Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
540
questions
31
votes
4answers
13k views
How to reverse engineer a Windows 10 UWP app?
I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10:
Somehow the results are not the same what is available via ...
28
votes
4answers
38k views
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
as i'm new about cross-debugging and cross-compilation i need some help because i feel so confused. I have a MIPS elf file, [myelf][1] .You can see bellow the output of file myelf:
myelf: ELF 32-bit ...
27
votes
8answers
44k views
Decompiling a 1990 DOS application
I have some crucial data written decades ago by an ancient 16bit DOS application. There are no docs, no source, and no information about the author. Just the 16 bit exe. I guess it's time for me to ...
19
votes
4answers
18k views
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR.
break start and similar ...
17
votes
1answer
4k views
Debugging with radare2 using two terminals
I have been trying to figure this out for quite some time now, and would really need some help. Firstly, some intro:
I am running the newest version of radare2 from Github on a 64bit Ubuntu 16.04 and ...
14
votes
1answer
33k views
How to debug the DLL of an EXE using IDA Pro?
I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge.
Currently, I'm trying to reverse a ...
13
votes
2answers
2k views
How can I find the source of a string in an old DOS game?
I am attempting to amend some strings in an old DOS game (FIFA International Soccer), specifically the names of players.
In the past it hasn't been too hard to pull off such a task on post-DOS games ...
12
votes
2answers
15k views
How to find arrays of objects (entities, enemies) in a game I'm reversing with Cheat Engine?
I am reversing a game using Cheat Engine and OllyDBG, through this memory addresses within an FPS game are read and monitored, these addresses will contain the coordinates(xyz) of enemies.
My ...
12
votes
3answers
804 views
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
10
votes
3answers
8k views
Jump back to the caller
I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app.
I load the exe from file menu with input arguments
Set breakpoint on msvcr71.printf function
After this ...
10
votes
1answer
853 views
Static analysis data combined with dynamic analysis knowledge
What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
9
votes
3answers
20k views
x64dbg how to debug a DLL called from an application
I have a 64 bit application that when runs will load a dll (plugin) I want to debug only this plugin, I have tried setting x64dbg to break on dll load, but two issues, this app loads hundreds of other ...
9
votes
2answers
1k views
Open-source equivalent for FLIRT
I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.
Right now, the only way I can do that is to use IDA's FLIRT (...
8
votes
3answers
6k views
Is there any tool to visually see program stack in linux while debugging?
By stack I mean the location where local variable, return address etc are stored. Which is pointed to by the esp and ebp.
8
votes
1answer
4k views
How to investigate Windows 32/64bit (WOW64) transition
There is surprisingly little information about Windows WOW64 mechanism.
I'm trying to investigate it.
So when we have system call in 32-land, it calls an address that is stored in FS, which leads us ...
8
votes
1answer
10k views
How to debug DLL imported from an application?
I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
8
votes
1answer
11k views
What is the difference between step into and step over when debugging?
I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
8
votes
1answer
2k views
GDB via JTAG on ARM Hardware target without source code
Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested.
Update: ...
7
votes
2answers
701 views
Trace assisted code identification?
I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists.
I'd like to find a specific part of code in the binary. Searching for ...
7
votes
3answers
5k views
windows kernel debugging on Mac host (using VMware fusion)
in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD.
now the question is, is there any possibility of doing ...
7
votes
2answers
1k views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
7
votes
2answers
3k views
How to deal with Static Memory Allocation while modifying an executable?
I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P
At present I'm dealing with an executable that I would like to modify a little bit, for ...
7
votes
1answer
2k views
OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?
I know how to set conditional breakpoints on a register, but how can I have a breakpoint trigger if a specific value (say, 0x12345678) appears anywhere in the active call stack frame?
7
votes
2answers
2k views
"Debugged application has modified the debugging registers" with ollydbg 2.01
I have the following problem. When I open a sample with ollydbg v2.01, then I get that message here:
Debugged application has modified the debugging registers.
Maybe it called ZwContinue() or ...
7
votes
1answer
6k views
Problem while debugging with gdbserver in IDA Pro
I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
7
votes
2answers
321 views
Lego NXT Exploitation and Vulnerabilities?
First, I wasn't sure if I should post this on the Lego Stack Exchange site or here, and I decided this site had more to do with the question (I hope I don't get bad rep for this). OK, my friends and I ...
7
votes
1answer
729 views
Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?
Let's say I have lots of breakpoints at some push instructions.
I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + ...
6
votes
2answers
4k views
Break on returning to a specific module
I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
6
votes
1answer
3k views
How to get current PHP function name in gdb?
I'm following these steps to locate the current PHP function call as below:
Run dummy script:
$ gdb -ex run --args php -r "sleep(10);"
Pressed Ctrl+C to get back to gdb to run:
(gdb) bt full
#1 ...
6
votes
1answer
156 views
ARM debugging interesting behavior
I was just disassembling and debugging an ARM binary for fun and I noticed something unusual. Consider the following set of instructions:-
0x00008058 <+4>: mov r1, pc
0x0000805c <+8>...
6
votes
1answer
10k views
How can I set breakpoint and get value of a register with IDApython
How can I set a breakpoint and get the value of the EAX register with IDApython?
I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
6
votes
1answer
2k views
Is there any way to display the standard input and output of a program to Cutter's console while debugging?
So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how:
Debugging with radare2 using two terminals
i was wondering if i can use rarun2 with ...
6
votes
1answer
2k views
Handling INT 2D anti-debugger technique in IDA Pro
I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging:
CODE:00455050 push ebp
CODE:00455051 mov ebp, esp
CODE:00455053 push ecx
CODE:00455054 push ebx
...
6
votes
1answer
2k views
Calling fgets while debugging under IDA Linux
I have _fgets call in a program I want to debug in IDA. My program receives SIGTTIN while calling it, that's normal. But when I mark to pass SIGTTIN to application, program waits for input in terminal,...
6
votes
1answer
2k views
How to know which module am I currently in? (EIP/RIP pointer)
I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode:
What ...
6
votes
0answers
418 views
Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?
How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful.
I ...
6
votes
1answer
2k views
IDA Pro 6.4 android_server processattach failed
I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
5
votes
3answers
3k views
How to break on not-yet-loaded kernel driver
I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
5
votes
3answers
773 views
Any documentation available for r2 other than official book
I am interested in learning and using radare2 as a toolset for reverse engineering. But I want ANY other resource for learning this tools other than radare2 book, preferably a video series. What I am ...
5
votes
1answer
10k views
When to use OllyDgb over Immunity Debugger
I have always been curious when I should use OllyDbg over Immunity Debugger.
Immunity Debugger has inherited code from OllyDbg and can perform scripted debugging with Python.
Interestingly enough, ...
5
votes
1answer
664 views
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments.
Ideally I would like to ...
5
votes
1answer
3k views
5
votes
2answers
15k views
Remote debugging with IDA and GDB
Recently I've run across an ELF file that I would like to debug using IDA. I've used GDB for basic debugging but I would like to utilize IDA. I've been researching for a while and can't seem to find ...
5
votes
3answers
1k views
Changing a windows name by patching create window function call
I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
5
votes
2answers
1k views
What is replay debugging?
I've read some info here but looks like the site concerned itself only with vmware and moreover it has abandoned the idea. How can this concept be used with existing debugging environments like IDA ...
5
votes
1answer
196 views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
5
votes
1answer
4k views
How to log all memory accesses (read and write) including the memory content in a binary execution trace?
I would like to create an execution trace of a binary. To be precise, I would like to record every executed assembly instruction, together with possible memory accesses. By memory accesses I mean ...
5
votes
1answer
1k views
Are Reverse Debuggers Impossible on OSX?
I have been impressed with the reverse debugging (that is stepping back in time through a program) capabilities in GDB and tools like QIRA, but I am a little confused as to why no such program exists ...
5
votes
1answer
2k views
Using a VMM/hypervisor to monitor guest OS execution?
I would like to set up a virtual machine monitor using Microsoft Hyper-V, VMware vSphere/ESX, Xen, or any other alternative hypervisor solution that is able to monitor the execution of a guest OS (a ...
5
votes
1answer
746 views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
