Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
1
vote
1answer
38 views

Switch between debuggers while paused on a breakpoint

Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
0
votes
0answers
35 views

Debugging kernel modul with IDA

I have shell at linux-arm-embedded and running gdb-server, There is kernel module(ko) that I want to debugging . How can I do that with IDA ?
0
votes
2answers
77 views

kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works

Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes. The first process is winword.exe and the second process is calc.exe The virtual address in the first case ...
0
votes
0answers
17 views

Run ltrace to avoid detection (on a different PID?)

I am trying to run ltrace on this file: ./launcher: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]...
0
votes
1answer
76 views

Why compiler is doing this?

While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
0
votes
0answers
175 views

Windbg vs x64dbg for network analysis

I have a program that I want to perform malware analysis on. The program seems to use HTTPs with SSL pinning (my theory) and some other proprietary protocol. I want to understand what is the best tool ...
0
votes
0answers
41 views

Access violation writing location

I am currently playing with C# and detours/trampolines using a library I found here: https://github.com/xcvd/Detours I am attempting to hook a known function in a game and then call the original ...
19
votes
4answers
18k views

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Given a position-independent, statically-linked, stripped binary, there does not appear to be a way in GDB to set a breakpoint at the entry point without disabling ASLR. break start and similar ...
1
vote
0answers
91 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
0
votes
0answers
135 views

SSL pinning and bypass

I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
8
votes
1answer
11k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
-1
votes
3answers
963 views

Proxy debugging tool doesn't capture traffic from some online games

I'm analyzing Android games with Fiddler 2 to see how the game collects data. There is a problem, both Fiddler 2 and Charles Proxy doesn't capture any traffic from some online games. All i got are ads ...
0
votes
1answer
98 views

IDA Unknown Exception Code 6F4

So basically I had set a breakpoint on a WINAPI function call. When I tried to run the program and step over the breakpoint, the program exits with the popup window: unknown exception code 6F4 (exc....
2
votes
0answers
1k views

Bypassing Enigma loader

Currently I'm trying to get past Enigma's loader, which asks you for a name & key, as an excercise. I have very little progress, as I haven't worked too much with packers. What I did was ...
0
votes
0answers
16 views

Load an IDB file when debugging kernel to get the function names in IDA?

I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files. Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded ...
0
votes
0answers
28 views

How to pause a kernel debugee instead of stopping in IDA pro?

While debugging windows kernel with IDA, the problem is i cannot pause it like Windbg, when its running and i click on suspend, 50% of times it just freezes/crashes, and other times it just gets stuck ...
0
votes
1answer
118 views

Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?

I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
0
votes
0answers
58 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
1
vote
2answers
102 views

Why eax is assigned to 'variable looked' like addresses

#include <stdio.h> int main() { int number1, number2, sum; printf("Enter two integers: "); scanf("%d %d", &number1, &number2); sum = number1 + ...
2
votes
2answers
79 views

How to test and debug x86 Assembly exceptions in NASM?

I have seen all the exception "IDs" in the Intel Manuals, and just came across sandpile's exception guide, which actually shows some hexcodes. For example, "divide by zero error": ...
1
vote
2answers
213 views

Issue with debugger - black screen and freeeze after loading game executable

I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
1
vote
1answer
426 views

With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?

I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra. I'...
5
votes
1answer
182 views

WinDBG Hung on Shellcode Execution

I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
2
votes
1answer
232 views

How to debug an application (exe) freeze and crash?

I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
2
votes
0answers
36 views

QEMU with GDB: Stepping Instruction causes Windows VM BSOD

I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing. I have ...
2
votes
1answer
188 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
1
vote
1answer
620 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
1
vote
1answer
211 views

How to let SIGTRAP get caught by sighandler in GDB?

I have a program that I am trying to reverse, which contains an int3 (0xCC) which emits a SIGTRAP signal, which is then handled by a sighandler defined in sigaction. The handler performs calculations ...
2
votes
3answers
188 views

Where Can I Get .PDB files for Windows OS Components?

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
0
votes
1answer
56 views

Is it possible for a process to debug itself?

What happens if you try to debug yourself ? I mean, does the process crash ? If it is possible, how would you implement it ? I have tried launching x64dbg and I can't attach to my own x64dbg process. ...
0
votes
0answers
57 views

How to use aarch64 call convention to understand an unknown function?

I’m trying to reverse engineer an aarch64 Golang binary which happens to call a symbol, i.e., function named guess_me which is an import. To stop the binary from throwing errors, I write a Hello World!...
1
vote
1answer
78 views

how can ı debug encrypted dll with x32dbg and look getregistery request

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point. I can bypass ...
0
votes
0answers
296 views

Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container

My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using sudo docker ...
0
votes
0answers
46 views

Use IDAPython to automatically attach to a remote GDB server

I would like to automate the process of connecting to a remote debug server. The following code worked for the remote win32 debugger: from ida_dbg import * set_remote_debugger(addr, port) ...
0
votes
0answers
91 views

How to debug a shared library with radare2?

I am currently trying to pick up radare2 but I am struggling on a little hurdle.. I am given a shared library, let's call it shared.so. I managed to perform some static analysis using $ r2 shared.so ...
1
vote
1answer
650 views

How can I debug Ghidra plugin Python scripts in IDE?

I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin)...
4
votes
2answers
2k views

Is there a way to import debug/symbol information of a C++ DOS executable to IDA?

I have an old DOS program compiled using Borland C++ (1991 version) The end of the executable contains many strings preceded by an underscore which looks like debug/symbol information : eg: ...
2
votes
1answer
508 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
1
vote
0answers
87 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
1
vote
1answer
238 views

Do all games have static base addresses for values like gold and energy?

I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base ...
0
votes
1answer
40 views

How to run a process with high privileges using remote debugging

I am using remote debugging with IDA. The target and host machine are Windows. I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
0
votes
0answers
37 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0answers
58 views

Unable to debug with Debuggers

I can't debug Screen Recorders on any debugger. I tried every possible way including anti debugging plugins, editing up the instructions but every time I failed. Mostly they land on pushad (which ...
1
vote
1answer
31 views

are address for instructions specified during compilation?

when following certain youtube tutorials, the address in memory for the instructions are same in my machine and the youtuber's machine. How is that possible? Are instructions provided with memory ...
4
votes
0answers
253 views

Trying to identify Renesas custom SoC through CPU die inspection

Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by ...
0
votes
1answer
76 views

Append to environment variable in LLDB

It is relatively easy to set environment variables in LLDB, via settings set target.env-vars DEBUG=1 However, I can't seem to find a way to append to an environment variable. The following doesn't ...
1
vote
0answers
54 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
1
vote
2answers
469 views

IDA PRO - compare running process

I have a software which writes some data to specific location in memory depending on user choices. Say i can have 2 choices, A & B. I want to run IDA, set option A and save all the data, then run ...
0
votes
0answers
84 views

capture traffic of an android app

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
1
vote
2answers
3k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.

1
2
3 4 5
11