Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
568
questions
32
votes
4
answers
14k
views
How to reverse engineer a Windows 10 UWP app?
I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10:
Somehow the results are not the same what is available via ...
- 1,295
28
votes
4
answers
39k
views
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf:
myelf: ELF 32-bit ...
- 455
27
votes
8
answers
47k
views
Decompiling a 1990 DOS application
I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
- 549
19
votes
4
answers
21k
views
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR.
break start and similar ...
- 2,279
18
votes
1
answer
4k
views
Debugging with radare2 using two terminals
I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:
I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
- 1,043
17
votes
1
answer
36k
views
How to debug the DLL of an EXE using IDA Pro?
I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge.
Currently, I'm trying to reverse a ...
- 315
13
votes
2
answers
3k
views
How can I find the source of a string in an old DOS game?
I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players.
In the past it hasn't been too hard to pull off such a task on post-DOS games ...
user11826
12
votes
2
answers
15k
views
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
My ...
- 123
12
votes
3
answers
849
views
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
- 221
11
votes
1
answer
12k
views
What is the difference between step into and step over when debugging?
I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
- 385
10
votes
3
answers
9k
views
Jump back to the caller
I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app.
I load the exe from file menu with input arguments
Set breakpoint on msvcr71.printf function
After this ...
- 101
10
votes
1
answer
897
views
Static analysis data combined with dynamic analysis knowledge
What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
- 1,908
9
votes
3
answers
22k
views
x64dbg how to debug a DLL called from an application
I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
- 311
9
votes
2
answers
1k
views
Open-source equivalent for FLIRT
I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.
Right now, the only way I can do that is to use IDA's FLIRT (...
- 337
8
votes
3
answers
6k
views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
- 181
8
votes
1
answer
4k
views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
- 263
8
votes
1
answer
10k
views
How to debug DLL imported from an application?
I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
- 177
8
votes
1
answer
2k
views
GDB via JTAG on ARM Hardware target without source code
Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested.
Update: ...
- 81
7
votes
2
answers
755
views
Trace assisted code identification?
I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists.
I'd like to find a specific part of code in the binary. Searching for ...
- 1,022
7
votes
3
answers
6k
views
windows kernel debugging on Mac host (using VMware fusion)
in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD.
now the question is, is there any possibility of doing ...
- 551
7
votes
2
answers
1k
views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
- 123
7
votes
1
answer
10k
views
How can I set breakpoint and get value of a register with IDApython
How can I set a breakpoint and get the value of the EAX register with IDApython?
I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
- 73
7
votes
2
answers
3k
views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
- 175
7
votes
1
answer
2k
views
OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?
I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
- 181
7
votes
2
answers
2k
views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
- 1,491
7
votes
1
answer
6k
views
Problem while debugging with gdbserver in IDA Pro
I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
- 818
7
votes
2
answers
337
views
Lego NXT Exploitation and Vulnerabilities?
First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I ...
- 345
7
votes
1
answer
751
views
Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?
Let's say I have lots of breakpoints at some push instructions.
I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + ...
- 71
6
votes
2
answers
5k
views
Break on returning to a specific module
I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
- 1,908
6
votes
1
answer
11k
views
When to use OllyDgb over Immunity Debugger
I have always been curious when I should use OllyDbg over Immunity Debugger.
Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python.
Interestingly enough, ...
- 420
6
votes
1
answer
3k
views
How to get current PHP function name in gdb?
I'm following these steps to locate the current PHP function call as below:
Run dummy script:
$ gdb -ex run --args php -r "sleep(10);"
Pressed Ctrl+C to get back to gdb to run:
(gdb) bt full
#1 ...
- 435
6
votes
1
answer
161
views
ARM debugging interesting behavior
I was just disassembling and debugging an ARM binary for fun and I noticed something unusual. Consider the following set of instructions:-
0x00008058 <+4>: mov r1, pc
0x0000805c <+8>...
user1743
6
votes
1
answer
3k
views
DOS program debug in IDA?
Does anybody know something hack to debug 16bit DOS program in IDA 6.1?
- 63
6
votes
1
answer
2k
views
Is there any way to display the standard input and output of a program to Cutter's console while debugging?
So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how:
Debugging with radare2 using two terminals
i was wondering if i can use rarun2 with ...
- 63
6
votes
1
answer
2k
views
Handling INT 2D anti-debugger technique in IDA Pro
I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging:
CODE:00455050 push ebp
CODE:00455051 mov ebp, esp
CODE:00455053 push ecx
CODE:00455054 push ebx
...
- 225
6
votes
1
answer
2k
views
Calling fgets while debugging under IDA Linux
I have _fgets call in a program I want to debug in IDA. My program receives SIGTTIN while calling it, that's normal. But when I mark to pass SIGTTIN to application, program waits for input in terminal,...
- 161
6
votes
1
answer
4k
views
How to log all memory accesses (read and write) including the memory content in a binary execution trace?
I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
- 1,432
6
votes
1
answer
2k
views
How to know which module am I currently in? (EIP/RIP pointer)
I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode:
What ...
- 1,295
6
votes
0
answers
480
views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
- 173
6
votes
1
answer
2k
views
IDA Pro 6.4 android_server processattach failed
I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
- 61
5
votes
3
answers
3k
views
How to break on not-yet-loaded kernel driver
I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
- 403
5
votes
3
answers
789
views
Any documentation available for r2 other than official book
I am interested in learning and using radare2 as a toolset for reverse engineering. But I want ANY other resource for learning this tools other than radare2 book, preferably a video series. What I am ...
- 335
5
votes
3
answers
11k
views
Kernel debugging - how to set breakpoint at DriverEntry?
I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
- 53
5
votes
1
answer
735
views
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments.
Ideally I would like to ...
- 133
5
votes
2
answers
15k
views
Remote debugging with IDA and GDB
Recently I've run across an ELF file that I would like to debug using IDA. I've used GDB for basic debugging but I would like to utilize IDA. I've been researching for a while and can't seem to find ...
- 51
5
votes
1
answer
1k
views
Why did the program entry point become 'sub esp, 1C'?
I compiled the following C++ code with MinGW and opened it in OllyDbg 2.01. And the program stops at the following lines:
CPU Disasm
Address Hex dump Command ...
- 53
5
votes
3
answers
2k
views
Changing a windows name by patching create window function call
I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
- 51
5
votes
2
answers
1k
views
What is replay debugging?
I've read some info here but looks like the site concerned itself only with vmware and moreover it has abandoned the idea. How can this concept be used with existing debugging environments like IDA ...
- 734
5
votes
1
answer
294
views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
- 345
5
votes
1
answer
1k
views
Are Reverse Debuggers Impossible on OSX?
I have been impressed with the reverse debugging (that is stepping back in time through a program) capabilities in GDB and tools like QIRA, but I am a little confused as to why no such program exists ...
- 1,196