Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
51
questions
7
votes
2answers
682 views
Trace assisted code identification?
I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists.
I'd like to find a specific part of code in the binary. Searching for ...
17
votes
1answer
4k views
Debugging with radare2 using two terminals
I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:
I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
18
votes
4answers
18k views
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR.
break start and similar ...
12
votes
2answers
14k views
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
My ...
9
votes
3answers
19k views
x64dbg how to debug a DLL called from an application
I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
2
votes
2answers
1k views
IDA pro: jump back to previous instruction
I'm new with IDA pro and currently running with debugger, I have few questions:
How can I jump on previous instruction? Undo the latest instruction ?
Is it possible in IDA to examine memory of an ...
31
votes
4answers
12k views
How to reverse engineer a Windows 10 UWP app?
I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10:
Somehow the results are not the same what is available via ...
27
votes
4answers
37k views
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf:
myelf: ELF 32-bit ...
27
votes
8answers
42k views
Decompiling a 1990 DOS application
I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
4
votes
3answers
4k views
Does IDA support remote debugging in their Freeware Version?
I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
3
votes
1answer
12k views
how to setup IDA pro linux GDB server
I have Ubuntu 14.04 x64 and I am running Ida pro V6.6 in virtual box in windows 8 ... currently I want to debug some Linux elf's using Ida either via IDA linux remote server or gdbserver but I don't ...
2
votes
3answers
601 views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
5
votes
1answer
684 views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
2
votes
1answer
3k views
IDA Pro debugging: follow child process
I'm reverse engineering a malware that creates a number of child processes and I'm trying to do dynamic analysis of the ELF binary with IDA Pro and IDA's Local Linux Debugger, but I can't get IDA to ...
1
vote
1answer
773 views
ESP out of range of “Stack View” in IDA
A very similar (or exact) question was asked here, though it was not answered properly.
I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
8
votes
1answer
4k views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
9
votes
2answers
1k views
Open-source equivalent for FLIRT
I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.
Right now, the only way I can do that is to use IDA's FLIRT (...
8
votes
3answers
5k views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
12
votes
2answers
2k views
How can I find the source of a string in an old DOS game?
I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players.
In the past it hasn't been too hard to pull off such a task on post-DOS games ...
10
votes
3answers
8k views
Jump back to the caller
I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app.
I load the exe from file menu with input arguments
Set breakpoint on msvcr71.printf function
After this ...
7
votes
2answers
3k views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
3
votes
2answers
3k views
lldb: break at start of actual code, not entrypoint
I want lldb to break at the start of the actual code of an OS X application (which might be called main if symbols are existing).
I am currently looking this up by hand, but as I want to script some ...
7
votes
1answer
2k views
OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?
I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
6
votes
1answer
2k views
Handling INT 2D anti-debugger technique in IDA Pro
I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging:
CODE:00455050 push ebp
CODE:00455051 mov ebp, esp
CODE:00455053 push ecx
CODE:00455054 push ebx
...
5
votes
1answer
3k views
3
votes
2answers
2k views
Extracting HTTPS packets before encryption
Say we have a Windows application, which sends some packets over HTTPS. We need to extract the content of this packets (unencrypted of course).
There is no way to get hands on server private ...
3
votes
2answers
2k views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
1
vote
2answers
7k views
How to print from pointers in radare2 in debug session
when I am using the radare2 debugger, it happens that I have sometimes to examine variables and memory. Consider the following instruction
0x08048498 8b4508 mov eax, dword [ebp+arg2]
...
1
vote
1answer
1k views
IDA - Remote debug on linux
I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink).
Because the exploit is via gets() I try to pass input through the "...
1
vote
1answer
899 views
Call Stack vs Intermodular Calls in Ollydbg
What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
1
vote
1answer
941 views
ImpRec invalid thunks seem valid
I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just ...
0
votes
1answer
480 views
Dumpbin: Correlating thunk jumps in .reloc to disassembly
I have an application that I am auditing that runs code from an imported DLL. Said DLL itself has imports. Specifically, during execution there's a point where the following is called (EIP is in said ...
0
votes
1answer
300 views
Seed/Key Constant Value
I am trying to reverse a seed/key algorithm that has a constant value inside it. and there is different const value for different device that use this algorithm.
i can give some sample from each ...
0
votes
1answer
378 views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
0
votes
1answer
345 views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
7
votes
2answers
2k views
“Debugged application has modified the debugging registers” with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
3
votes
1answer
4k views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
3
votes
1answer
313 views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
2
votes
1answer
324 views
change compare function in assembly and .exe stopped working x64dbg
I'm trying to bypass (crack) a very old software that require license in order to unlock all the features
i was digging in the lines with a little bit of knowledge in assembly
and i found the line ...
2
votes
2answers
332 views
Radare2 doesn't update current address, when single-step debugging using `ds`?
Radare2 doesn't update current address, when single-step debugging using ds?
I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
2
votes
1answer
348 views
How to setup VSCode with IDAPython?
Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
2
votes
1answer
436 views
How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?
Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra.
I'm working on several new Modules for Ghidra that will work together. But I've basically ...
2
votes
3answers
4k views
How to go into thread function knowing only the thread handle
How do I go into the thread function (so I can do step by step tracing), knowing only the handle to the thread. I am using OllyDbg for tracing and the thread is created through the API ZwCreateProcess(...
2
votes
4answers
10k views
IDA PRO + Windows 10 + WinDbg
I didn't know That we've got a Reverse Engineering community around here :D
I am very glad on that....
anyway...
I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time.
I am ...
2
votes
1answer
758 views
Analyzing a Login Process
I am reverse engineering a program that uses a custom auth protocol. This is a basic outline of the process:
Client takes input for username and password, then sends username to the auth server.
Auth ...
2
votes
1answer
2k views
Set QWORD with a constant value in IDA Pro
At line #3 of a function, I have a QWORD at address 7FE875F3FE0 which resolves to a value of 85857490416 for which the function returns true. If not, the value is set to 0.
I would like to know how ...
2
votes
1answer
341 views
How to detect only external-module calls?
I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
1
vote
1answer
4k views
Unable to view stack and memory addresses in IDA Pro [duplicate]
I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328
...
1
vote
1answer
725 views
How can I change the values in esp?
0x08048785 <+344>: movl $0x0,0xc(%esp)
0x0804878d <+352>: movl $0x804896c,0x8(%esp)
0x08048795 <+360>: movl $0x8048973,0x4(%esp)
0x0804879d <+368>: movl ...
1
vote
2answers
2k views
How to set breakpoint on C++ symbols?
How to set breakpoint on this C++ symbol?
bp qmgr!TokenHandle::operator-:
Could not resolve error at 'qmgr!TokenHandle::operator-:'
in windbg?
