Skip to main content

Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
35 votes
4 answers
17k views

How to reverse engineer a Windows 10 UWP app?

I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10: Somehow the results are not the same what is available via ...
c00000fd's user avatar
  • 1,711
32 votes
9 answers
59k views

Decompiling a 1990 DOS application

I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
ScumCoder's user avatar
  • 609
31 votes
4 answers
44k views

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf: myelf: ELF 32-bit ...
creuchmeuch's user avatar
22 votes
1 answer
45k views

How to debug the DLL of an EXE using IDA Pro?

I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge. Currently, I'm trying to reverse a ...
Pramod Mohandas's user avatar
20 votes
4 answers
27k views

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR. break start and similar ...
Zach Riggle's user avatar
  • 2,357
18 votes
1 answer
5k views

Debugging with radare2 using two terminals

I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro: I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
ubnix's user avatar
  • 1,073
13 votes
2 answers
3k views

How can I find the source of a string in an old DOS game?

I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players. In the past it hasn't been too hard to pull off such a task on post-DOS games ...
user avatar
12 votes
2 answers
16k views

How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?

I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies. My ...
Daniel Filipe's user avatar
12 votes
3 answers
999 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
MikeF's user avatar
  • 221
11 votes
3 answers
9k views

Jump back to the caller

I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app. I load the exe from file menu with input arguments Set breakpoint on msvcr71.printf function After this ...
Igor's user avatar
  • 111
11 votes
3 answers
29k views

x64dbg how to debug a DLL called from an application

I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
Raz Razman's user avatar
11 votes
1 answer
14k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
user avatar
10 votes
1 answer
1k views

Static analysis data combined with dynamic analysis knowledge

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
Dominik Antal's user avatar
10 votes
1 answer
2k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
cyphunk's user avatar
  • 101
9 votes
1 answer
11k views

How to debug DLL imported from an application?

I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
studentofmp's user avatar
9 votes
2 answers
2k views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
Aviv's user avatar
  • 337
8 votes
3 answers
7k views

Is there any tool to visually see program stack in linux while debugging?

By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
pizzaEatingGuy's user avatar
8 votes
1 answer
5k views

How to investigate Windows 32/64bit (WOW64) transition

There is surprisingly little information about Windows WOW64 mechanism. I'm trying to investigate it. So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
Shmuel Fomberg's user avatar
8 votes
2 answers
927 views

Trace assisted code identification?

I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists. I'd like to find a specific part of code in the binary. Searching for ...
mikeazo's user avatar
  • 1,072
8 votes
3 answers
6k views

windows kernel debugging on Mac host (using VMware fusion)

in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD. now the question is, is there any possibility of doing ...
n00b's user avatar
  • 581
8 votes
2 answers
25k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
bernd feinman's user avatar
8 votes
2 answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
Zarathos's user avatar
  • 185
7 votes
1 answer
11k views

When to use OllyDgb over Immunity Debugger

I have always been curious when I should use OllyDbg over Immunity Debugger. Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python. Interestingly enough, ...
itsbriany's user avatar
  • 440
7 votes
2 answers
2k views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
plowsec's user avatar
  • 143
7 votes
1 answer
12k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
user121314's user avatar
7 votes
2 answers
18k views

Remote debugging with IDA and GDB

Recently I've run across an ELF file that I would like to debug using IDA. I've used GDB for basic debugging but I would like to utilize IDA. I've been researching for a while and can't seem to find ...
RE Noob's user avatar
  • 71
7 votes
1 answer
2k views

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
John Blatz's user avatar
7 votes
1 answer
2k views

Calling fgets while debugging under IDA Linux

I have _fgets call in a program I want to debug in IDA. My program receives SIGTTIN while calling it, that's normal. But when I mark to pass SIGTTIN to application, program waits for input in terminal,...
michaeluskov's user avatar
7 votes
2 answers
2k views

"Debugged application has modified the debugging registers" with ollydbg 2.01

I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here: Debugged application has modified the debugging registers. Maybe it called ZwContinue() or ...
user3097712's user avatar
  • 1,541
7 votes
1 answer
7k views

Problem while debugging with gdbserver in IDA Pro

I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
Benny's user avatar
  • 828
7 votes
1 answer
2k views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
SwordWorth's user avatar
7 votes
2 answers
1k views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
Frenchy Fry's user avatar
7 votes
2 answers
375 views

Lego NXT Exploitation and Vulnerabilities?

First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I ...
Starwarsfan2099's user avatar
7 votes
1 answer
797 views

Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?

Let's say I have lots of breakpoints at some push instructions. I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + ...
algotroll's user avatar
7 votes
0 answers
347 views

running iOS debugserver on non-jailbroken devices

There are multiple tutorials on how to debug applications on jailbroken devices. These usually involves resigning debugserver, scp and running it from ssh with few tweaks to the entitlements and ...
3asm_'s user avatar
  • 506
6 votes
2 answers
5k views

Break on returning to a specific module

I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
Dominik Antal's user avatar
6 votes
1 answer
4k views

How to get current PHP function name in gdb?

I'm following these steps to locate the current PHP function call as below: Run dummy script: $ gdb -ex run --args php -r "sleep(10);" Pressed Ctrl+C to get back to gdb to run: (gdb) bt full #1 ...
kenorb's user avatar
  • 505
6 votes
1 answer
166 views

ARM debugging interesting behavior

I was just disassembling and debugging an ARM binary for fun and I noticed something unusual. Consider the following set of instructions:- 0x00008058 <+4>: mov r1, pc 0x0000805c <+8>...
user avatar
6 votes
1 answer
3k views

DOS program debug in IDA?

Does anybody know something hack to debug 16bit DOS program in IDA 6.1?
Dominoman's user avatar
6 votes
1 answer
3k views

Is there any way to display the standard input and output of a program to Cutter's console while debugging?

So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how: Debugging with radare2 using two terminals i was wondering if i can use rarun2 with ...
Alya Gomaa's user avatar
6 votes
1 answer
2k views

Handling INT 2D anti-debugger technique in IDA Pro

I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging: CODE:00455050 push ebp CODE:00455051 mov ebp, esp CODE:00455053 push ecx CODE:00455054 push ebx ...
Ariyan's user avatar
  • 235
6 votes
1 answer
560 views

WinDBG Hung on Shellcode Execution

I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
rustam Shirinov's user avatar
6 votes
1 answer
5k views

How to log all memory accesses (read and write) including the memory content in a binary execution trace?

I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
langlauf.io's user avatar
  • 1,560
6 votes
1 answer
1k views

Are Reverse Debuggers Impossible on OSX?

I have been impressed with the reverse debugging (that is stepping back in time through a program) capabilities in GDB and tools like QIRA, but I am a little confused as to why no such program exists ...
MrSynAckSter's user avatar
  • 1,258
6 votes
1 answer
2k views

How to know which module am I currently in? (EIP/RIP pointer)

I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode: What ...
c00000fd's user avatar
  • 1,711
6 votes
1 answer
1k views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
c00000fd's user avatar
  • 1,711
6 votes
2 answers
3k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
csharpnewbie's user avatar
6 votes
1 answer
608 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
Maniaxx's user avatar
  • 185
5 votes
3 answers
2k views

Faster Kernel debugging for Windows

I am Kernel debugging in Windbg and it's slow , very slow stepping through. My current setup is using VMWARE and Windbg through a com port on the Virtual Machine. Is there a faster way to debug the ...
LUser's user avatar
  • 793
5 votes
3 answers
3k views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
Andrew's user avatar
  • 413

1
2 3 4 5
13