Skip to main content

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
1 vote
1 answer
38 views

What's the best way or approach to debug binary Linux library?

I've got a header file (I know the functions and have some documentation) and a .so file: From a wrapper library and from context, I need to call "Connect", but it does not work, just fails ...
2 votes
1 answer
108 views

What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?

What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG? I found this command useful to debug with ASLR (w/o disabling it).
3 votes
1 answer
69 views

How can I set up a conditional breakpoint for the CreateFileW function for when a specific file/path is read in x64dbg?

I'm currently debugging a program using x64dbg, and I'm struggling to set up a conditional breakpoint on the CreateFileW function: HANDLE CreateFileW( [in] LPCWSTR lpFileName,...
1 vote
1 answer
155 views

Rename a program's button using x64dbg?

I'm trying to change the name of a button, but I can't find anything that references it. I looked for the CreateWindow function in the intermodular calls, but I only found a reference to the main ...
1 vote
2 answers
211 views

Debugging of any x86(_64) executable producing strange results under Parallels + Windows on Arm

Recently, I have been experimenting with using an M1 (Arm64) Mac full-time for RE work, including Windows on Arm under Parallels with x86(_64) binaries. From several online sources discussing this use ...
0 votes
1 answer
111 views

IDA Pro Debugging GDB SendDbgCommand

I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging. Setting up the debug environment with IDA Pro using ...
2 votes
0 answers
79 views

i want to know how to tracing a exe's http responses

I want to "debug" this exe protected by thermedia + vmp and I had someone do it before but lost contact with them and, now I would like to learn to do it myself. and they said a basic way to ...
1 vote
1 answer
103 views

Tips for reverse engineering Common Lisp (SBCL) ELF binary

I got to the task of reverse engineering the ELF binary. I found out that it is a compiled SBCL. I have no idea how to do static or dynamic analysis, any tips (where to start, I found basically ...
0 votes
0 answers
47 views

How to get which Tedit is referenced when retrieving text

Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv Now, the two parameters for the function are: LEA param_2=>local_8,[EBP + -0x4] MOV param_1,...
0 votes
1 answer
710 views

Wrong default starting address

I have no idea how, when or why, but now, the "default address" (the one executed when pressing F9) is 0x77960884. It should be 0x00401000 (when I manually go to 0x00401000, everything works). The ...
0 votes
1 answer
2k views

Dynamic Analysis on ELF using IDA

On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
0 votes
0 answers
47 views

Decoding API headers of unknown encoding?

I'm using mitmproxy to monitor facebook messenger app traffic on my android. Firstly I had to enable whitehat settings to use it. After that I found some request headers has some unknown value in body....
0 votes
0 answers
51 views

How to use reverse engineering to get paginated threads id on facebook messenger

I'm trying to replicate websocket request in python. I want to get paginated results of threads id that appears after scrolling down the friends chats section. Seems messenger uses websocket for it. ...
0 votes
0 answers
51 views

How to use reverse engineering to learn how facebook send messages?

I would like to know how I can use reverse engineering technique to learn how Facebook/messenger send messages? I were analyzing my developer tools network tab, but couldn't find anything. Fiddler ...
0 votes
0 answers
28 views

How to trigger calls and attach to functions on a running process?

I'm a software developer, with some knowledge in memory management but near zero experience in reverse engineering. I wonder if there is a way to detect which function a program calls at certain ...
0 votes
2 answers
141 views

How can I debug if the program closes directly?

I'm trying to debug a game and it's closing under few circumstances: When debugging (solved by hooking IsDebuggerPresent to return false when called by the game) When setting a memory/hardware ...
0 votes
1 answer
172 views

How can I debug a UWP application on startup?

I'm trying to debug a UWP application, and break on startup. However, when I start the application with windbg, the breakpoint didn't work. After further digging I found the process is started by ...
0 votes
1 answer
57 views

Offset addressing

I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation: in code I ...
6 votes
1 answer
608 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
0 votes
0 answers
83 views

How to get decryption keys from an offline player?

I am just starting to learn reverse engineering from lena lectures. I have 2 encrypted sample vids and an offline player which is able to decrypt the videos and play them, is there any way,I can get ...
3 votes
1 answer
686 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
1 vote
1 answer
321 views

Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?

In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
0 votes
0 answers
47 views

Why a breakpoint works in x64dbg but not in IDA?

I've spent all morning trying to find a solution to debug with IDA the same function I'm debugging in x64dbg. In x64dbg, I just go to Symbols -> ws2_32.dll -> WSARecvFrom -> F2 (set ...
0 votes
0 answers
49 views

Debugging [DebuggerHidden] method

My app uses DLL that calls another app with System.RuntimeType.InvokeMember. I decompiled all modules and got source code with VS2022 so I can see the code of System.RuntimeType.InvokeMember, but it's ...
0 votes
0 answers
40 views

How can I find the part of cmd.exe that processes windows batch commands before they're executed?

I'm able to find the ReadConsoleInputW commands for pause and reading input for commands but I'm unable to find the actual processing of the commands. I'm using x64dbg but I'm fairly new to Reverse ...
0 votes
0 answers
138 views

APK/Apktool If I decompile and recompile sources the app does not start

I'm trying to reverse an apk but there is a strange thing that happens, probably something new for me, basically if I decompile only the resources (not dex files) and recompile it zipalign/sign, the ...
0 votes
0 answers
39 views

how to set a BP on button in SunAwtCanvas in x96dbg

I'm trying to debug a program in x96dbg that I think this is written in Matlab. There is no string related to buttons or something interesting. Then I go to Handles tab to find buttons and set break ...
1 vote
0 answers
80 views

Freeware x86 decompilers for Windows with debug? [closed]

I'm searching for a software that is capable of decompiling x86 code in C-like code and run a debug session within it with the possibility to see the content of the variables. That above was a quick ...
0 votes
0 answers
72 views

Requesting Guidance To Understand SuperScape's .VCA Format: Lego Creator Knights Kingdom

I hope you all are doing well and staying safe. I am in the process of trying to understand how SuperScape stored data in their .VCA/LCA format, so I can extract the original SHAP and PAL data from ...
1 vote
0 answers
128 views

Got access to SWD, but I need to identify the chip

I was able to connect to the chip via SWD/openocd, but I can't figure out what chip it is (says SM9PQ1 2322-52 on chip, googled but cant find anything). I'm hoping to download the firmware after I ...
0 votes
0 answers
62 views

IDA Free Debugger slows down app substantially

I'm using IDA Free to decompile and debug an exectuable (a game, actually). When starting the debugger, the game runs really, really slow occasionally. Before, I have used Cheat Engine to debug the ...
1 vote
0 answers
274 views

IDA pro Error how to resolve this error

52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672) How to solve this? I have seen sandbox reports in those the ...
1 vote
1 answer
82 views

Should shell32.dll be in executable search path for winword.exe with WinDBG?

I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
0 votes
0 answers
99 views

How to exclude "Process Monitor" from Themida's list of monitoring programs

Can Themida be made to whitelist a particular program of its list of "monitoring programs", whether through reversing or compile-flags? I want to exclude Sysinternals "Process Monitor&...
0 votes
0 answers
215 views

Need Help Cracking a Program

So I've got this .exe that I want to crack. It's an old management system for people in truck loading business. I kind of understand what's happening with window API calls but I'm unable to access the ...
2 votes
1 answer
432 views

xdbg64 Unable to find string.. Need help cracking a program

Ive been trying to crack my friends program for quite some time. He gave me permission and we are trying to see if his mod menu is ready to hit the market. Ive watched a couple youtube videos and I am ...
0 votes
1 answer
76 views

IDA Pro: JDWP error: ABSENT_INFORMATION - Desired information is not available

I am trying to debug a dex file from an APK file in IDA Pro. I set some breakpoints when launching the activity. When I start the process, the application waits for the debugger. After some time, IDA ...
0 votes
0 answers
129 views

Debug the DLL of an EXE using IDA Freeware

I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
0 votes
1 answer
102 views

Trying to reverse encypter to decrytper in C. Can't figure out what I'm missing

Goal: Trying to reverse encrypter to decrypter that successfully decrypts. This is the pseudo-code of the disassembled encrypting program. There are no function calls, and I've been able to somewhat ...
1 vote
0 answers
44 views

Retrieve functionality to button - game patching

I'm patching an old game, and I want the retrieve the toggle fullscreen functionality it's supposed to have. In the menu, in the display tab, there is a disabled option of fullscreen mode that you can ...
1 vote
2 answers
541 views

How can I jump to the start/end of a function in x64dbg?

I'm currently debugging a program using x64dbg, and I'm wondering how to quickly jump to the start or end (prologue/epilogue) of a function while I'm in the middle of it. I couldn't find this ...
0 votes
0 answers
38 views

How can I make a quick tracer for a PE file?

INTRODUCTION: I made my tracer on the event debug loop, but after I compared its speed characteristics with the same PinTool or similar tools, I realized that my tracer is several dozen times slower ...
0 votes
1 answer
98 views

How to reverse a USB firmware patching tool for another device?

I have a USB device from a vendor (TRENDnet) that has the exact same chipset as a QNAP device with an available firmware patching tool. It's my belief that this firmware patching tool should work ...
1 vote
0 answers
69 views

How to debug armel and armhf binaries on x86-64 Ubuntu simultaneously?

I'm working on the challenges on ROP Emporium. For the ARMv5 version of the callme challenge, we are given two binaries and two shared libraries: callme_armv5 with libcallme_armv5.so and callme_armv5-...
2 votes
1 answer
336 views

help me to debug file packed with molebox and proteced with obsidium

I have a exe file that packed with molebox and protected with obsidium. I try to unpack it with demoleition but it has some problem. when I want to open the unpacked file it says "Component '...
1 vote
0 answers
50 views

JEB pro is not showing xrefs for native code (arm)

i have this problem when analyzing arm shared object. when working with IDA pro, it finds all xrefs but in jeb, most of xrefs are missing. when JEB finfishes, the final analysis lacks most of xrefs. I ...
2 votes
1 answer
168 views

What triggers RIP_EVENT?

The documentation for the Windows Debugger API mentions a debug event called RIP_EVENT. It offers little explanation of what a RIP_EVENT is, only stating that the structure "contains the error ...
2 votes
0 answers
69 views

Radare2: How to Create a Custom Scripted Panel?

TLDR: How do I get a panel in radare2 to correctly show the output of a radare2 command piped to an external script? e.g. afvd | python var_displayer.py This is my current view. Multiple panels, ...
3 votes
0 answers
78 views

How to unpack emotet with x64dbg and do dynamic analysis?

I am a beginner at malware analysis. I have been trying to analyze Emotet using X64DBG. I followed the steps below and succeeded once, but when I repeated the same steps, I failed. Can you tell me if ...
4 votes
2 answers
290 views

Malware analysis - Debugger hangs at HttpSendRequestA

I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC. I was able to replicate this behaviour with a small ...

1
2 3 4 5
13