Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
1
vote
0answers
83 views
Trace replayer won't load binary debug information
So I'm debugging a linux application with what I believe DWARF debug information on x86-64 host. Everything is working fine and as expected - the source files are loaded immediately on function ...
1
vote
1answer
2k views
OllyDbg: how to record all funtion calls for attached process
I am trying to learn how IIS 5.0(running on Win2K Server) works with OllyDbg v1.10.
I attach Olly to inetinfo.exe, which is the process for IIS 5.0. Olly then pauses in ntdll. See here.
My plan is: I ...
2
votes
1answer
2k views
How to connect two Windows VMWare virtual machines over a virtual serial port for kernel debugging on a Linux host
The problem: Recently I had to perform a kernel debugging on two MS windows VMWare virtual machines connected via a virtual serial port, and while running on a GNU/Linux host.
The layout: GNU/Linux ...
0
votes
0answers
272 views
How to get the arguments passed to a function located in a DLL?
I am using Pydbg for resolving the exported function address located in the dll. Going through the pydbg documentation, i couldn't find a way to dump the arguments passed to those functions.
0
votes
1answer
244 views
Entry point of malicious child process
OK...I have a file which, upon execution, runs a copy of itself as a child process, with, obviously, different behaviors. Since this (obviously) means that OllyDBG isn't going to be able to see what ...
0
votes
2answers
1k views
How to set a breakpoint on a 64 bit process button with x64dbg?
I want to find out what certain buttons do on a 64 bit application, x64dbg is the debugger I have available to me, can anyone help me out? I read that ollydbg has an option to break on user input, ...
2
votes
2answers
2k views
Why does program fail to run under several debuggers?
To lay out the obvious for a start, I am a beginner in the Reverse Engineering area when it comes to Computer Science. I have come across a program which I wanted to reverse engineer for myself to see ...
4
votes
2answers
328 views
How to break on a clipboard operation in cmd.exe with IDA / WinDbg?
My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
2
votes
1answer
203 views
Hooking in Immunity - LogBpHook not working
I try to use a simple hook on different memory allocation functions in Immunity. But the hook doesn't react at all (no logging).
First of all my hook class:
class AllocHook(LogBpHook):
def ...
1
vote
0answers
118 views
Help for unpacking software [closed]
I try to unpacking a software packed with PC guard 5 there are few month and i dont arrive manually or with script to find OEP. I readed many tutorials on it but dont worked.
Can you help me please ?
2
votes
2answers
106 views
How do debuggers help one with finding information about how a program does something?
Let's say I want to reverse engineer an executable that interprets some data type. I want to see how the program interferes with the file, and what is stored. In the case that decompilation is not an ...
1
vote
1answer
178 views
x64 Memory Pointer and Addressing modes [closed]
I'm working through example from a Windows disassembly training guide. In the exercise rax is set to a byte ptr, then rbx a word ptr. I notice the next byte of memory is skipped before rcx is to a ...
3
votes
1answer
143 views
Win32 x86 Prolog disassembly
I have the following disassembly of a function prolog with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack frame"...
1
vote
1answer
3k views
Is it possible to debug a .Net executable with IDA?
When I load a .Net executable into IDA then there is no Debug menu as when I load a normal binary. Is there any way to enable the debug functionality for .Net as well? I'd like to step into some ...
0
votes
0answers
76 views
breaks on wsasend but not on wsaconnect
Good evening it's me again,
I have found the address of the wsasend function where my program calls it. I have set a breakpoint on the function inside the ws2_32.dll and just checked the traceback ...
1
vote
1answer
606 views
x64dbg and ollydbg error not enough memory
I wanted to debug an executable but I always receive one of the errors 'last or first chance' exception. The 'last error' label shows me this error : 00000008 (ERROR_NOT_ENOUGH_MEMORY). When I run the ...
0
votes
1answer
132 views
Unexpected memory value MOVed from text segment to register in Windows x86 32-bit program
I am debugging a 32-bit program on a 64-bit MS Windows 7 using IDA Pro 6.8 as seen in the image below:
The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to ...
0
votes
1answer
79 views
how calculate size of memory that allocated from create specific windows object? [closed]
how calculate size of memory that allocated from create specific windows object
e.g.
how memory allocated when createsemaphore API is called?
there are any document that describe for all objects?
8
votes
2answers
262 views
Lego NXT Exploitation and Vulnerabilities?
First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I ...
0
votes
0answers
340 views
Debugger stack overflow
I'm having weird issue with debugging. No matter which software I use: IDA or even Cheat Engine, the debugger crashes on resuming from breakpoint with error:
7716DF76: A new guard page for the stack ...
4
votes
1answer
448 views
Where to start with iOS debugging?
Long story short, I have always had a jailbroken device, I have written and ported multiple tools to iOS, and have a fair knowledge of objective-C, ROP, and Linux exploitation. I have begun to take an ...
1
vote
0answers
185 views
How get a full memory dump of a running specific process from kernel mode by driver?
How can i get a full memory dump of a running specific process from kernel mode by driver on windows operation system?
-1
votes
2answers
5k views
Attaching Ida to a process
I am a little new to ida. So don't judge on the question I am about to ask but I am tired chasing my tail around. I am trying to attach ida to a running process but I get the following error messages:
...
3
votes
0answers
1k views
How to log all memory accesses (read and write) including the memory content in a binary execution trace?
I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
1
vote
1answer
2k views
Unable to view stack and memory addresses in IDA Pro [duplicate]
I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328
...
0
votes
1answer
600 views
How find address of specific pool allocated? [closed]
How find address of specific pool that allocated by specific tag
e.g. address of pool that allocated by CM7 tag?
thanks
0
votes
1answer
695 views
IDA pro doesn't stop on breakpoints with GUI based applications
A couple of days ago I ran into an executable called "carckme" which was a GUI application. So I decided to figure out the serial number it generates. Properly I found out the function but when it ...
2
votes
1answer
590 views
Trying to call function in process via DLL injection, need help in IDA if possible
I'm trying to create a bot for a game called "Mech Warrior Online". I've just completed my DLL injector which I want to use as mean to call function from the MWO client such as (fire, move, look ...
1
vote
1answer
1k views
Ollydbg:how to let Olly remember a breakpoint for next run
I'm a Olly newbie... whenever I set a breakpoint at an address and found I need to restart the target program, the previously set breakpoints are all removed. Is there anyway to let Olly to remember ...
-1
votes
2answers
2k views
how to extract a file embedded in an .exe?
for some months nearly a year of reversing an app not for cracking but my is to see the difference between the registered version and the unregistered one.
according to my research both apps(...
-1
votes
2answers
5k views
How to extract code form .exe file having signature Borland Delphi 6.0 - 7.0 [Overlay] [closed]
when i input .exe file to PEiD v0.95 it gives output like
"Borland Delphi 6.0 - 7.0 [Overlay]"
Now i want to retrieve code from .exe file. So how to do that . Can any one give me right path for that.
0
votes
1answer
80 views
Very simple example log file - Recording program execution [closed]
I'm after a very simple example log file with corresponding code, that expresses exactly what would need to be recorded to enable deterministic replay - for the purpose of record/replay debugging.
...
0
votes
1answer
197 views
Is it possible to programmatically determine if a crash resulted from a buffer overflow?
Crash analysis:
Given a large set of crashes, all resulting from access violations, is it possible to (with or without access to symbols and source code) programmatically determine whether the ...
2
votes
1answer
2k views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
1
vote
1answer
215 views
iOS exploit hunting environment
Suppose, I have a new iPhone 6s with latest iOS, and I want to find vulnerabilities in iOS itself. iPhone is not jailbroken. How do I set up the proper environment for this? What software and/or ...
0
votes
1answer
226 views
Breaking on specific API
I wish to set a breakpoint on a call to a specific windows API function, e.g.-
RegQueryValueExA()
It is resolved at runtime in unknown stage of malware execution, and I wish to initiate manual ...
1
vote
2answers
4k views
How to print from pointers in radare2 in debug session
when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction
0x08048498 8b4508 mov eax, dword [ebp+arg2]
...
0
votes
2answers
145 views
Which libraries exist for PDB (symbol file) generation?
I know that there are many libraries that parse PDB files and allow extracting debug information from them.
For a project I am working on, I need to generate PDB files. Are there any publicly ...
0
votes
1answer
123 views
Get DLL name with PyDBG and System_dll.py?
Is it possible to get the name and path of a DLL that is loaded by the application using PyDBG and System_dll.py? I have a script and PyDBG handles loaded dlls with just:
dbg.set_callback(...
2
votes
1answer
263 views
Can I get different thread registers with PyDBG?
I am writing a python debugger and disassembler using the PyDBG library I have the disassembler part working, but not all of the debugger. Is it possible to use it to return something similar to:
[*] ...
4
votes
1answer
1k views
Is there a way to import debug/symbol information of a C++ DOS executable to IDA?
I have an old DOS program compiled using Borland C++ (1991 version)
The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information :
eg: ...
4
votes
1answer
990 views
How Can I Debug A Bios Better
I am trying to reverse engineer a firmkit in a bios, but in general I would like to know how can I debug a bios better.
I found a way to attach IDA to a vmware instance usign a GDB session GDB ...
2
votes
1answer
495 views
Analyzing a Login Process
I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process:
Client takes input for username and password, then sends username to the auth server.
Auth ...
3
votes
1answer
7k views
how to setup IDA pro linux GDB server
I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
1
vote
0answers
231 views
immunity debugger MSVCR90.dll R6034
I'm new to the science of reverse engineering. I recently downloaded immunity debugger 1.85 32bit Assembler-Level Debugger. My host machine is Windows 7 64 bit. I have python 2.7 installed as 32 bit ...
3
votes
1answer
534 views
Using multilevel pointers obtained via cheat engine in own application
So I have finished step 8 of the Cheat Engine tutorial and obtained a static address with corresponding offsets to manipulate a value which should be changed to progress in the tutorial. The ...
2
votes
1answer
6k views
How to disassemble .NET after using Confuser
I want to test malware that wrote in .NET 4.5 and obfuscated by Confuser 1.9.
I have tried to open it with .NET Reflector, ILSpy and dotpeek, but all of them can't open it.
How can I debug (and ...
2
votes
1answer
1k views
Kernel debugging between two virtual machines not working
i want to do kernel debugging on my vm from another vm.
My setup is pretty simple,
Debugged - VM:
Windows XP SP3 x32 (To be debugged)
Debugger - VM:
Windows 7 SP1 x64 (With Windbg installed - the ...
1
vote
2answers
766 views
Find a string in an object file
I have a libcocos2djs.so file, which presumably is a mobile game using Cocos2d. Result of file:
ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/...
1
vote
1answer
365 views
ImpRec invalid NtdllDefWindowProc_A seem valid
I have a problem that NtdllDefWindowProc_A function from ntdll is
inside user32 thunk.
Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...
