Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
1
vote
0answers
666 views
Immunity Debugger Unable to set Breakpoint
I have recently installed Immunity Debugger in order to do some dynamic analysis on some Malware however am getting the same 2 errors no matter what i try.
The first error is that Immunity is 'Unable ...
1
vote
0answers
358 views
OllyDbg step over command not behaving exactly as the Immunity Debugger
I am taking Lena Reverse Engineering Tutorial and it uses OllyDbg debugger for its teaching.
In the first chapter, he shows the file in OllyDbg debugger and steps over through it "step by step" until ...
2
votes
0answers
90 views
Trace replayer won't load binary debug information
So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
1
vote
1answer
2k views
OllyDbg: how to record all funtion calls for attached process
I am trying to learn how IIS 5.0(running on Win2K Server) works with OllyDbg v1.10.
I attach Olly to inetinfo.exe, which is the process for IIS 5.0. Olly then pauses in ntdll. See here.
My plan is: I ...
2
votes
1answer
2k views
How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host
The problem: Recently I had to perform a kernel debugging on two MS windows VMWare virtual machines connected via a virtual serial port, and while running on a GNU/Linux host.
The layout: GNU/Linux ...
0
votes
1answer
253 views
Entry point of malicious child process
OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what ...
0
votes
2answers
2k views
How to set a breakpoint on a 64 bit process button with x64dbg?
I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, ...
2
votes
2answers
2k views
Why does program fail to run under several debuggers?
To lay out the obvious for a start, I am a beginner in the Reverse Engineering area when it comes to Computer Science. I have come across a program which I wanted to reverse engineer for myself to see ...
4
votes
2answers
337 views
How to break on a clipboard operation in cmd.exe with IDA / WinDbg?
My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
2
votes
1answer
222 views
Hooking in Immunity - LogBpHook not working
I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging).
First of all my hook class:
class AllocHook(LogBpHook):
def ...
1
vote
0answers
121 views
Help for unpacking software [closed]
I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked.
Can you help me please ?
2
votes
2answers
106 views
How do debuggers help one with finding information about how a program does something?
Let's say I want to reverse engineer an executable that interprets some data type. I want to see how the program interferes with the file, and what is stored. In the case that decompilation is not an ...
1
vote
1answer
184 views
x64 Memory Pointer and Addressing modes [closed]
I'm working through example from a Windows disassembly training guide. In the exercise rax is set to a byte ptr, then rbx a word ptr. I notice the next byte of memory is skipped before rcx is to a ...
3
votes
1answer
150 views
Win32 x86 Prolog disassembly
I have the following disassembly of a function prolog with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack frame"...
1
vote
1answer
3k views
Is it possible to debug a .Net executable with IDA?
When I load a .Net executable into IDA then there is no Debug menu as when I load a normal binary. Is there any way to enable the debug functionality for .Net as well? I'd like to step into some ...
1
vote
1answer
651 views
x64dbg and ollydbg error not enough memory
I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the ...
0
votes
1answer
136 views
Unexpected memory value MOVed from text segment to register in Windows x86 32-bit program
I am debugging a 32-bit program on a 64-bit MS Windows 7 using IDA Pro 6.8 as seen in the image below:
The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to ...
0
votes
1answer
80 views
how calculate size of memory that allocated from create specific windows object? [closed]
how calculate size of memory that allocated from create specific windows object
e.g.
how memory allocated when createsemaphore API is called?
there are any document that describe for all objects?
8
votes
2answers
264 views
Lego NXT Exploitation and Vulnerabilities?
First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I ...
4
votes
1answer
465 views
Where to start with iOS debugging?
Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
1
vote
0answers
188 views
How get a full memory dump of a running specific process from kernel mode by driver?
How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
-1
votes
2answers
5k views
Attaching Ida to a process
I am a little new to ida. So don't judge on the question I am about to ask but I am tired chasing my tail around. I am trying to attach ida to a running process but I get the following error messages:
...
3
votes
0answers
1k views
How to log all memory accesses (read and write) including the memory content in a binary execution trace?
I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
1
vote
1answer
2k views
Unable to view stack and memory addresses in IDA Pro [duplicate]
I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328
...
0
votes
1answer
635 views
How find address of specific pool allocated? [closed]
How find address of specific pool that allocated by specific tag
e.g. address of pool that allocated by CM7 tag?
thanks
0
votes
1answer
732 views
IDA pro doesn't stop on breakpoints with GUI based applications
A couple of days ago I ran into an executable called "carckme" which was a GUI application. So I decided to figure out the serial number it generates. Properly I found out the function but when it ...
2
votes
1answer
598 views
Trying to call function in process via DLL injection, need help in IDA if possible
I'm trying to create a bot for a game called "Mech Warrior Online". I've just completed my DLL injector which I want to use as mean to call function from the MWO client such as (fire, move, look ...
1
vote
1answer
1k views
Ollydbg:how to let Olly remember a breakpoint for next run
I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
-1
votes
2answers
2k views
how to extract a file embedded in an .exe?
for some months nearly a year of reversing an app not for cracking but my is to see the difference between the registered version and the unregistered one.
according to my research both apps(...
-1
votes
2answers
6k views
How to extract code form .exe file having signature Borland Delphi 6.0 - 7.0 [Overlay] [closed]
when i input .exe file to PEiD v0.95 it gives output like
"Borland Delphi 6.0 - 7.0 [Overlay]"
Now i want to retrieve code from .exe file. So how to do that . Can any one give me right path for that.
0
votes
1answer
84 views
Very simple example log file - Recording program execution [closed]
I'm after a very simple example log file with corresponding code, that expresses exactly what would need to be recorded to enable deterministic replay - for the purpose of record/replay debugging.
...
0
votes
1answer
199 views
Is it possible to programmatically determine if a crash resulted from a buffer overflow?
Crash analysis:
Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the ...
2
votes
1answer
3k views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
1
vote
1answer
234 views
iOS exploit hunting environment
Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
0
votes
1answer
250 views
Breaking on specific API
I wish to set a breakpoint on a call to a specific windows API function, e.g.-
RegQueryValueExA()
It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual ...
1
vote
2answers
5k views
How to print from pointers in radare2 in debug session
when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction
0x08048498 8b4508 mov eax, dword [ebp+arg2]
...
0
votes
2answers
151 views
Which libraries exist for PDB (symbol file) generation?
I know that there are many libraries that parse PDB files and allow extracting debug information from them.
For a project I am working on, I need to generate PDB files. Are there any publicly ...
0
votes
1answer
128 views
Get DLL name with PyDBG and System_dll.py?
Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just:
dbg.set_callback(...
2
votes
1answer
278 views
Can I get different thread registers with PyDBG?
I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to:
[*] ...
4
votes
1answer
1k views
Is there a way to import debug/symbol information of a C++ DOS executable to IDA?
I have an old DOS program compiled using Borland C++ (1991 version)
The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information :
eg: ...
4
votes
1answer
1k views
How Can I Debug A Bios Better
I am trying to reverse engineer a firmkit in a bios, but in general I would like to know how can I debug a bios better.
I found a way to attach IDA to a vmware instance usign a GDB session GDB ...
2
votes
1answer
512 views
Analyzing a Login Process
I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process:
Client takes input for username and password, then sends username to the auth server.
Auth ...
3
votes
1answer
8k views
how to setup IDA pro linux GDB server
I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
1
vote
0answers
240 views
immunity debugger MSVCR90.dll R6034
I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit ...
3
votes
1answer
545 views
Using multilevel pointers obtained via cheat engine in own application
So I have finished step 8 of the Cheat Engine tutorial and obtained a static address with corresponding offsets to manipulate a value which should be changed to progress in the tutorial. The ...
2
votes
1answer
7k views
How to disassemble .NET after using Confuser
I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9.
I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it.
How can I debug (and ...
2
votes
1answer
1k views
Kernel debugging between two virtual machines not working
i want to do kernel debugging on my vm from another vm.
My setup is pretty simple,
Debugged - VM:
Windows XP SP3 x32 (To be debugged)
Debugger - VM:
Windows 7 SP1 x64 (With Windbg installed - the ...
1
vote
2answers
795 views
Find a string in an object file
I have a libcocos2djs.so file, which presumably is a mobile game using Cocos2d. Result of file:
ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/...
1
vote
1answer
373 views
ImpRec invalid NtdllDefWindowProc_A seem valid
I have a problem that NtdllDefWindowProc_A function from ntdll is
inside user32 thunk.
Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...
4
votes
1answer
7k views
When to use OllyDgb over Immunity Debugger
I have always been curious when I should use OllyDbg over Immunity Debugger.
Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python.
Interestingly enough, ...
