Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Immunity Debugger Trace of Vulnerable Application

I'm trying to trace a vulnerable application while it is being exploited. I'm testing it on the application and exploit pair found at (https://www.exploit-db.com/exploits/36826). the exploit works ...
user avatar
  • 1
1 vote
1 answer
147 views

IDA Pro Debbuger is debugging the original code and not the patched code

Using IDA Pro, I tried to patch int 2Dh to nop. However, with the debugger, it seems that the original code is being loaded. What may be the reason for that? This might be related for some protections?...
user avatar
0 votes
0 answers
63 views

How to debug an unknown Tricore binary

I want to analyze a binary from a automotive ECU with an Infineon TC1797 Tricore processor. I can load it in Ghidra, and have analyzed and reverse-engineered a bit of code at the starting address. I ...
user avatar
  • 1
1 vote
1 answer
88 views

Debug bFLT in qemu-arm-static

I have bFLT binary (into linux-arm arch.) that I can run with qemu-arm-static . I want to debug that binary dynamically with GDB. I know I can debug binary with qemu like qemu-arm-static -g 1111 <...
user avatar
1 vote
1 answer
146 views

Mono.Cecil throws SymbolsNotMatchingException, how to find out Method line number?

I tried to use a PDB file to map the Instructions to the Sequencepoints in Mono.Cecil and find out the line number of a method. But none of the answers in any forum seems to work, because no matter ...
user avatar
1 vote
2 answers
249 views

Why IDA debugger on android doesn't show all threads?

My IDA Version is IDA Pro 7.5 SP2. And I'm trying to debug a .so file inside a .apk file. Here's what I've done: download a x86_64 system image android emulator from android studio install that .apk ...
user avatar
0 votes
0 answers
152 views

Bypass Javascript Debug Prevention in Firefox

I've looked around, and can't find an answer for my specific question. The closest I could find was this. I'm trying to reverse engineer some suspicious Javascript, but it repeatedly calls a debugger ...
user avatar
  • 1
1 vote
0 answers
37 views

Can i follow the invoke function?

im trying to debug some C# app. Flow: main -> load dll into mem -> main invoke some function (i want to be here after invoke called). Im using dnspy.
user avatar
1 vote
1 answer
111 views

Is there a way to attach x86dbg with ida pro?

IDA has the option to use debuggers but the debuggers are quite limited. Is there a way that I can use to use x86dbg with IDA Pro?
user avatar
  • 25
1 vote
1 answer
75 views

Kernel debug two physical MacBook pro devices

I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?): I'm trying to kernel debug a physical Macbook pro device. When my setup ...
user avatar
  • 638
0 votes
2 answers
202 views

Get Zip password used by application

I bought a game, "They are billions", and I'm trying to edit a savegame on my singleplayer campaign to change some vars (cheating because im very bad player). But the file is a password ...
user avatar
  • 13
1 vote
1 answer
218 views

How to load modules symbols to IDA while debugging a process

I am debugging a program that I compiled. This program calls SetWindowTextW. When I am debugging it with IDA I can step into this function, but it doesn't recognize anything there: If I will load ...
user avatar
  • 451
0 votes
0 answers
108 views

Why rundll32.exe could be loading a DLL multiple times?

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason. Most of the time I use ...
user avatar
1 vote
1 answer
131 views

Reverse engineer sticky notes to allow external script to open new notes

For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse ...
user avatar
2 votes
2 answers
154 views

Changing value of parameter with gdb

I have a file named exploit.c inside which: #include <stdbool.h> #include <stdio.h> const char y1 = 'a'; const char y2 = 'b'; const char y3 = 'x'; const char y4 = 'y'; const char y5 = 'i';...
user avatar
1 vote
1 answer
67 views

analyze how data is read in android usb device

I've a huawei envizion 360, which doesn't provide any API for other application. But I want to read raw data from this device, to an android or to a raspberry-pi for debugging and development purpose. ...
user avatar
0 votes
1 answer
62 views

Program goes to suspend when buffer overflow occurs

Full disclosure: I am seeking help to complete a college assignment. I am seeking help on steps where I am stuck and unable to move forward, not a ready made answer. I need to exploit it to get a ...
user avatar
0 votes
0 answers
160 views

Debug multithreaded program in X32dbg

I am still quite inexperienced in reverse engineering. I have a small program that establishes an HTTP connection to a server and send data via POST method to the servert. I see strings like Winhttp....
user avatar
  • 1
0 votes
1 answer
76 views

How much of the kernel does remote kernel debugging allow you to debug?

This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have. What ...
user avatar
0 votes
1 answer
83 views

What does "???" mean in x32dbg?

I see such things but I just couldn't understand. Do you have any ideas? Thank you!
user avatar
1 vote
1 answer
55 views

Switch between debuggers while paused on a breakpoint

Is it possible to switch between debuggers and preserve where you are paused? Often times I find myself wanting to use a feature from a different debugger while paused in a specific context as each of ...
user avatar
2 votes
1 answer
278 views

GDB inserting breakpoint cause Segmentation Fault

I was trying to play around with gdb, and I'm especially interest in seeing how the Procedural Linkage Table(PLT) and the Global Offset Table (GOT) interact with each other. So I set some breakpoints ...
user avatar
0 votes
2 answers
144 views

kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works

Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes. The first process is winword.exe and the second process is calc.exe The virtual address in the first case ...
user avatar
1 vote
2 answers
185 views

Run ltrace to avoid detection (on a different PID?)

I am trying to run ltrace on this file: ./launcher: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]...
user avatar
0 votes
0 answers
384 views

SSL pinning and bypass

I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I ...
user avatar
0 votes
1 answer
808 views

Program prevents x64dbg from starting or kills it if it's already running. What to do?

I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows. It looks like the program has some sort of anti-debug protection. I have the following behavior: ...
user avatar
  • 1
1 vote
1 answer
284 views

IDA Unknown Exception Code 6F4

So basically I had set a breakpoint on a WINAPI function call. When I tried to run the program and step over the breakpoint, the program exits with the popup window: unknown exception code 6F4 (exc....
user avatar
  • 11
0 votes
1 answer
89 views

Why compiler is doing this?

While I was disassembling my own C code for practice I saw an interesting point which I want to share with you guys and needs to know the answer as I always get from here. Now, the interesting point ...
user avatar
0 votes
0 answers
22 views

Load an IDB file when debugging kernel to get the function names in IDA?

I am debugging a windows kernel, and i have already analyzed some modules and have their IDB files. Now is there anyway that i can somehow "map" these IDB files to their corresponding loaded ...
user avatar
0 votes
1 answer
295 views

Difference between \n, \0, \x00 and data from /dev/zero when performing a buffer overflow?

I am working with a binary that involves a buffer overflow on two contiguous memory blocks allocated with malloc. The binary filles up the first buffer with whatever the user inputs and hardcodes the ...
user avatar
0 votes
0 answers
183 views

Using GDB to find the address of a buffer in a stripped C binary

I am working with a crackmes binary called Simple Overflow. It has two buffers with sizes 0x10 and 0x8, and it uses malloc to allocate two contiguous memory blocks (see <+25> and <+39> on ...
user avatar
1 vote
2 answers
115 views

Why eax is assigned to 'variable looked' like addresses

#include <stdio.h> int main() { int number1, number2, sum; printf("Enter two integers: "); scanf("%d %d", &number1, &number2); sum = number1 + ...
user avatar
2 votes
2 answers
176 views

How to test and debug x86 Assembly exceptions in NASM?

I have seen all the exception "IDs" in the Intel Manuals, and just came across sandpile's exception guide, which actually shows some hexcodes. For example, "divide by zero error": ...
user avatar
  • 153
1 vote
1 answer
807 views

Debug 3rd-party apk with .so-files missing debug symbols

Apologies, if this has been asked before. I am reverse engineering a chinese app that connects to a BLE device, so I can inspect how it transmits the data. Using this official guide I decompiled my ...
user avatar
2 votes
1 answer
471 views

How to debug an application (exe) freeze and crash?

I have an app (and I don't know the source code), that freeze and crash everytime it loses focus (but the music continue). I've tried to debug it using windbg but it doesn't change anything, and I don'...
user avatar
2 votes
0 answers
93 views

QEMU with GDB: Stepping Instruction causes Windows VM BSOD

I'm currently analyzing a piece of software inside a Windows 10 QEMU virtual machine which is connected to a remote GDB debugger. I have set breakpoints to audit what the application is doing. I have ...
user avatar
1 vote
1 answer
1k views

With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?

I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra. I'...
user avatar
  • 123
5 votes
1 answer
294 views

WinDBG Hung on Shellcode Execution

I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
user avatar
2 votes
1 answer
247 views

The Knowledge of Compiler for becoming a good Reverser

I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
user avatar
1 vote
1 answer
684 views

How to let SIGTRAP get caught by sighandler in GDB?

I have a program that I am trying to reverse, which contains an int3 (0xCC) which emits a SIGTRAP signal, which is then handled by a sighandler defined in sigaction. The handler performs calculations ...
user avatar
2 votes
3 answers
454 views

Where Can I Get .PDB files for Windows OS Components?

I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
user avatar
0 votes
1 answer
85 views

Is it possible for a process to debug itself?

What happens if you try to debug yourself ? I mean, does the process crash ? If it is possible, how would you implement it ? I have tried launching x64dbg and I can't attach to my own x64dbg process. ...
user avatar
1 vote
1 answer
254 views

how can ı debug encrypted dll with x32dbg and look getregistery request

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point. I can bypass ...
user avatar
0 votes
0 answers
445 views

Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container

My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using sudo docker ...
user avatar
  • 257
1 vote
1 answer
354 views

Analyse structure from memory dump

I'm trying to extract master key from OpenSSL 1.0.2l (statically linked without debug symbols). I'm using x64dbg, I was able to locate int SSL_connect(SSL *s) method, so I have a breakpoint there (the ...
user avatar
  • 111
1 vote
1 answer
1k views

How can I debug Ghidra plugin Python scripts in IDE?

I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin)...
user avatar
  • 13
1 vote
0 answers
138 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
user avatar
  • 11
0 votes
3 answers
566 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
user avatar
  • 451
0 votes
1 answer
72 views

How to run a process with high privileges using remote debugging

I am using remote debugging with IDA. The target and host machine are Windows. I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
user avatar
  • 451
0 votes
0 answers
51 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
user avatar

1
2
3 4 5
12