side checks

My problem is the packets are encrypted. And, the server checks every packet sent from the client. If the packet that the server expect does not match from what the client sent, the server will ...
6
votes
3answers
2k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
2
votes
2answers
281 views

Running machine code that I need to execute with arguments. How?

There is a program which I expect to run to generate a seed, but I don't know how to proceed and I am new to reversing. I have the machine code of a program which is built for x86 architecture. I ...
1
vote
2answers
114 views

strange instruction in IDA when debugging malware

What does mov edi, ds:RegCloseKey actually do ? Does it call RegCloseKey and the registry is "closed"? The whole function looks like call ds:RegOpenKeyEXW test eax,eax jnz loc_12345 ...
0
votes
1answer
79 views

Translate addresses on stack to the exported function names

I'm investigating a bug that happens in proprietary DLL that doesn't have PDB symbols. The callstack looks like this: KernelBase.dll!7710c54f() [Frames below may be incorrect and/or missing, no ...
3
votes
1answer
2k views

my question is what means proc near?

sub_123434 proc near mov esi, [ebp-1Ch] sub_123434 endp What means proc near? Can someone possibly explain also the whole function?
1
vote
3answers
1k views

Can apk files have protection against being debugged?

As part of a bug bounty program, I am trying to reverse engineer the bumble android mobile application via dynamic analysis. I find that if I use apktool to disassemble the apk and reassemble it again ...
0
votes
1answer
477 views

How to debug DLL injection in IDA?

Recently, I've been cracking a crackme DLL, and I need to inject it into a process, to see if it worked. However, I've ran into a problem. I cannot seem to find how to debug DLL injection inside of ...
0
votes
1answer
119 views

Detecting user<->kernel transitions with hypervisor

Is it possible to use a hypervisor to trap all ring0<->ring3 transitions (both 0->3 and 3->0)?
3
votes
1answer
561 views

Debugger always paused in ntdll

I'm a beginner at reverse engineering so any help would be appreciated. I apologise if a similar question has already been asked or if this is a dumb question, but I couldn't find anything. I have ...
3
votes
2answers
359 views

Window application - Does the debugger stop the window thread?

Playing with the debugger x64dbg, I noticed that my application uses multiple threads as shown below: Among them, one thread is certainly used for the window, as the application is a window ...
3
votes
2answers
603 views

Obtain .exe/.dll/.sys for a given .pdb file

If I have an executable file (let's say ntoskrnl.exe) I can obtain it's .pdb file from Microsoft. Is it possible to do the reverse? If I have a .pdb can I obtain the .exe? Or the only method is to ...
1
vote
1answer
2k views

Decompiling and deobfuscating APK file

Let's suppose that I have an APK file. I decompiled it but I have very obfuscated code. Is it possible to analize this APK in such way that application will be executed step by step (instruction after ...
6
votes
3answers
8k views

x64dbg how to debug a DLL called from an application

I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
0
votes
1answer
540 views

Debug a .dll file within powershell

I have given a .ps1 file which loads a .dll via: Import-Module ".\decrypter.dll" After that, a call to that module is performed by: get-decrypt(" *Some Base64 Encoded string* ") Only the .dll is ...