Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

1
vote
1answer
1k views

IDA Pro debugging: follow child process

I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
1
vote
1answer
641 views

How to convert the dumped firmware (from linksys-wrt54gl via JTAG port) in an understandable format

Issuing some commands for the dumped firmware: $ du -h fw.bin 4.0 M $ file fw.bin fw.bin: data $ file -i fw.bin fw.bin: application/octet-stream; charset=binary $ binwalk fw.bin - $ enca -L none ...
0
votes
1answer
677 views

Ollydbg: Function name list like in IDA

I'm new with reverse engineering and especially with Ollydbg, I have little experience with IDA and currently trying to get used to Olly. My questions are: 1.Is there any window which would show ...
1
vote
1answer
402 views

windows kernel debugging on Mac host (using VirtualBox)

I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22). 1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10) 2- Target ...
2
votes
2answers
816 views

IDA pro: jump back to previous instruction

I'm new with IDA pro and currently running with debugger, I have few questions: How can I jump on previous instruction? Undo the latest instruction ? Is it possible in IDA to examine memory of an ...
1
vote
0answers
92 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
0
votes
1answer
584 views

I'd like to ask about unpacking aspack 2.12

I've tried to unpack program packed with aspack 2.12 manually by ollydbg,by setting breakpoint at RETN 0c. However whenever I tried to dump with ollydump, it sends error message like "unable to read ...
1
vote
0answers
408 views

Is there a way to debug an elf file that runs with no problems with damaged header?

My question is general, but to have an example to work with, let us take one from Whirlwind Tutorial. ; tiny.asm BITS 32 org 0x00010000 db 0x7F, "ELF" ; ...
1
vote
0answers
185 views

Find string in stripped binary file use gdb

Does this debugger support this feature? Through find it is impossible, as the file stripped.
-1
votes
1answer
506 views

ollydbg: how to set a breakpoint at program exit?

How can I break right when the program I am debugging quits? I don't know how to even locate the relevant code.
-1
votes
1answer
88 views

Python winappdbg getting process name from event object

I'm developing a debugging automation system using https://github.com/MarioVilas/winappdbg. I would like to retrieve process name from event object. Here is my code: def EventHandler(event): ...
2
votes
1answer
2k views

I'm unable to copy to executable (ollydebug)

I just finished up with cracking this crackme I found off the net and it's cracked and everything,but the problem is that in ollydebug I don't happen to see a option to copy the modified code and save ...
1
vote
2answers
175 views

How to debug binwalk tool?

My lecturers have requested that I debug binwalk in order to understand how it works and develop new features so that it can extract more. I tried to use gdb to debug binwalk but it results in the ...
1
vote
1answer
384 views

How can I change the values in esp?

0x08048785 <+344>: movl $0x0,0xc(%esp) 0x0804878d <+352>: movl $0x804896c,0x8(%esp) 0x08048795 <+360>: movl $0x8048973,0x4(%esp) 0x0804879d <+368>: movl ...
1
vote
0answers
153 views

What causes a blank memory dump in OllyDbg?

I'm debugging a program right now in OllyDbg, and the entire hex dump is blank. I'm stepping through fine, and I do get the WIN API recognition, but I want to edit some memory but am not able to: I'd ...
0
votes
1answer
895 views

Calling DLL exports in x64dbg

I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
1
vote
1answer
3k views

Access violation when reading [OLLYDEBUG]

Any time I try to crack a program I get this error in olly: What causes this error? How can I fix this? If anyone has suggestion or advice that would be great. I already tried pressing F9 but that ...
4
votes
2answers
1k views

How to debug malware that injects itself into another process?

I am kind of new in the field of reverse engineering, so sorry if it is a silly question. I have to analyse some malwares for my bachelor thesis and I am currently trying to reverse engineer a ...
4
votes
2answers
1k views

IDA - Some issues regarding function's/data/code recognition

I have to write an IDAPython script and I came across many false positives in IDA's function/code/data recognition. Case 1 - Invalid function's end (rpcrt4.dll): In some DLLs (especially in rpcrt4....
0
votes
2answers
5k views

Is it possible to debug an ELF file with a Windows-based disassembler?

Problem : How can I debug an ELF file in MS Windows? is it possible? Scenario : I have an ELF file compiled to work on hardware with VXWorks 5.5 OS and SH4 CPU. IDA68 is able to disassemble the file ...
3
votes
1answer
255 views

How to adjust function type/call parameters to custom structs in IDA Pro?

I'm trying to reverse-engineer a function in IDA Pro that was originally identified by IDA as such (I was able to rename it into Device_CreateCloseIoControl): but I know that this function was ...
4
votes
0answers
572 views

GDB find string strange results

I'm playing with gdb and strange things are happening. I wanted to find some address in memory where string "/bin/sh" is located, and gdb says it found it. But when I examine the memory there, the ...
1
vote
1answer
290 views

I have a problem with understanding the register %bl

0x080484ad <+0>: xor %ebx,%ebx 0x080484af <+2>: mov (%eax),%bl ***** 0x080484b1 <+4>: xor $0x52,%bl 0x080484b4 <+7>: cmp $0x11,%bl ...
1
vote
1answer
2k views

Call DLL export in OllyDBG

I am using OllyDbg 2.01 and I walked through this tutorial to figure out how Call DLL export works. Even though it was written for another version of OllyDBG it work just fine. We should notice, that ...
3
votes
1answer
137 views

How does the processor distinguishes processes wrt HW bps?

When setting a hardware breakpoint (DR0...), this stores an address (as far as I can see, it looks like a virtual address). Because addresses are shared between processes (at least in 32 bits this can ...
0
votes
1answer
556 views

Can't debug a service

I am working on Lab11-03 in "Practical Malware Analysis" book. The malware I am analyzing trojanized the file cisvc.exe which is the indexing service in Windows XP. After that the malware start the ...
1
vote
1answer
982 views

Radare2 console output?

I have been playing around with radare2, and i am wondering something that seems almost obvious to me but after much googling down the rabbit hole i can not find out how to view the console output of ...
0
votes
2answers
135 views

Antidebug/reverse engineering targeted for libraries [closed]

So I'm reading about antidebug and anti-reverse engineering techniques, but these cover, in all the docs I've seen, just executables. Are there any resources that target specifically shared and ...
0
votes
1answer
6k views

Debug ELF executable

I cannot load the following executable type in OllyDbg: - ELF 32-bit LSB executable, Intel 80386 Why can OllyDbg not handle this kind of executables? What are good (OllyDbg-like) debuggers to debug ...
1
vote
0answers
330 views

Hopper remote debugging

I have hopper on my Mac and work fine for disassemble, now I want to debug an exe file, but I have a problem... with ida you can remote debugging, is there any method where I have hopper on my Mac (...
-1
votes
2answers
148 views

which windows API called when execute wmic qfe get hotfixid command?

which windows API called when execute this command wmic qfe get hotfixid command?
6
votes
1answer
866 views

How to know which module am I currently in? (EIP/RIP pointer)

I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode: What ...
6
votes
1answer
1k views

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
1
vote
2answers
3k views

How to load a script in ollydbg

I decided to start learning Reverse Engineering and picked Ollydbg to start my path. Figured out how to install plugins, but I want to run a script for specific program to help me with the reverse. It ...
1
vote
1answer
902 views

how to bypass exception to debug EXE

i am trying to debug and find the encryption password algorithm in a Windows Application. Whenever i try to debug, setting a breakpoint or not, the application gives a exception: is it some kind of ...
1
vote
0answers
130 views

Am I interpreting the instructions correctly or not. (ollydbg + executable)

I'm fairly new in reverse engineering, but I do comprehend assembly code. However, I'm facing a problem. It is about an old Rockstar game, "Bully: The scholarship edition" (released 2007 - aka "...
0
votes
3answers
872 views

Program gets terminated when debugging

I'm getting into the world of reverse engineering because I think it would be interesting to know how things work and such (also learning some assembly). But I have this strange problem, when I'm ...
3
votes
1answer
682 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
1
vote
1answer
2k views

How to analyze a child process created by malware by process hollowing mechanism using immunity debugger?

When I analyzed this malware sample it was invoking api's related to creating additional processes. With the process explorer I saw the debugged process is creating a new process. Please suggest any ...
0
votes
1answer
938 views

Windows XP kernel debugging

I'm trying to debug Windows XP's kernel with KD but every time I start the debugger,it seem to crash. Setup Windows 10 (host machine,running kd) Windows XP x86 SP3 VM (being debugged) I configured ...
0
votes
1answer
296 views

How to find vulnerabilities in stripped binaries?

Do you just use tools like strace and a debugger to disassemble and find syscalls and then read the disassembly to find say for example a buffer overflow? Is that all you can do? I mean after all you ...
2
votes
3answers
5k views

IDA PRO + Windows 10 + WinDbg

I didn't know That we've got a Reverse Engineering community around here :D I am very glad on that.... anyway... I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time. I am ...
1
vote
0answers
285 views

How to use Hopper to debug wine apps

I'm running Linux Mint , and I try to use the linux Hopper to debug a windows exe . Does anyone knows a way to debug in Hopper the applications that runs uder wine ? For example like : winedbg --gdb /...
2
votes
1answer
466 views

WinDbg - RVA of current instruction

Do someone know a windbg command to display the RVA of a certain instruction within it's module? Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, ...
0
votes
1answer
365 views

Save injected code

I am analyzing a binary that is injecting code into another process (i.e., svchost.exe) to make the debugging more tedious. I can attach the new process to a debugger (e.g., ollydbg or the one ...
5
votes
1answer
6k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
2answers
783 views

How to set breakpoint on C++ symbols?

How to set breakpoint on this C++ symbol? bp qmgr!TokenHandle::operator-: Could not resolve error at 'qmgr!TokenHandle::operator-:' in windbg?
8
votes
2answers
710 views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
0
votes
1answer
103 views

How does some application get through the block when mobile data plan is exceeded [closed]

I have a mobile data plan of 2 GBs. When I exceed it, I always get redirected to the network operator's website when I trying to load an URL. For some reason Telegram(Android app only, Desktop app ...
1
vote
1answer
495 views

How would I find a color's memory address? (Beginner)

I'm an absolute beginner (just started learning about process memory a few hours ago). I'm trying to find the memory address for the color of Color 1 in mspaint using x64dbg. I know it's black, so I'...