Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
54
questions
7
votes
2
answers
757
views
Trace assisted code identification?
I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists.
I'd like to find a specific part of code in the binary. Searching for ...
- 1,022
18
votes
1
answer
4k
views
Debugging with radare2 using two terminals
I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:
I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
- 1,043
19
votes
4
answers
21k
views
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR.
break start and similar ...
- 2,279
12
votes
2
answers
15k
views
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
My ...
- 123
9
votes
3
answers
22k
views
x64dbg how to debug a DLL called from an application
I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
- 311
2
votes
2
answers
2k
views
IDA pro: jump back to previous instruction
I'm new with IDA pro and currently running with debugger, I have few questions:
How can I jump on previous instruction? Undo the latest instruction ?
Is it possible in IDA to examine memory of an ...
- 29
32
votes
4
answers
14k
views
How to reverse engineer a Windows 10 UWP app?
I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10:
Somehow the results are not the same what is available via ...
- 1,295
28
votes
4
answers
39k
views
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf:
myelf: ELF 32-bit ...
- 455
27
votes
8
answers
47k
views
Decompiling a 1990 DOS application
I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
- 549
4
votes
3
answers
4k
views
Does IDA support remote debugging in their Freeware Version?
I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
- 279
3
votes
1
answer
13k
views
how to setup IDA pro linux GDB server
I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
- 335
2
votes
3
answers
946
views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
- 3,189
5
votes
1
answer
961
views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
- 51
2
votes
1
answer
3k
views
IDA Pro debugging: follow child process
I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
- 21
1
vote
1
answer
893
views
ESP out of range of "Stack View" in IDA
A very similar (or exact) question was asked here, though it was not answered properly.
I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
- 183
8
votes
1
answer
4k
views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
- 263
9
votes
2
answers
1k
views
Open-source equivalent for FLIRT
I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.
Right now, the only way I can do that is to use IDA's FLIRT (...
- 337
8
votes
3
answers
6k
views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
- 181
13
votes
2
answers
3k
views
How can I find the source of a string in an old DOS game?
I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players.
In the past it hasn't been too hard to pull off such a task on post-DOS games ...
user11826
10
votes
3
answers
9k
views
Jump back to the caller
I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app.
I load the exe from file menu with input arguments
Set breakpoint on msvcr71.printf function
After this ...
- 101
7
votes
2
answers
3k
views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
- 175
3
votes
2
answers
4k
views
lldb: break at start of actual code, not entrypoint
I want lldb to break at the start of the actual code of an OS X application (which might be called main if symbols are existing).
I am currently looking this up by hand, but as I want to script some ...
- 165
7
votes
1
answer
2k
views
OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?
I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
- 181
6
votes
1
answer
2k
views
Handling INT 2D anti-debugger technique in IDA Pro
I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging:
CODE:00455050 push ebp
CODE:00455051 mov ebp, esp
CODE:00455053 push ecx
CODE:00455054 push ebx
...
- 225
6
votes
1
answer
3k
views
DOS program debug in IDA?
Does anybody know something hack to debug 16bit DOS program in IDA 6.1?
- 63
3
votes
2
answers
2k
views
Extracting HTTPS packets before encryption
Say we have a Windows application, which sends some packets over HTTPS. We need to extract the content of this packets (unencrypted of course).
There is no way to get hands on server private ...
- 31
3
votes
2
answers
2k
views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
- 51
2
votes
1
answer
51
views
LLDB debugging on android?
I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
- 144
1
vote
2
answers
7k
views
How to print from pointers in radare2 in debug session
when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction
0x08048498 8b4508 mov eax, dword [ebp+arg2]
...
- 335
1
vote
1
answer
998
views
ImpRec invalid thunks seem valid
I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just ...
- 31
1
vote
1
answer
1k
views
Call Stack vs Intermodular Calls in Ollydbg
What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
1
vote
1
answer
2k
views
IDA - Remote debug on linux
I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink).
Because the exploit is via gets() I try to pass input through the "...
- 13
0
votes
1
answer
494
views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
0
votes
1
answer
380
views
Seed/Key Constant Value
I am trying to reverse a seed/key algorithm that has a constant value inside it. and there is different const value for different device that use this algorithm.
i can give some sample from each ...
- 87
0
votes
1
answer
525
views
Dumpbin: Correlating thunk jumps in .reloc to disassembly
I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said ...
- 368
0
votes
1
answer
475
views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
- 169
7
votes
2
answers
2k
views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
- 1,491
3
votes
1
answer
389
views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
- 163
3
votes
1
answer
5k
views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
- 1,295
2
votes
1
answer
818
views
Analyzing a Login Process
I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process:
Client takes input for username and password, then sends username to the auth server.
Auth ...
- 141
2
votes
3
answers
4k
views
How to go into thread function knowing only the thread handle
How do I go into the thread function (so I can do step by step tracing), knowing only the handle to the thread. I am using OllyDbg for tracing and the thread is created through the API ZwCreateProcess(...
- 117
2
votes
1
answer
460
views
change compare function in assembly and .exe stopped working x64dbg
I'm trying to bypass (crack) a very old software that require license in order to unlock all the features
i was digging in the lines with a little bit of knowledge in assembly
and i found the line ...
- 47
2
votes
2
answers
580
views
How to setup VSCode with IDAPython?
Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
- 21
2
votes
1
answer
1k
views
How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?
Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra.
I'm working on several new Modules for Ghidra that will work together. But I've basically ...
- 355
2
votes
1
answer
368
views
How to detect only external-module calls?
I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
- 391
2
votes
1
answer
2k
views
Set QWORD with a constant value in IDA Pro
At line #3 of a function, I have a QWORD at address 7FE875F3FE0 which resolves to a value of 85857490416 for which the function returns true. If not, the value is set to 0.
I would like to know how ...
- 315
2
votes
5
answers
11k
views
IDA PRO + Windows 10 + WinDbg
I didn't know That we've got a Reverse Engineering community around here :D
I am very glad on that....
anyway...
I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time.
I am ...
- 131
2
votes
2
answers
409
views
Radare2 doesn't update current address, when single-step debugging using `ds`?
Radare2 doesn't update current address, when single-step debugging using ds?
I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
- 265
1
vote
1
answer
815
views
How can I change the values in esp?
0x08048785 <+344>: movl $0x0,0xc(%esp)
0x0804878d <+352>: movl $0x804896c,0x8(%esp)
0x08048795 <+360>: movl $0x8048973,0x4(%esp)
0x0804879d <+368>: movl ...
- 21
1
vote
2
answers
2k
views
How to set breakpoint on C++ symbols?
How to set breakpoint on this C++ symbol?
bp qmgr!TokenHandle::operator-:
Could not resolve error at 'qmgr!TokenHandle::operator-:'
in windbg?
- 121