Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
0
votes
0answers
198 views

How can I debug code execution on a Native->Unity/Mono/C# Application

I'm reverse engineering a Windows application which has a main executable that appears to run some boilerplate/stub code before calling UnityMain and also using Mono. This means that if I use an ...
2
votes
2answers
177 views

Reverse engineering MCU with “poor” datasheet

I'm reverse engineering a chinese MCU. The datasheet for this chip is pretty poor, they left out important things like memory map, block diagrams ecc... so i got stuck. This is what i've done: I got ...
3
votes
0answers
76 views

How to retrieve generically memory reads of an input and determine all relevant offsets?

I would like to record all memory read operations that are performed by an application on a given input file, to help infer which specific parts of an input are relevant for the specific execution ...
0
votes
1answer
78 views

xor eax,3 why does the input change the way it does?

I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
3
votes
3answers
5k views

GDB hangs when I try to run and debug a binary

When I type gdb a.out and then run inside the gdb itself I get stuck on the empty line: jericho-laptop:exploit.education jericho$ gdb a.out GNU gdb (GDB) 9.1 ... Reading symbols from a.out... (No ...
1
vote
0answers
52 views

Possible to inject a new menu into a program's menu bar?

Is it be possible to inject a new menu/menu item into a program's menu bar? As an example, in Notepad's (Windows) "Help" menu, would it be possible to add a new entry to that menu like "Open ...
0
votes
1answer
174 views

Debugging UEFI with real hardware?

New to this so here we go. I want to reverse engineer a x86-64 desktop UEFI to add hardware support. Since I have the actual hardware available, are there debug interfaces that run via actual ...
0
votes
0answers
102 views

Key Algorithm Reverse

I am trying to reverse a Seed/Key algorithm. i have some sample and knowledge about it, for example i know this algorithm work with only "xor" and "shift" operations. some sample shown in below: ...
0
votes
1answer
300 views

Seed/Key Constant Value

I am trying to reverse a seed/key algorithm that has a constant value inside it. and there is different const value for different device that use this algorithm. i can give some sample from each ...
1
vote
0answers
464 views

How can I debug a non-main .NET assembly using dnSpy?

I am performing a security assessment on a .NET application. dnSpy is a great tool to do this. However, I've reached a module which is not in the "main" section of the program... It is loaded by the ...
0
votes
0answers
51 views

How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?

So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file. how can i do this in IDA ...
0
votes
0answers
1k views

How to capture specific data packets sent in an online game?

I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. ...
0
votes
1answer
403 views

IDA Pro ignores condition in breakpoint

Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
1
vote
1answer
47 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
1
vote
1answer
59 views

I want to modify the data [closed]

I am so newbie about this matter. I have a file XXXX.record file that contains a data. When I open the file How can I read this data and modify the values? thanks.
2
votes
1answer
76 views

Stuck at ntdll when trying to enter a game loop

I'm new to reverse enginnering and currently following Lena's tutorials. I wanted to put my new skills to use and wanted to reverse a simple game: https://github.com/Zolomon/labyrinth. I think I'm ...
1
vote
1answer
62 views

How to track/debug/manipulate Windows processes in a VM?

I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization. Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
2
votes
1answer
324 views

change compare function in assembly and .exe stopped working x64dbg

I'm trying to bypass (crack) a very old software that require license in order to unlock all the features i was digging in the lines with a little bit of knowledge in assembly and i found the line ...
2
votes
1answer
462 views

bypass license of very old software, Access violation (C0000005) x32dbg

I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license so, with a little bit of knowledge in ...
0
votes
0answers
61 views

How to use API Monitor to filter function parameters?

I am monitoring a process using API monitor. I'm getting a lot of API calls unrelated to what I am interested in monitoring. I know about the Display Filter and have been using to filter API Names to ...
2
votes
1answer
48 views

CMP ecx with DAT_

So I encountered this bit of assembly code: cmp dword ptr [ECX + 0x24c], DAT_007c6bc0 It's comparing ECX + 0x24c with DAT_007c6bc0. If they are not equal, it will just return from the function. I ...
4
votes
0answers
244 views

Trying to identify Renesas custom SoC through CPU die inspection

Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by ...
1
vote
2answers
1k views

Why Windows Defender is not able to get rid of this trojan?

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
101 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
0answers
134 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
0
votes
2answers
224 views

Is it possible to use a program's GUI abilities without the GUI?

Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)? For example, a program with abilities nested too deeply in cascading submenus:...
1
vote
0answers
82 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
6
votes
1answer
1k views

Is there any way to display the standard input and output of a program to Cutter's console while debugging?

So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how: Debugging with radare2 using two terminals i was wondering if i can use rarun2 with ...
0
votes
1answer
47 views

IDA - How can I get a list of differing instructions from 2 recorded instruction traces?

I have 2 recorded IDA pro instruction traces, how can I get a list of differing instructions? I am able to load the diffs as overlays but there are a large amount of instructions recorded that are ...
2
votes
2answers
364 views

Add disassembly comment at rip in radare2

When in visual mode (command v) in radare, in the disassembly panel, I can press ; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I ...
0
votes
1answer
2k views

How to use memory address information from IDAFree to set a breakpoint in x32dbg?

I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
0
votes
0answers
249 views

X32DBG ignores dependent DLL

I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
0
votes
1answer
761 views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
0
votes
2answers
59 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
0
votes
1answer
345 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
1
vote
2answers
2k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
0answers
90 views

How to trace in x64dbg?

Does x64dbg have ““Add entries of all procedures”. option to trace the instructions and save the output as a *.txt file?
1
vote
0answers
209 views

Is there a way to trace the differences of a software in x64dbg?

Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the Add entries of all procedures ...
3
votes
1answer
556 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
0
votes
1answer
3k views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
1
vote
0answers
89 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
0
votes
2answers
82 views

Predicting Memory locations of arguments within a function

I'm trying to write a script that would help display the memory contents of the arguments passed within a function. For example, in the function below, the first argument starts at the EAX register. ...
1
vote
0answers
359 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
1
vote
1answer
2k views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
0
votes
0answers
160 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
1
vote
2answers
1k views

x64dbg (x32dbg) log registers every step like windbg

So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
3
votes
0answers
149 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
0
votes
1answer
408 views

Intercept zip decryption key or files from an application

If an application is reading from a password protected zip file, is there a way to intercept the key being sent to decrypt the zip file. Or, is there a way to dump the files being read themselves?
0
votes
1answer
379 views

ASCII strings not showing up in CPU in OllyDbg, but rather in dump

I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
3
votes
1answer
316 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...

1 2
3
4 5
11