Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
0 votes
0 answers
51 views

Is there a debugger that will trace into ring-0 code?

Is there a debugger these days that will trace beyond a syscall or sysenter into ring-0 code? Or is there a technique using a debugger like Windbg? I have read that if you get close enough to the ...
user avatar
1 vote
1 answer
167 views

Examining memory without attaching to the process by using /proc/$PID/mem?

I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example. #include <stdio.h> #include <unistd.h> ...
user avatar
  • 1,644
3 votes
1 answer
34 views

How to use software watchpoints in LLDB?

After trying to use watch command, LLDB said the device had 0 available hardware watchpoints. In GDB you can use set can-use-hw-watchpoints 0 How do you disable hardware watchpoints in LLDB?
user avatar
  • 144
0 votes
1 answer
13 views

Gdb hardware watchpoint error on android

After failing to find a solution to this I have started using Gdb and have encountered another error. Gdbfails to set hardware watchpoint when I'm remote debugging a rooted arm7-a target. It supports ...
user avatar
  • 144
2 votes
1 answer
51 views

LLDB debugging on android?

I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
user avatar
  • 144
0 votes
1 answer
66 views

Hex editing an IP address of a different length

I am performing some Windows malware research on a rogue AV software called SpySheriff (password: infected). I want to edit the IP address within the PE (.exe) file to change it to my honeypot IP ...
user avatar
0 votes
0 answers
35 views

Finding function called when button is clicked

I am trying to find what function was called from the main application upon the button click in the specific game. In particular, there is a starting UI, where I can select Load option and then click ...
user avatar
  • 146
0 votes
0 answers
34 views

Is it possible to copy a video game and edit the copied version?

Sorry if this is a "dumb" question, but I couldn't find anywhere else to ask this. I want to "copy" my game of Super Smash Bros. Ultimate and edit/change in-game features. I also ...
user avatar
0 votes
0 answers
26 views

Better debug output with IDA

I don't have much knowledge and experience with assembly so I value more or less readable IDA's pseudocode output. I want to examine stack and locals of the specific functions I set breakpoint in, ...
user avatar
  • 33
0 votes
0 answers
24 views

Call function only when check box is checked

Which function is responsible whether the check box is checked or not in disassembler's intermodular calls window?
user avatar
2 votes
1 answer
216 views

Ghidra Debugger not working

When I try to debug one of hackadayu exercises (or any other file) using "debug c1 in dbgeng locally via GADP" I get following errors: Launch failed for {args=/C:/Users/abc/Desktop/...
user avatar
  • 21
1 vote
1 answer
100 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
user avatar
0 votes
1 answer
180 views

Why 0x90 byte is always at top of my file?

Note: Not sure if this kind of question belongs here but as long as this won't fit anywhere else this site is the closest. Back to the topic, I have a python file which I obfuscated it and anytime I ...
user avatar
0 votes
1 answer
106 views

Ghidra: Reading all registers contents at chosen instruction

Remembering all register contents may be exhausting so I would like to find a solution to be able to see all register contents at a chosen instruction in the Listing. I know debuggers got this ...
user avatar
0 votes
0 answers
25 views

Radare2 only printing out the last byte at RSP when using pxq @ rsp

According to documentation, px[?][owq] [len]    hexdump of N bytes (o=octal, w=32bit, q=64bit) and pr[?][glx] [len]    print N raw bytes (in lines or hexblocks, 'g'unzip) These two ...
user avatar
1 vote
0 answers
20 views

How to make the default stack width/offset 8 bytes when debgging in radare2

If you start radare2 in debugging mode like: r2 -d /usr/bin you'll be prompted with something similar to: If you press V for the prompt, you get debugging view with panels. Then, if you select the ...
user avatar
0 votes
1 answer
44 views

How to determine the data type of a register

I'm learning reverse engineering and I'm trying to understand what process people use to identify a variable type. For example, I'm looking at an argument being passed to a function and I'm trying to ...
user avatar
0 votes
1 answer
77 views

Wrong relocations on programs requiring DOS/4G (or DOS/32) 32-bit extender

In the last week I've attempted maybe 3 times to debug a game in DOSBox (Fallout 1 DOS version), and the game uses DOS/4G to extend itself to 32-bit protected mode. The program has a DOS stub which ...
user avatar
  • 156
0 votes
0 answers
49 views

Which encryption returns 192 hash value it means 96 in bytes?

I am reversing an APK and there is a signature that needs to be found. The function from where the signature is generated is present in the .so file. I did small debugging. While doing it, the ...
user avatar
0 votes
0 answers
30 views

IDA debugger register string pointer in conditional breakpoints

When debugging in IDA, it’s possible to use an IDC script as the breakpoint condition. I want to break if EAX points to a null terminated string which contains “substring”. I can’t seem to find a ...
user avatar
0 votes
0 answers
16 views

Print CMarkupSTL object with GDB

CMarkupSTL is contain XML. How can I print that XML with GDB while I debug process? I run on Arm Linux
user avatar
0 votes
0 answers
118 views

How to resolve illegal instruction for this ARM stack exploitation?

Summary I am trying to write a stack overflow exploit for ARM Cortex-A72 running Raspberry Pi OS (32-bit). Because of my choice of OS, I am restricted to the ARMv7 (32-bit) instruction set. I have ...
user avatar
0 votes
1 answer
72 views

help me to debug file packed with molebox and proteced with obsidium

I have a exe file that packed with molebox and protected with obsidium. I try to unpack it with demoleition but it has some problem. when I want to open the unpacked file it says "Component '...
user avatar
  • 1
2 votes
0 answers
77 views

Strange exception thrown while debugging in Win10, but not Win7

I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
user avatar
1 vote
0 answers
70 views

IDA tracing not working

I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called. I have tried to use IDA Tracing, but it doesn't print to file.
user avatar
  • 173
1 vote
0 answers
25 views

Using rbreak without import functions

While debugging with GDB I want to break for each function and print the PC register. rbreak . define hook-stop i r $PC c end The problem is that is stop on functions that imported like printf ...
user avatar
1 vote
1 answer
50 views

How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]

I have this class with constructor offsets and attributes: public class example { // Fields public float Attribute_1 = 1.5f; // 0x8 public int Attribute_2 = 102 ; // 0xC // RVA: ...
user avatar
  • 21
1 vote
0 answers
60 views

Counting how many times a function is called

I want to change context (Rdx, Rax etc.) everytime a specific function gets called. My solution: I seted up a breakpoint at function event.get_thread().set_context({"Rdx" : "bla bla&...
user avatar
1 vote
0 answers
47 views

Scraping data from an audio analyzer application

Briefly: I have an app that analyzes audio files and classifies them into 4 or 5 categories, how would one go about scraping the category each audio file belongs to? What is a good place to start? ...
user avatar
1 vote
0 answers
165 views

Brother DCP-L2550DW Identify Toner Reset TN-760 or TN-730 (Continued)

I'm really continuing discussion on a previous question posed 2 years ago ("Identifying a toner chip and its communication protocol to re-program it"). I found that user to have the most ...
user avatar
  • 11
0 votes
0 answers
131 views

How to debug a .NET windows service: "Cannot start service from the command line or a debugger"

I have a .NET windows service which I can stop and run through Process Hacker. I can also view it's code with dnSPY. I tried to debug it without a success by trying to attach to the process. I wanted ...
user avatar
  • 451
2 votes
1 answer
266 views

Debug shared library in Android application

There is an Android application that has a shared library (.so) file in split_config.arm64_v8a.apk that I want to debug . When I look at /proc/PID/maps I don't see that library (I do see the ...
user avatar
  • 23
0 votes
2 answers
155 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
user avatar
  • 49
1 vote
1 answer
36 views

Adding ltrace information to gdb

I'd like to run gdb (or gdb-peda) with ltrace like info on each syscall. How can I do that? I know that, as per ltrace and gdb attach to same process , you can't actually attach ltrace and gdb to the ...
user avatar
1 vote
1 answer
187 views

How can I find out the size of heap allocations?

While I debug with GDB I see the address of a buffer that's located on the heap. How can I know what is the size of this buffer? Or where (in the code) this buffer was originally allocated? When I ...
user avatar
1 vote
1 answer
119 views

Connect remotely with GDBSERVER to pid

When I run gdbserver to listen for port and connect remotely with gdb: Gdbserver command: gdbserver --multi 0.0.0.0:4444 Gdb command: target remote 192.168.1.99 4444 In gdb . How can I connect to pid ...
user avatar
  • 11
0 votes
0 answers
116 views

How to decrypt/decode the strings found in desktop application with x64dbg?

I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
user avatar
0 votes
1 answer
84 views

PEDA: Don't show context

gdb-peda shows a very useful context each time it stops (b, si, etc.), but sometimes I don't want it. Is there any way to quiet it so it won't show the context automatically (unless prompted context)?...
user avatar
0 votes
0 answers
135 views

Remote debugging with Binary Ninja on Windows possible?

Quick background -- I cannot start the .exe from a debugger; I need to attach after the fact. Binary Ninja's debugging plugin only allows attaching to a remote debug server and not a process. The ...
user avatar
  • 101
1 vote
1 answer
385 views

How to debug a .net DLL?

I'm trying to reverse engineer a .net malicious EXE but it loads a DLL inside its memory. I have tried to debug this DLL using a tool called SharpDllLoader and dnspy but I have 2 issues: First one: (...
user avatar
  • 35
0 votes
0 answers
111 views

Trying to debug with IDA Pro + Windbg on remote VM: It won't break or step

I'm new to remote debugging so plz bare with me. I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is ...
user avatar
  • 51
0 votes
0 answers
61 views

IDA + Windbg does not break on sxe commands

I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running ...
user avatar
  • 51
2 votes
1 answer
714 views

How to get offset of specific function in exe?

Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
user avatar
  • 23
0 votes
0 answers
53 views

Memory Viewer/Debugger for VBA

I'm trying to understand the layout of VBA code in memory, how COM objects are structured, what VBA functions look like under the hood etc. I want something like this: I.e. a GUI that has some of the ...
user avatar
  • 101
0 votes
0 answers
40 views

is it possible to get code out of chipset through reverse engineering?

for example, encryption/decryption mechanism was inbuilt in a chip, to get the code that performs this mechanisms, is there some ways you can get this code through reverse engineering? what tools and ...
user avatar
  • 179
1 vote
2 answers
686 views

How to debug / analyze a Themida protected binary

Background: I have an application that has worked fine up until Windows 10 build 1511 but broke as of build 1607. It produces an access violation: STACK_TEXT: 03799f54 00f91cfa 24d1ae78 0000000f ...
user avatar
  • 2,918
2 votes
1 answer
108 views

Debugging Native Lib using IDA Pro Fails to Load Registers and other Information

Currently, I am debugging a native library in a test APK, however I am running into issues. First of all, I can connect to the debugger and attach to the process without any issues. In the first image ...
user avatar
  • 121
0 votes
0 answers
85 views

How can I find out where relocated functions are in a Win16 executable in SoftICE?

Backstory: I'm poking through SimTower for Windows to discover the actual logic for how it decides how much alternative background is used for the SimTower lobby floors (the ones with the green ...
user avatar
  • 101
1 vote
1 answer
71 views

print format in radare2 cannot output all my string

I was doing a CTF challenge and I need to see the value of RAX register in radare2. I first dumped all of printable ascii characters as input, one of the function encoded the input and spit out the ...
user avatar
1 vote
0 answers
53 views

'... Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript

I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error Unable to get property 'Debugger' of undefined or null reference. Line was simply var ctl = host....
user avatar

1
2 3 4 5
12