Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
0 votes
0 answers
68 views

How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?

So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file. how can i do this in IDA ...
user avatar
  • 212
0 votes
0 answers
2k views

How to capture specific data packets sent in an online game?

I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. ...
user avatar
0 votes
1 answer
545 views

IDA Pro ignores condition in breakpoint

Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
user avatar
1 vote
1 answer
61 views

How to determine what code created a string, in a live debugger session?

I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
user avatar
  • 51
1 vote
1 answer
67 views

I want to modify the data [closed]

I am so newbie about this matter. I have a file XXXX.record file that contains a data. When I open the file How can I read this data and modify the values? thanks.
user avatar
  • 113
2 votes
1 answer
92 views

Stuck at ntdll when trying to enter a game loop

I'm new to reverse enginnering and currently following Lena's tutorials. I wanted to put my new skills to use and wanted to reverse a simple game: https://github.com/Zolomon/labyrinth. I think I'm ...
user avatar
1 vote
1 answer
95 views

How to track/debug/manipulate Windows processes in a VM?

I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization. Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
user avatar
  • 179
2 votes
1 answer
460 views

change compare function in assembly and .exe stopped working x64dbg

I'm trying to bypass (crack) a very old software that require license in order to unlock all the features i was digging in the lines with a little bit of knowledge in assembly and i found the line ...
user avatar
  • 47
2 votes
1 answer
690 views

bypass license of very old software, Access violation (C0000005) x32dbg

I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license so, with a little bit of knowledge in ...
user avatar
  • 47
0 votes
0 answers
82 views

How to use API Monitor to filter function parameters?

I am monitoring a process using API monitor. I'm getting a lot of API calls unrelated to what I am interested in monitoring. I know about the Display Filter and have been using to filter API Names to ...
user avatar
  • 43
2 votes
1 answer
78 views

CMP ecx with DAT_

So I encountered this bit of assembly code: cmp dword ptr [ECX + 0x24c], DAT_007c6bc0 It's comparing ECX + 0x24c with DAT_007c6bc0. If they are not equal, it will just return from the function. I ...
user avatar
  • 21
4 votes
0 answers
289 views

Trying to identify Renesas custom SoC through CPU die inspection

Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by ...
user avatar
1 vote
2 answers
2k views

Why Windows Defender is not able to get rid of this trojan?

Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
user avatar
  • 61
1 vote
0 answers
145 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
user avatar
1 vote
0 answers
169 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
user avatar
0 votes
2 answers
273 views

Is it possible to use a program's GUI abilities without the GUI?

Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)? For example, a program with abilities nested too deeply in cascading submenus:...
user avatar
1 vote
0 answers
88 views

API Hiding Issue

I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
user avatar
  • 11
6 votes
1 answer
2k views

Is there any way to display the standard input and output of a program to Cutter's console while debugging?

So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how: Debugging with radare2 using two terminals i was wondering if i can use rarun2 with ...
user avatar
0 votes
1 answer
51 views

IDA - How can I get a list of differing instructions from 2 recorded instruction traces?

I have 2 recorded IDA pro instruction traces, how can I get a list of differing instructions? I am able to load the diffs as overlays but there are a large amount of instructions recorded that are ...
user avatar
2 votes
2 answers
583 views

Add disassembly comment at rip in radare2

When in visual mode (command v) in radare, in the disassembly panel, I can press ; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I ...
user avatar
  • 121
0 votes
1 answer
4k views

How to use memory address information from IDAFree to set a breakpoint in x32dbg?

I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
user avatar
  • 223
0 votes
0 answers
315 views

X32DBG ignores dependent DLL

I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
user avatar
0 votes
1 answer
1k views

How to change the title of a windows GUI app when patching? (the title that usually writes the application name)

So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
user avatar
  • 212
0 votes
2 answers
64 views

Which APIs are responsible for terminating process icons in Taskbar?

I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part : it does ...
user avatar
  • 212
0 votes
1 answer
475 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
user avatar
1 vote
2 answers
3k views

How to debug a DLL written in .NET/C#?

I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
user avatar
1 vote
0 answers
139 views

How to trace in x64dbg?

Does x64dbg have ““Add entries of all procedures”. option to trace the instructions and save the output as a *.txt file?
user avatar
1 vote
0 answers
267 views

Is there a way to trace the differences of a software in x64dbg?

Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the Add entries of all procedures ...
user avatar
3 votes
1 answer
733 views

Radare2 - How to debug Android native code (dynamic analysis)?

I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
user avatar
  • 173
0 votes
1 answer
4k views

How do I find the address of a data location at runtime?

I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
user avatar
  • 43
1 vote
0 answers
113 views

How can I emulate Huawei routers HG5xx firmware?

i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
user avatar
0 votes
2 answers
89 views

Predicting Memory locations of arguments within a function

I'm trying to write a script that would help display the memory contents of the arguments passed within a function. For example, in the function below, the first argument starts at the EAX register. ...
user avatar
1 vote
0 answers
521 views

write radare2 output to a file

I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
user avatar
1 vote
1 answer
3k views

Dump value of register using frida

I'm new with frida and came to this problem. I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
user avatar
  • 173
0 votes
0 answers
253 views

OllyDbg - After restarting program, breakpoints lost

I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
user avatar
1 vote
2 answers
2k views

x64dbg (x32dbg) log registers every step like windbg

So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
user avatar
  • 11
4 votes
0 answers
199 views

How to redirect stdin in OllyDbg?

When I use IDA, I can use stdin from the file as in bash. When I tried to do it in OllyDbg, it processed the parameters simply as a string. Can I redirect stdin in OllyDbg?
user avatar
0 votes
1 answer
520 views

Intercept zip decryption key or files from an application

If an application is reading from a password protected zip file, is there a way to intercept the key being sent to decrypt the zip file. Or, is there a way to dump the files being read themselves?
user avatar
0 votes
1 answer
494 views

ASCII strings not showing up in CPU in OllyDbg, but rather in dump

I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
user avatar
3 votes
1 answer
389 views

custom virtual machine protection

How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
user avatar
  • 163
2 votes
3 answers
946 views

Debug program using peculiar anti-debugging technique

In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques. One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
user avatar
  • 3,189
1 vote
1 answer
1k views

Call Stack vs Intermodular Calls in Ollydbg

What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
user avatar
2 votes
2 answers
529 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
user avatar
2 votes
2 answers
528 views

eip register address not matching with address at breakpoint (breakpoint set at main function)

I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below (gdb) disass main Dump of ...
user avatar
3 votes
0 answers
346 views

gdb - searching for pointers to a given memory region

Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
user avatar
1 vote
0 answers
728 views

Unable to attach java sources to APK being debugged in Android Studio -- Option not displayed

This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
user avatar
  • 25
1 vote
1 answer
319 views

radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char

Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack. ...
user avatar
-1 votes
1 answer
738 views

Program closing even with IsDebuggerPresent Patched!

i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways. Steps i Followed ...
user avatar
5 votes
1 answer
962 views

function call trace with radare2 or break on all function call

I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library. Or is ...
user avatar
0 votes
2 answers
228 views

crackme disassembly - are these local variables ever initialized?

I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
user avatar
  • 103

1 2 3
4
5
12