Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

1
vote
0answers
83 views

Trace replayer won't load binary debug information

So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
1
vote
1answer
2k views

OllyDbg: how to record all funtion calls for attached process

I am trying to learn how IIS 5.0(running on Win2K Server) works with OllyDbg v1.10. I attach Olly to inetinfo.exe, which is the process for IIS 5.0. Olly then pauses in ntdll. See here. My plan is: I ...
2
votes
1answer
2k views

How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host

The problem: Recently I had to perform a kernel debugging on two MS windows VMWare virtual machines connected via a virtual serial port, and while running on a GNU/Linux host. The layout: GNU/Linux ...
0
votes
0answers
272 views

How to get the arguments passed to a function located in a DLL?

I am using Pydbg for resolving the exported function address located in the dll. Going through the pydbg documentation, i couldn't find a way to dump the arguments passed to those functions.
0
votes
1answer
244 views

Entry point of malicious child process

OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what ...
0
votes
2answers
1k views

How to set a breakpoint on a 64 bit process button with x64dbg?

I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, ...
2
votes
2answers
2k views

Why does program fail to run under several debuggers?

To lay out the obvious for a start, I am a beginner in the Reverse Engineering area when it comes to Computer Science. I have come across a program which I wanted to reverse engineer for myself to see ...
4
votes
2answers
328 views

How to break on a clipboard operation in cmd.exe with IDA / WinDbg?

My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
2
votes
1answer
203 views

Hooking in Immunity - LogBpHook not working

I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging). First of all my hook class: class AllocHook(LogBpHook): def ...
1
vote
0answers
118 views

Help for unpacking software [closed]

I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked. Can you help me please ?
2
votes
2answers
106 views

How do debuggers help one with finding information about how a program does something?

Let's say I want to reverse engineer an executable that interprets some data type. I want to see how the program interferes with the file, and what is stored. In the case that decompilation is not an ...
1
vote
1answer
178 views

x64 Memory Pointer and Addressing modes [closed]

I'm working through example from a Windows disassembly training guide. In the exercise rax is set to a byte ptr, then rbx a word ptr. I notice the next byte of memory is skipped before rcx is to a ...
3
votes
1answer
143 views

Win32 x86 Prolog disassembly

I have the following disassembly of a function prolog with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack frame"...
1
vote
1answer
3k views

Is it possible to debug a .Net executable with IDA?

When I load a .Net executable into IDA then there is no Debug menu as when I load a normal binary. Is there any way to enable the debug functionality for .Net as well? I'd like to step into some ...
0
votes
0answers
76 views

breaks on wsasend but not on wsaconnect

Good evening it's me again, I have found the address of the wsasend function where my program calls it. I have set a breakpoint on the function inside the ws2_32.dll and just checked the traceback ...
1
vote
1answer
606 views

x64dbg and ollydbg error not enough memory

I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the ...
0
votes
1answer
132 views

Unexpected memory value MOVed from text segment to register in Windows x86 32-bit program

I am debugging a 32-bit program on a 64-bit MS Windows 7 using IDA Pro 6.8 as seen in the image below: The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to ...
0
votes
1answer
79 views

how calculate size of memory that allocated from create specific windows object? [closed]

how calculate size of memory that allocated from create specific windows object e.g. how memory allocated when createsemaphore API is called? there are any document that describe for all objects?
8
votes
2answers
262 views

Lego NXT Exploitation and Vulnerabilities?

First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I ...
0
votes
0answers
340 views

Debugger stack overflow

I'm having weird issue with debugging. No matter which software I use: IDA or even Cheat Engine, the debugger crashes on resuming from breakpoint with error: 7716DF76: A new guard page for the stack ...
4
votes
1answer
448 views

Where to start with iOS debugging?

Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
1
vote
0answers
185 views

How get a full memory dump of a running specific process from kernel mode by driver?

How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
-1
votes
2answers
5k views

Attaching Ida to a process

I am a little new to ida. So don't judge on the question I am about to ask but I am tired chasing my tail around. I am trying to attach ida to a running process but I get the following error messages: ...
3
votes
0answers
1k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
1
vote
1answer
2k views

Unable to view stack and memory addresses in IDA Pro [duplicate]

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328 ...
0
votes
1answer
600 views

How find address of specific pool allocated? [closed]

How find address of specific pool that allocated by specific tag e.g. address of pool that allocated by CM7 tag? thanks
0
votes
1answer
695 views

IDA pro doesn't stop on breakpoints with GUI based applications

A couple of days ago I ran into an executable called "carckme" which was a GUI application. So I decided to figure out the serial number it generates. Properly I found out the function but when it ...
2
votes
1answer
590 views

Trying to call function in process via DLL injection, need help in IDA if possible

I'm trying to create a bot for a game called "Mech Warrior Online". I've just completed my DLL injector which I want to use as mean to call function from the MWO client such as (fire, move, look ...
1
vote
1answer
1k views

Ollydbg:how to let Olly remember a breakpoint for next run

I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
-1
votes
2answers
2k views

how to extract a file embedded in an .exe?

for some months nearly a year of reversing an app not for cracking but my is to see the difference between the registered version and the unregistered one. according to my research both apps(...
-1
votes
2answers
5k views

How to extract code form .exe file having signature Borland Delphi 6.0 - 7.0 [Overlay] [closed]

when i input .exe file to PEiD v0.95 it gives output like "Borland Delphi 6.0 - 7.0 [Overlay]" Now i want to retrieve code from .exe file. So how to do that . Can any one give me right path for that.
0
votes
1answer
80 views

Very simple example log file - Recording program execution [closed]

I'm after a very simple example log file with corresponding code, that expresses exactly what would need to be recorded to enable deterministic replay - for the purpose of record/replay debugging. ...
0
votes
1answer
197 views

Is it possible to programmatically determine if a crash resulted from a buffer overflow?

Crash analysis: Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the ...
2
votes
1answer
2k views

How to change address in the hex view in IDA debugger?

I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
1
vote
1answer
215 views

iOS exploit hunting environment

Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
0
votes
1answer
226 views

Breaking on specific API

I wish to set a breakpoint on a call to a specific windows API function, e.g.- RegQueryValueExA() It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual ...
1
vote
2answers
4k views

How to print from pointers in radare2 in debug session

when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction 0x08048498 8b4508 mov eax, dword [ebp+arg2] ...
0
votes
2answers
145 views

Which libraries exist for PDB (symbol file) generation?

I know that there are many libraries that parse PDB files and allow extracting debug information from them. For a project I am working on, I need to generate PDB files. Are there any publicly ...
0
votes
1answer
123 views

Get DLL name with PyDBG and System_dll.py?

Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just: dbg.set_callback(...
2
votes
1answer
263 views

Can I get different thread registers with PyDBG?

I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to: [*] ...
4
votes
1answer
1k views

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

I have an old DOS program compiled using Borland C++ (1991 version) The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information : eg: ...
4
votes
1answer
990 views

How Can I Debug A Bios Better

I am trying to reverse engineer a firmkit in a bios, but in general I would like to know how can I debug a bios better. I found a way to attach IDA to a vmware instance usign a GDB session GDB ...
2
votes
1answer
495 views

Analyzing a Login Process

I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process: Client takes input for username and password, then sends username to the auth server. Auth ...
3
votes
1answer
7k views

how to setup IDA pro linux GDB server

I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
1
vote
0answers
231 views

immunity debugger MSVCR90.dll R6034

I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit ...
3
votes
1answer
534 views

Using multilevel pointers obtained via cheat engine in own application

So I have finished step 8 of the Cheat Engine tutorial and obtained a static address with corresponding offsets to manipulate a value which should be changed to progress in the tutorial. The ...
2
votes
1answer
6k views

How to disassemble .NET after using Confuser

I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9. I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it. How can I debug (and ...
2
votes
1answer
1k views

Kernel debugging between two virtual machines not working

i want to do kernel debugging on my vm from another vm. My setup is pretty simple, Debugged - VM: Windows XP SP3 x32 (To be debugged) Debugger - VM: Windows 7 SP1 x64 (With Windbg installed - the ...
1
vote
2answers
766 views

Find a string in an object file

I have a libcocos2djs.so file, which presumably is a mobile game using Cocos2d. Result of file: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/...
1
vote
1answer
365 views

ImpRec invalid NtdllDefWindowProc_A seem valid

I have a problem that NtdllDefWindowProc_A function from ntdll is inside user32 thunk. Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...