Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
1
vote
0answers
66 views

radare2 stop on lazy loaded library (gdb's stop-on-solib-events)

I am running an application and would like to set a breakpoint, as soon as a relevant shared library is loaded. On gdb I can achieve it via set stop-on-solib-events 1 I've been unable to find ...
1
vote
1answer
85 views

What is the difference between mapped and private memory segments in xdbg? and what is a reserved segment?

So in xdbg in the memory map, i can see that some segments are mapped and some are private, at first i thought maybe mapped means it has a corresponding file on disk and its the mapped version of that,...
2
votes
1answer
582 views

How to Launch and debug Ghidra from Eclipse with two Modules I'm developing at the same time?

Ghidra comes with its own Eclipse extensions that allows you to develop new Scripts and Modules for Ghidra. I'm working on several new Modules for Ghidra that will work together. But I've basically ...
2
votes
1answer
186 views

Get return address from syscall

I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
2
votes
1answer
144 views

Mysterious ARM instruction evaluating result to be 0xfe instead of 0xff

I'm facing some issues while debugging an iOS application for educational purposes. This is an iOS application found on the App Store and has some anti-debugging capabilities built in it. Pretext: ...
0
votes
0answers
122 views

Anti-re tactics or radare problem while debugging

Here's the target application: https://www.sa-mp.com/download.php While live debugging, the Windows application is starting a few threads, and Cutter auto breaks after entrypoint for a reason I'm not ...
0
votes
0answers
73 views

Jump without jmp near

I need to jump a Hello, I need to jump some lines that lock program in a loop status. i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
0
votes
1answer
107 views

How can I debug open source C code for Linux?

I want to debug & reverse engineer open source code such as this project. I usually use CLion to write and debug C code on Linux. I've also used GDB. What steps do I need to take to download a ...
0
votes
0answers
54 views

Tracing back the user code section that triggered a message

I have a Windows GUI x86 executable and I have identified, in the .rsrc section, where the error string I want to trace is. Let's assume it is in id=83Ah. I have set a bpx user32:LoadStringA and then ...
0
votes
0answers
124 views

Reversing WSASend finding functions that called it

I'm trying to make my first DLL calling game functions What I need is tracing functions that call WSASend, so it will be easy for me to get all functions address to call them from my DLL. What I ...
1
vote
1answer
358 views

Unable to intercept traffic of an android app even after patching ssl pinning

Recently, I was trying to test an app developed on Rhomobile, I setup a proxy with burp, and of course I have installed burp certificate on my device hence I can intercept other apps on my device but ...
0
votes
0answers
217 views

How can I debug code execution on a Native->Unity/Mono/C# Application

I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
2
votes
2answers
181 views

Reverse engineering MCU with "poor" datasheet

I'm reverse engineering a chinese MCU. The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done: I got ...
3
votes
0answers
77 views

How to retrieve generically memory reads of an input and determine all relevant offsets?

I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
0
votes
1answer
86 views

xor eax,3 why does the input change the way it does?

I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
3
votes
3answers
6k views

GDB hangs when I try to run and debug a binary

When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line: jericho-laptop:exploit.education jericho$ gdb a.out GNU gdb (GDB) 9.1 ... Reading symbols from a.out... (No ...
1
vote
0answers
52 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
0
votes
1answer
189 views

Debugging UEFI with real hardware?

New to this so here we go. I want to reverse engineer a x86-64 desktop UEFI to add hardware support. Since I have the actual hardware available, are there debug interfaces that run via actual ...
0
votes
0answers
108 views

Key Algorithm Reverse

I am trying to reverse a Seed/Key algorithm. i have some sample and knowledge about it, for example i know this algorithm work with only "xor" and "shift" operations. some sample shown in below: ...
0
votes
1answer
329 views

Seed/Key Constant Value

I am trying to reverse a seed/key algorithm that has a constant value inside it. and there is different const value for different device that use this algorithm. i can give some sample from each ...
1
vote
0answers
530 views

How can I debug a non-main .NET assembly using dnSpy?

I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the ...
0
votes
0answers
55 views

How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?

So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file. how can i do this in IDA ...
0
votes
0answers
1k views

How to capture specific data packets sent in an online game?

I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. ...
0
votes
1answer
449 views

IDA Pro ignores condition in breakpoint

Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
1
vote
1answer
50 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
1
vote
1answer
61 views

I want to modify the data [closed]

I am so newbie about this matter. I have a file XXXX.record file that contains a data. When I open the file How can I read this data and modify the values? thanks.
2
votes
1answer
77 views

Stuck at ntdll when trying to enter a game loop

I'm new to reverse enginnering and currently following Lena's tutorials. I wanted to put my new skills to use and wanted to reverse a simple game: https://github.com/Zolomon/labyrinth. I think I'm ...
1
vote
1answer
73 views

How to track/debug/manipulate Windows processes in a VM?

I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization. Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
2
votes
1answer
341 views

change compare function in assembly and .exe stopped working x64dbg

I'm trying to bypass (crack) a very old software that require license in order to unlock all the features i was digging in the lines with a little bit of knowledge in assembly and i found the line ...
2
votes
1answer
513 views

bypass license of very old software, Access violation (C0000005) x32dbg

I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license so, with a little bit of knowledge in ...
0
votes
0answers
67 views

How to use API Monitor to filter function parameters?

I am monitoring a process using API monitor. I'm getting a lot of API calls unrelated to what I am interested in monitoring. I know about the Display Filter and have been using to filter API Names to ...
2
votes
1answer
53 views

CMP ecx with DAT_

So I encountered this bit of assembly code: cmp dword ptr [ECX + 0x24c], DAT_007c6bc0 It's comparing ECX + 0x24c with DAT_007c6bc0. If they are not equal, it will just return from the function. I ...
4
votes
0answers
260 views

Trying to identify Renesas custom SoC through CPU die inspection

Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by ...
1
vote
2answers
1k views

Why Windows Defender is not able to get rid of this trojan?

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
111 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
0answers
140 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
0
votes
2answers
236 views

Is it possible to use a program's GUI abilities without the GUI?

Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)? For example, a program with abilities nested too deeply in cascading submenus:...
1
vote
0answers
82 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
6
votes
1answer
2k views

Is there any way to display the standard input and output of a program to Cutter's console while debugging?

So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how: Debugging with radare2 using two terminals i was wondering if i can use rarun2 with ...
0
votes
1answer
50 views

IDA - How can I get a list of differing instructions from 2 recorded instruction traces?

I have 2 recorded IDA pro instruction traces, how can I get a list of differing instructions? I am able to load the diffs as overlays but there are a large amount of instructions recorded that are ...
2
votes
2answers
412 views

Add disassembly comment at rip in radare2

When in visual mode (command v) in radare, in the disassembly panel, I can press ; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I ...
0
votes
1answer
3k views

How to use memory address information from IDAFree to set a breakpoint in x32dbg?

I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
0
votes
0answers
268 views

X32DBG ignores dependent DLL

I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
0
votes
1answer
873 views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
0
votes
2answers
59 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
1answer
382 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
1
vote
2answers
3k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
0answers
96 views

How to trace in x64dbg?

Does x64dbg have ““Add entries of all procedures”. option to trace the instructions and save the output as a *.txt file?
1
vote
0answers
223 views

Is there a way to trace the differences of a software in x64dbg?

Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the Add entries of all procedures ...
3
votes
1answer
631 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...

1 2
3
4 5
11