Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
530
questions
3
votes
1answer
313 views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
2
votes
3answers
601 views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
1
vote
1answer
899 views
Call Stack vs Intermodular Calls in Ollydbg
What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
2
votes
2answers
434 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
2
votes
2answers
397 views
eip register address not matching with address at breakpoint (breakpoint set at main function)
I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below
(gdb) disass main
Dump of ...
3
votes
0answers
278 views
gdb - searching for pointers to a given memory region
Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
1
vote
0answers
583 views
Unable to attach java sources to APK being debugged in Android Studio — Option not displayed
This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
1
vote
1answer
239 views
radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char
Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack.
...
-1
votes
1answer
565 views
Program closing even with IsDebuggerPresent Patched!
i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.
Steps i Followed ...
5
votes
1answer
684 views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
0
votes
2answers
180 views
crackme disassembly - are these local variables ever initialized?
I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
1
vote
1answer
238 views
Do all games have static base addresses for values like gold and energy?
I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base ...
0
votes
1answer
171 views
Finding the correct emulator for programming a renesas sh7722 processor
I have a question about reverse engineering a Roland gr-55 guitar synthesizer. I'm 90% sure the device uses a Renesas sh7722 processor as the main CPU, or at least one of the CPU's in the SH family. I ...
4
votes
1answer
1k views
How do I type in hex input into radare2 debug mode?
#include<stdio.h>
#include<stdlib.h>
int main() {
puts("Enter input: ");
char buf[100];
fgets(buf, 100, stdin);
printf("%s", buf);
}
Suppose I am debugging a program, such ...
1
vote
0answers
131 views
How does Ida suspend threads?
I know that Ida uses ptrace function to attach and debug process.
How Ida can suspend thread? how is that possible?
0
votes
0answers
82 views
How to debug programs that load from another one? with radare2/gdb
I'm reversing engendering a plugin. This plugin is loaded into memory by the main program.
I disassemble the plugin with radare2 but I don't know how to debug it.
I try with gdb but same problem.
I ...
4
votes
0answers
267 views
Using GDB to trace guest OS inside a hypervisor, the whole running on Qemu - kvm
I use Gdb to trace the execution (breakpoint, single stepping, ...) of a hypervisor OS in Qemu and it works fine so far.
qemu-system-x86_64 -enable-kvm -display sdl -cpu host -serial my: stdio -m ...
0
votes
1answer
700 views
IDA PRO Tracing stopps
I need to get data from the window of the external program. This data is dynamic and changes each time the additional window is restarted. I have already found an offset, but I need to find the ...
3
votes
0answers
213 views
Does pwntools provide any Radare2 integration?
I want to use pwntools with Radare2, since this is my debugger of choice.
However, I can only find GDB-related library calls in pwntools' documentation (pwnlib.gdb).
Anyone with experience in ...
1
vote
0answers
79 views
IDA Pro - Remote debugging suse enterpris server 10 (glibc2_10 required)
I have a Suse enterprise server 10 on VMWare. I want to remote debug an application in this VM using IDA pro, I already tried these:
Copied linux_server form IDApro into this VM and tried to run it, ...
0
votes
0answers
449 views
OPENOCD Error codes: How do I fix this?
I have a chip I am trying to use JTAG communications with using openOCD. However, I get the following error:
openocd -f ocd.cfg
Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports,...
0
votes
1answer
160 views
Is there a way to see & keep track of registers in dnSpy?
Hello I am trying to see if there is a way to see & keep track of the IP, and other registers as you would in OllyDbg or x64Dbg?
2
votes
1answer
828 views
How to print eax value with Radare2?
I am solving a crack me challenge but I am stuck. The challenge executes several jne tests. The first test is the simpliest but I don't arrive to print the eax value to know the content of cmp ...
2
votes
1answer
405 views
How to use aaa in radare2 while in -d (debug) mode?
This might be a stupid question, but I am trying to learn by myself and I encountered a problem which I cannot solve for the life of me. I tried googling and I can't find anything relevant, so here ...
-1
votes
2answers
697 views
CreateThread returns true but thread doesn't run [closed]
I have a PE executable which uses threads to handle most of its functionality. It uses CreateThread API to spawn local threads to handle functions.
The call to the CreateThread returns a valid handle ...
1
vote
1answer
202 views
How to set a breakpoint in an execve'd program in radare2?
If I have a program A, which uses execve to run program B. How can I set a breakpoint in program B's main routine if I'm debugging program A?
After a certain point in the execve routine, program B ...
3
votes
2answers
731 views
Jump in the middle trick
I'm reversing a program that "hides" some instructions using the jump in the middle trick. This trick is a jump to a middle of an instruction, whereas the real address actually contains another opcode....
0
votes
1answer
362 views
Remote debugger for Linux from one VM (IDA) to another (running the debuggee)
I want to debug a Linux program (ELF), but my IDA Pro is on a Windows 10 VM and I want to use remote debugging to debug the program on Ubuntu (also in a VM).
So, is it possible to debug if both ...
1
vote
1answer
356 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
1
vote
0answers
85 views
Motorola Freescale mpc564 microcontroller
Im hoping somebody here can give me some advice. Im trying to read the flash contents of a Mpc564 Motorola MCU. The flash size is 512KB The processor was removed from a bad circuit board. Is there ...
0
votes
1answer
283 views
Show arguments while debugging
I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program.
Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
2
votes
1answer
166 views
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
Why does -A (aaa) analysis show much more information, when using the -d (debug) CLI option in Radare2?
I'm using the newest version of Radare2 to analyze the Windows application.
As can be seen ...
1
vote
2answers
213 views
Issue with debugger - black screen and freeeze after loading game executable
I have issue with debugging. When I try to load game executable to debugger and go to certain place in code, game window shows up but it is black and it looks freezed. I can't even go back to debugger ...
1
vote
1answer
903 views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...
2
votes
1answer
2k views
How to save (trace) the execution route/sequences in debugger and Replay?
is it possible to save the step-by-step execution route of the program?
i.e. lets say in x64dbg the program executes one handle after another
and so on, probably hundreds of calls...
But according ...
2
votes
1answer
834 views
How to make Radare2 automatically disassemble next instruction after each `ds` debug single-step?
How to make Radare2 automatically disassemble next instruction after each ds debug single-step?
I thought that e asm.bytes=1 would achieve this, but that doesn't help.
In particular, GDB supports ...
2
votes
2answers
332 views
Radare2 doesn't update current address, when single-step debugging using `ds`?
Radare2 doesn't update current address, when single-step debugging using ds?
I'm debugging an ELF binary on Linux using single-step (ds). The problem is that the current address at the prompt doesn't ...
2
votes
2answers
503 views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa =...
1
vote
1answer
2k views
Analyzing and deobfuscating complex JS code [duplicate]
I am looking to reverse engineer a very ugly piece of JS found here.
As far as I can tell, this script generates and sets some cookies on my browser that identify it on the site. Deobfuscating it ...
0
votes
1answer
1k views
IDA remote linux Debugger attach to a running process
I usually use remote linux debugger as shown below:
./linux_server bin
And in IDA Pro, I select Remote Linux Debugger as the debugger and set the process options accordingly with the IP address and ...
3
votes
3answers
2k views
How to see all functions that called with debugger
I debugging with IDA, and I want to see/print all the functions that get called.
In the functions window I see over than 1000 functions.
So I want to see which functions are called when I press ...
0
votes
1answer
2k views
How to run ida in windows xp
I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application.
I search and found that IDA is not supported with Windows XP.
How can I run IDA ...
0
votes
1answer
282 views
How to identify different memory regions of an elf binary in radare2?
I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
1
vote
0answers
180 views
How to find which event is bound to which GUI part
let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ):
that program has a button xyz:
1) how to find out ...
1
vote
1answer
936 views
Run any line/command in x64dbg
Is it possible, to run whichever line I want?
For example, if it is at black position, and i want to run the RED CIRCLED command:
I couldn't find a way to do that, neither in right click or etc......
2
votes
1answer
6k views
Reconstructing Unity APK
Note: I am only doing this for educational purposes with no intent to redistribute
I have decompiled an APK built with Unity successfully (Somewhat).
Using an array of programs, I managed to extract ...
0
votes
1answer
160 views
Where to find address of registers populated in a binary
This question might sound very naive, however, I got stuck when one of my friends asked me where can I find the address of an initialized register in the stack.
For e.g., info registers in gdb gives ...
3
votes
1answer
2k views
IDA Pro's debugging - Stack view , Register values and ASCII decoding
Below questions are related to IDA Pro debugging:
1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
7
votes
2answers
1k views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
3
votes
2answers
13k views
Find base address and memory size of program debugged in gdb
I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
