Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
1
vote
1answer
64 views

how can ı debug encrypted dll with x32dbg and look getregistery request

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point. I can bypass ...
0
votes
0answers
262 views

Remote Debugging an Aarch64 ELF File on Multiarch/Qemu-user-static (arm64v8/alpine) Docker Container

My goal is stated in the title. However, I think there is a fundamental issue with gdbserver. In particular, I create an aarch64 alpine docker container on a x86_64 Ubuntu 16.04 host using sudo docker ...
1
vote
1answer
195 views

Analyse structure from memory dump

I'm trying to extract master key from OpenSSL 1.0.2l (statically linked without debug symbols). I'm using x64dbg, I was able to locate int SSL_connect(SSL *s) method, so I have a breakpoint there (the ...
0
votes
0answers
40 views

Use IDAPython to automatically attach to a remote GDB server

I would like to automate the process of connecting to a remote debug server. The following code worked for the remote win32 debugger: from ida_dbg import * set_remote_debugger(addr, port) ...
0
votes
0answers
75 views

How to debug a shared library with radare2?

I am currently trying to pick up radare2 but I am struggling on a little hurdle.. I am given a shared library, let's call it shared.so. I managed to perform some static analysis using $ r2 shared.so ...
1
vote
1answer
602 views

How can I debug Ghidra plugin Python scripts in IDE?

I'd like to debug Ghidra plugin scripts written in python using an IDE such as Eclipse. I have installed Pydev and the GhidraDev plugin (from Ghidra open a script in Eclipse to autoinstall the plugin)...
1
vote
0answers
83 views

Dynamic Analysis with gdb on ELF binaries with no compilation/linking information

I am trying to do some dynamic analysis on a couple of ELF binaries with gdb. However, since those two are directly downloaded (ELF binary file only) with no additional information related to ...
0
votes
3answers
193 views

How to find the address (offset) of specific driver function

I am reversing Capcom driver and in IDA I have this list of functions: I want to set breakpoint on the function sub_10590 but I don't know what is the address of this function when I am doing live ...
0
votes
1answer
39 views

How to run a process with high privileges using remote debugging

I am using remote debugging with IDA. The target and host machine are Windows. I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
0
votes
0answers
36 views

Radare2: Running executable from a specific point

I am using radare2 to reverse engineer a standard crackme executable. I have obtained the password, but now I need use the program to read & print a restricted file to which the executable has ...
0
votes
0answers
58 views

Unable to debug with Debuggers

I can't debug Screen Recorders on any debugger. I tried every possible way including anti debugging plugins, editing up the instructions but every time I failed. Mostly they land on pushad (which ...
1
vote
1answer
512 views

How to open new window of decompiler or resize the decompiler of Ghidra?

This is very small and inconvenient to read. How do i open new Window (any shortcut key) or resize it, for some reason i cant resize. Any help? EDIT: Oh thanks Shane Riley, i clicked the blue button ...
1
vote
1answer
31 views

are address for instructions specified during compilation?

when following certain youtube tutorials, the address in memory for the instructions are same in my machine and the youtuber's machine. How is that possible? Are instructions provided with memory ...
1
vote
0answers
53 views

Ways of creating a new thread on Windows

I'd like to know about every possible way how a thread can be created in a process at the lowest possible level. There are loads of WinAPI-s to create a thread, but as far as I know all of them ends ...
0
votes
1answer
69 views

Append to environment variable in LLDB

It is relatively easy to set environment variables in LLDB, via settings set target.env-vars DEBUG=1 However, I can't seem to find a way to append to an environment variable. The following doesn't ...
0
votes
0answers
79 views

capture traffic of an android app

I was trying to test and intercept traffic from an app developed on Rhodes open source framework, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can ...
0
votes
1answer
233 views

Can I force GDB breakpoints and disassemble?

Sorry English isn't my first language. I noticed something when setting breakpoints in GDB. It appears that they are ignored if symbols aren't loaded. I have found it weird how GDB behaves when there ...
1
vote
1answer
105 views

Rust string capacity lower than string lenght

According to RUST documentation, strings are stored this way : This is a statement I can verify while reversing rust binaries. The thing is that when I am reversing rust binaries, I likely encounter ...
0
votes
1answer
96 views

How can I modify these?

So I'm onto something interesting, I asked the less direct way but failed to meet the requirements in terms of explanation So here it is, how would I go about editing these the same way I would go ...
0
votes
0answers
48 views

Change value of memory in a debugger?

So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist ...
0
votes
0answers
38 views

N64 ROM file index hacking issue

Alright, I downloaded the N64 SDK and compiled one of the samples provided by the SDK and dissembled the ROM with IDA and found the asset data is stored some way using index's so my question is. What ...
0
votes
0answers
170 views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
0
votes
0answers
78 views

How to find and edit the source of a string in a DX11 game's exe/files (debug build of the game available)

I want to find and edit the values for the motion blur effect in Naruto: Ultimate Ninja Storm 3 on PC (Windows, DX11) to be more in line with the PS3 version (and the other Storm games on PC as well). ...
1
vote
0answers
324 views

Instruction trace using frida in android emulator

i have a emulator named "Ldplayer" in my windows os and I'm trying to log all instructions executed by the app that uses ARM JNI libraries. basically, the app is running in an x86 emulator ...
0
votes
1answer
81 views

Debugging Encrypted Malware with Multiple Threads

What is the best approach when debugging a multithreaded program that is yet to be encrypted? Where is the best place to put Breakpoints using Ollydbg?
1
vote
1answer
124 views

Bypassing IsDebuggerPresent [closed]

I am currently trying to attach a debugger to a program with a callback for IsDebuggerPresent. Normally, i would patch the program to pass over this check, but patching the program is not an option. ...
1
vote
0answers
59 views

pick dump from a specific process from virtualbox coredump

i'm interested in reverse engineering and assembly stuff i have started to do some research and im still a complete beginner what i have learned so far that we could use virtualbox to dump the RAM ...
2
votes
0answers
94 views

x64dbg break when hex string is loaded

I'm trying to break execution when a string is loaded in memory. I can´t find the string by using the search for -> string references So I press Alt + M and press Ctrl + B to search my string ...
2
votes
1answer
267 views

How to debugging activeX with Ida

When I enter to some site it ask me to install ActivX to my Internet Explorer browser so this site will work well. I installed that,and that site works well. How can I see this ActiveX code(where ...
0
votes
2answers
100 views

How to retrieve name of a variable defined in the data segment in IDA when no process is attached?

I have disassembled an old DOS application with IDA. It run in 16-bit real mode. Some instructions are referencing variables defined in the data segment (DS). push word ptr ds:8401h Since I have ...
0
votes
0answers
30 views

Is it posible to break at string when it being use by program?

Like the title, i need to break at an url string when it being used by program. I try memory break point but it will break at begin of the section. I use x64dbg.
0
votes
1answer
52 views

How can I find the function that throws an error message in IDA Pro? [closed]

Let's suppose I want to use IDA Pro to debug a Windows PE64 application that always throws an error message at a specific point when being run. What steps would I have to take to find the specific ...
1
vote
0answers
88 views

PE Explorer vs. Debugger differences

I injected shellcode into an executable. Entrypoint is set to first shellcode instruction. Shellcode: nop nop label: nop nop jmp label nopnop which translate to: \x90\x90\x90\x90\xeb\xfc\x90\x90 ...
1
vote
1answer
441 views

x64dbg throwing exception

I have been working on finding an overflow in WordPad and I was able to run an exception with an undefined behavior (my point of view). I am using x64dbg (I am not a pro x64dbg) and it shows ...
3
votes
1answer
122 views

Construct a number from 0-999.9 using 5 data bytes of a MIDI SysEx message

I'm sending MIDI messages to a proprietary turntable that has an LCD screen on it. The normal software sends out updates via MIDI SysEx to display the current tempo on the LCD. The MIDI is being ...
2
votes
1answer
348 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
2
votes
0answers
106 views

Display open handle ids in IDA Pro

Is there a way to display all the open handles of a process in IDA Pro while debugging it? I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server. I want to ...
-2
votes
1answer
1k views

Debug and crack .NET executable PE

i'm trying to learn reverse engineering for penetration testing my codes and i believe i won't learn unless i can do some practical so I'm trying to crack an application that is written in C# and all ...
1
vote
0answers
213 views

Recommended plugins for x64dbg

I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks. The more you can ...
0
votes
1answer
71 views

Is it possible to view PE headers in xdbg just like ollydbg?

In ollydbg you can view the PE header of a module, by going into memory map and double clicking on the PE headers, but i couldn't find a way to do this in XDBG, is it possible?
1
vote
0answers
62 views

radare2 stop on lazy loaded library (gdb's stop-on-solib-events)

I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via set stop-on-solib-events 1 I've been unable to find ...
1
vote
1answer
68 views

What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?

So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
2
votes
1answer
436 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
2
votes
1answer
163 views

Get return address from syscall

I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
2
votes
1answer
132 views

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. Pretext: ...
0
votes
0answers
114 views

Anti-re tactics or radare problem while debugging

Here's the target application: https://www.sa-mp.com/download.php While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
0answers
66 views

Jump without jmp near

I need to jump a Hello, I need to jump some lines that lock program in a loop status. i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
1answer
102 views

How can I debug open source C code for Linux?

I want to debug & reverse engineer open source code such as this project. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a ...
0
votes
0answers
53 views

Tracing back the user code section that triggered a message

I have a Windows GUI x86 executable and I have identified, in the .rsrc section, where the error string I want to trace is. Let's assume it is in id=83Ah. I have set a bpx user32:LoadStringA and then ...
0
votes
0answers
112 views

Reversing WSASend finding functions that called it

I'm trying to make my first DLL calling game functions What I need is tracing functions that call WSASend, so it will be easy for me to get all functions address to call them from my DLL. What I ...

1
2
3 4 5
11