Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
4
votes
1answer
858 views

Finding execution flow/calls to functions?

I have a binary and I'm interested in an high level overview of how it operates. I was trying to generate a list of functions called during a particular execution, with their hierarchy, for example ...
3
votes
4answers
4k views

How to debug a NSIS installer in order to find where the compressed data is?

NISIS installers compress data using bizp2, lzma or zlib -- I don't know if there are others algorithms--. At some point in the installation process one of those algorithms has to be applied to ...
1
vote
2answers
1k views

Determining the size of an object allocated on the heap

As part of an assignment, dealing with the operation aurora vulnerability, I am supposed to determine the size of C++ classes allocated on the heap. I used: 0:017> !heap -p -a <address of the ...
1
vote
1answer
5k views

Debugging the code executed on a new thread

I would like to step into some code which is ran on a new thread. Luckily, after the initial startup this is the only thread that is newly created in the program. I can set the debugger to break on ...
6
votes
1answer
2k views

Handling INT 2D anti-debugger technique in IDA Pro

I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging: CODE:00455050 push ebp CODE:00455051 mov ebp, esp CODE:00455053 push ecx CODE:00455054 push ebx ...
1
vote
1answer
949 views

ImpRec invalid thunks seem valid

I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just ...
4
votes
1answer
5k views

How to start a DOS application in DOSbox in debug mode?

DOSbox compiled with --enable-debug=heavy option becomes a powerful reversing tool. Anytime I feel like checking the disassembly and memory state I just hit Alt+Pause. But, what if I want to see the ...
4
votes
2answers
2k views

Modifying Control Flow of a running program

I am working on the binary bomb labs and i just disarmed the bomb i am planning on solving it through a debugger and work start to work on my dynamic analysis skills or i.e debugging my real question ...
4
votes
1answer
1k views

Why did the program entry point become 'sub esp, 1C'?

I compiled the following C++ code with MinGW and opened it in OllyDbg 2.01. And the program stops at the following lines: CPU Disasm Address Hex dump Command ...
0
votes
1answer
119 views

Setting up virtual machine to recover from malware

I'm running two virtual machines with Windows 7 (host OS Mac) using Virtualbox which I'd like to use to analyze malware. I have configured Visual Studio debugging and WinDBG, as well as other tools. ...
3
votes
1answer
1k views

Use After Free - Example

Use After Free bugs a getting more severe these days. I'm planning to demonstrate Use After Free bug exploitation using VTable overwrite. So, I'm trying to create a ATL ActiveX Control which is ...
-1
votes
1answer
1k views

How do memory integrity checks work?

How does a memory integrity check work? For example, the .code memory region is scanned by this check and then changes can be detected and the program will return with an event that will exit the ...
3
votes
1answer
1k views

How to remote debug Linux binary from Mac OS X with IDA?

I heard that you can run linux_server on the linux server you wish to debug remotely, but I only see references to Windows on the IDA site. Can we use OS X to remote debug a linux program with IDA? If ...
4
votes
1answer
3k views

Disable ASLR on android 4.0.3

I would like that a shared library is always loaded at the same address on Android 4.0.3. I can't seem to disable the ASLR using: echo 0 > /proc/sys/kernel/randomize_va_space Running cat /proc/...
2
votes
2answers
2k views

Debugging Virtual Machine using Windbg

I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes. I was following the MSDN kernel mode debugging article, however bcdedit ...
3
votes
1answer
4k views

How to edit an executable's ".data" segment?

This is a question related to another question I asked a few days ago; I recommend you to give a quick read to it here because it can contain useful information. Anyway, I have two static classes ...
3
votes
1answer
1k views

Seeing previous register values in ollydbg possible?

I wanted to know if one can see old register values in Ollydbg in the register window. I mean, for example, I have the register value of eax like eax=12345678. And, now, let say that I go to the next ...
5
votes
3answers
3k views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
7
votes
2answers
3k views

How to deal with Static Memory Allocation while modifying an executable?

I'm not new to StackExchange, but I'm quite new to reverse engineering, so please be patient with me! :P At present I'm dealing with an executable that I would like to modify a little bit, for ...
4
votes
1answer
93 views

registers set by function

How can I figure out which general-purpose registers are modified by a function call. I am programming a Win32 Assembly program that calls IsDebuggerPresent(). According to MSDN, it will return a ...
2
votes
1answer
769 views

Trouble with ActiveX Reverseengineering (DispCallFunc Trick does not work)

It is common to set a breakpoint on oleaut32!DispCallFunc to catch the function call to the ActiveX component and it worked for me until recently. I tried to reverse engineer a ActiveX component I got ...
2
votes
1answer
739 views

Find register value of a remote process - pydbg

How can I find the register value of another process at a specific address using python pydbg or any other module that can do that? Lets say that: Address opcode 006122CB ...
2
votes
4answers
850 views

Reverse engineering close sourced JSP applets

I have a web application written in JSP running on a tomcat 6 server that I want to RE. I've decompiled the .jars associated with the web application. The source code is heavily obfuscated, making it ...
1
vote
1answer
265 views

Directed call inside recv

In tracing how the recv function works on Windows, I observe the following trace: ... 0x743817d2 push eax C:\windows\system32\WSOCK32.dll recv 0x743817d3 ...
5
votes
1answer
3k views

DOS program debug in IDA?

Does anybody know something hack to debug 16bit DOS program in IDA 6.1?
7
votes
3answers
5k views

windows kernel debugging on Mac host (using VMware fusion)

in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD. now the question is, is there any possibility of doing ...
-4
votes
1answer
681 views

what is the best debuger for firmware router ? [closed]

down vote favorite i need debugger for firmware router ,i work in security of firmware so when i have firmware for router or other machines but i need to debug this firmware , so i need firmware ...
1
vote
2answers
558 views

How to break on instruction that hasn't been traced yet?

I have some questions regarding IDA and Ollydbg. First, is there a way to create a record with traced instructions and let the debugger automatically break, when it hits an instruction that hasn't ...
2
votes
1answer
1k views

How to extract information from dll compiled in gcc with debug symbols?

I recently read that GCC annotates the source-code into the debug symbols it produces, although I haven't found any examples on how to retrieve this. If this is true, how can I view the data in the ...
6
votes
1answer
156 views

ARM debugging interesting behavior

I was just disassembling and debugging an ARM binary for fun and I noticed something unusual. Consider the following set of instructions:- 0x00008058 <+4>: mov r1, pc 0x0000805c <+8>...
10
votes
1answer
846 views

Static analysis data combined with dynamic analysis knowledge

What I'm doing now is placing an awful lot of comments about function variable values, global variable values as comments in my IDA database, which I find ugly after a while and obviously not a best ...
6
votes
2answers
4k views

Break on returning to a specific module

I'm debugging an application in OllyDbg, I pause the program at a specific place. Now I am deep inside ntdll and other gui related module calls, judging from the stack. I'ld like to break as soon as ...
10
votes
3answers
8k views

Jump back to the caller

I'm debugging some app inside the ollydbg, so this two steps i set to start debugging the app. I load the exe from file menu with input arguments Set breakpoint on msvcr71.printf function After this ...
1
vote
3answers
2k views

Malicious word document shellcode extraction

I am playing with some malicious MS Word documents which exploit a vulnerability in Word 2k3/2k7 to launch the shellcode. I am able to run it dynamically and get the drop-bys. However, I am interested ...
8
votes
1answer
10k views

How to debug DLL imported from an application?

I want to debug a DLL when it is called from an application. For example, when Firefox calls nss3.dll "NSS Builtin Trusted Root CAs" to check HTTPS Certificates, I want to catch the nss3.dll and debug ...
1
vote
2answers
1k views

How to debug Windows Media Player without attach mode?

When I try to debug Windows Media Player and play a movie this error message is shown: Running this process under a debugger while using DRM content is not allowed. But with drmdbg it can debug ...
7
votes
2answers
693 views

Trace assisted code identification?

I'm working on an RE project and had an idea for a tool that would help me greatly and wanted to see if it already exists. I'd like to find a specific part of code in the binary. Searching for ...
3
votes
2answers
1k views

gdb on FreeBSD and follow-fork-mode child

Long time ago I noticed that using set follow-fork-mode child in GDB on FreeBSD doesn't really work. This problem occurs very often with some challenges on various Capture The Flag contests. For ...
5
votes
2answers
15k views

Remote debugging with IDA and GDB

Recently I've run across an ELF file that I would like to debug using IDA. I've used GDB for basic debugging but I would like to utilize IDA. I've been researching for a while and can't seem to find ...

1
7 8 9 10
11