Questions tagged [debugging]
Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.
569
questions
0
votes
0
answers
68
views
How to see the full info of a handle in IDA debugger, just like other debuggers like xdbg?
So in xdb, whenever i see a handle value like 0xA0, i can easily go to handle tabs and see what type of handle it is and for example if its a file handle, what file.
how can i do this in IDA ...
- 212
0
votes
0
answers
2k
views
How to capture specific data packets sent in an online game?
I am playing an online MMORPG game, based on player versus player idea. In this game, characters have skills. I want to capture the sent packet, when a specific skill is pressed on keyboard or etc. ...
- 101
0
votes
1
answer
545
views
IDA Pro ignores condition in breakpoint
Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
1
vote
1
answer
61
views
How to determine what code created a string, in a live debugger session?
I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
- 51
1
vote
1
answer
67
views
I want to modify the data [closed]
I am so newbie about this matter.
I have a file XXXX.record file that contains a data.
When I open the file
How can I read this data and modify the values?
thanks.
- 113
2
votes
1
answer
92
views
Stuck at ntdll when trying to enter a game loop
I'm new to reverse enginnering and currently following Lena's tutorials. I wanted to put my new skills to use and wanted to reverse a simple game: https://github.com/Zolomon/labyrinth.
I think I'm ...
- 65
1
vote
1
answer
95
views
How to track/debug/manipulate Windows processes in a VM?
I am trying to make some deep-level windows debuggig/tracing, utilizing virtualization.
Considering that if a Windows runs in a virtual machine, theoretically I have total power over it - I could ...
- 179
2
votes
1
answer
460
views
change compare function in assembly and .exe stopped working x64dbg
I'm trying to bypass (crack) a very old software that require license in order to unlock all the features
i was digging in the lines with a little bit of knowledge in assembly
and i found the line ...
- 47
2
votes
1
answer
690
views
bypass license of very old software, Access violation (C0000005) x32dbg
I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license
so, with a little bit of knowledge in ...
- 47
0
votes
0
answers
82
views
How to use API Monitor to filter function parameters?
I am monitoring a process using API monitor. I'm getting a lot of API calls unrelated to what I am interested in monitoring. I know about the Display Filter and have been using to filter API Names to ...
- 43
2
votes
1
answer
78
views
CMP ecx with DAT_
So I encountered this bit of assembly code:
cmp dword ptr [ECX + 0x24c], DAT_007c6bc0
It's comparing ECX + 0x24c with DAT_007c6bc0. If they are not equal, it will just return from the function.
I ...
- 21
4
votes
0
answers
289
views
Trying to identify Renesas custom SoC through CPU die inspection
Was wondering if someone could help me identify which series a Renesas Custom SoC belongs to within the super-H family by looking at optical images of the die circuitry layout of the device, and by ...
- 103
1
vote
2
answers
2k
views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
- 61
1
vote
0
answers
145
views
How to load a library at a specific address in IDA and re-analyze the program statically?
I have a dumped PE that has calls like
call ds:dword_4010B4
now these are actually addresses of APIs in kernel32.dll
my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
- 320
1
vote
0
answers
169
views
How to dump a unpacked PE and still get the API names with IDA when they are called directly?
So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header)
i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
- 320
0
votes
2
answers
273
views
Is it possible to use a program's GUI abilities without the GUI?
Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?
For example, a program with abilities nested too deeply in cascading submenus:...
- 169
1
vote
0
answers
88
views
API Hiding Issue
I'm trying to analyze a malware which is hiding API names. When I open it with CFF Explorer, except a few API like GetProcAddress, nothing appears. Basically, I know how API hiding works. I set a ...
- 11
6
votes
1
answer
2k
views
Is there any way to display the standard input and output of a program to Cutter's console while debugging?
So it's easy to transfer the standard input and output in radare2 to a new terminal using rarun2, here's how:
Debugging with radare2 using two terminals
i was wondering if i can use rarun2 with ...
- 63
0
votes
1
answer
51
views
IDA - How can I get a list of differing instructions from 2 recorded instruction traces?
I have 2 recorded IDA pro instruction traces, how can I get a list of differing instructions?
I am able to load the diffs as overlays but there are a large amount of instructions recorded that are ...
- 103
2
votes
2
answers
583
views
Add disassembly comment at rip in radare2
When in visual mode (command v) in radare, in the disassembly panel, I can press ; to add a comment at the location I am current seeked to (which is the top instruction in the disassembly view). I ...
- 121
0
votes
1
answer
4k
views
How to use memory address information from IDAFree to set a breakpoint in x32dbg?
I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
- 223
0
votes
0
answers
315
views
X32DBG ignores dependent DLL
I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
0
votes
1
answer
1k
views
How to change the title of a windows GUI app when patching? (the title that usually writes the application name)
So I'm trying to patch a binary (its a GUI app), and i want to patch the title of it as well when I'm patching it, and by title i mean the text that appears on top of the app that usually is the ...
- 212
0
votes
2
answers
64
views
Which APIs are responsible for terminating process icons in Taskbar?
I am trying to reverse and debug a program but it exists after certain point, tried setting breakpoint on any inter module call that starts with exit or terminate, now here's the weird part :
it does ...
- 212
0
votes
1
answer
475
views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
- 169
1
vote
2
answers
3k
views
How to debug a DLL written in .NET/C#?
I want to reverse engineer an application written in C#. I would like to set a breakpoint at a function and observe the input passed to it during the normal course of the application's functioning.
1
vote
0
answers
139
views
How to trace in x64dbg?
Does x64dbg have ““Add entries of all procedures”. option to trace the instructions and save the output as a *.txt file?
1
vote
0
answers
267
views
Is there a way to trace the differences of a software in x64dbg?
Why does Immunity Debugger unable to start my application? I want to compare the differences of a software: Immunity Debugger can trace all assembly instruction with the Add entries of all procedures ...
3
votes
1
answer
733
views
Radare2 - How to debug Android native code (dynamic analysis)?
I'm using Termux(root) on LineageOS 16 (Android 9) with radare2 (v3.6.0 linux-arm32). When i attach to a process with 'r2 -d pid' the app freezes properly but doesn't continue with 'dc'. I'm not sure ...
- 173
0
votes
1
answer
4k
views
How do I find the address of a data location at runtime?
I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the ...
- 43
1
vote
0
answers
113
views
How can I emulate Huawei routers HG5xx firmware?
i want to pentest some HG routers in a way that i can try every thing without worrying if it would damage the router or not .... and a better view of debugging the actions .
- 170
0
votes
2
answers
89
views
Predicting Memory locations of arguments within a function
I'm trying to write a script that would help display the memory contents of the arguments passed within a function. For example, in the function below, the first argument starts at the EAX register. ...
- 53
1
vote
0
answers
521
views
write radare2 output to a file
I am trying to write all the write logs of a binary program into a file for further analysis. I am using radare2 for it. I don't know what's the issue, I am not able to write the 'dte' output to a ...
- 111
1
vote
1
answer
3k
views
Dump value of register using frida
I'm new with frida and came to this problem.
I have dll that I want to reverse engeneer(there are no debug symbols). Specifically I want to dump some data from a function. So I have this big function ...
- 173
0
votes
0
answers
253
views
OllyDbg - After restarting program, breakpoints lost
I am new to OllyDbg and I made a small (.NET Console App) program to test if I can crack the password. To set the break point where it writes Incorrect password. I need to run the program first. But ...
1
vote
2
answers
2k
views
x64dbg (x32dbg) log registers every step like windbg
So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
- 11
4
votes
0
answers
199
views
How to redirect stdin in OllyDbg?
When I use IDA, I can use stdin from the file as in bash.
When I tried to do it in OllyDbg, it processed the parameters simply as a string.
Can I redirect stdin in OllyDbg?
0
votes
1
answer
520
views
Intercept zip decryption key or files from an application
If an application is reading from a password protected zip file, is there a way to intercept the key being sent to decrypt the zip file. Or, is there a way to dump the files being read themselves?
- 13
0
votes
1
answer
494
views
ASCII strings not showing up in CPU in OllyDbg, but rather in dump
I'm pretty much new to the Reverse Engineering and assembly language. I've watched some videos about OllyDbg and cracking serial numbers in programs and I got interested in them and I want to learn ...
3
votes
1
answer
389
views
custom virtual machine protection
How someone would go to reverse engineer a sample protected with a virtual machine? The problem is that it's not opcode anymore it's bytecode which I don't have any idea about because it's a private ...
- 163
2
votes
3
answers
946
views
Debug program using peculiar anti-debugging technique
In my BA thesis, I wanted to present a program for Windows, using various anti-debugging techniques.
One of them, which I came up on my own (possibly it is well known, but I didn't find it anywhere) ...
- 3,189
1
vote
1
answer
1k
views
Call Stack vs Intermodular Calls in Ollydbg
What is the difference between call stack and intermodular calls. Could you clarify the difference between the two? For example if I need to catch message box API function, do these methods serve the ...
2
votes
2
answers
529
views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
- 103
2
votes
2
answers
528
views
eip register address not matching with address at breakpoint (breakpoint set at main function)
I recently started reading a book about reverse engineering. In one of the examples it uses gdb (debugger) to disassemble the main. So I did it, and the output is below
(gdb) disass main
Dump of ...
- 23
3
votes
0
answers
346
views
gdb - searching for pointers to a given memory region
Let's suppose there is a memory region that is m'mapped in memory, we need to find its address (which randomly changes, because of ASLR) by following a pointer path, basically, I'm trying to find a ...
- 131
1
vote
0
answers
728
views
Unable to attach java sources to APK being debugged in Android Studio -- Option not displayed
This article (https://developer.android.com/studio/debug/apk-debugger) explains how to debug third-party APKs and set breakpoints by attaching the java source (you can use decompiled code to get it ...
- 25
1
vote
1
answer
319
views
radare2 shows main function arguments argv as pointer to char on the stack, not as pointer to pointer to char
Well, I've been digging around process command line arguments as well as environment variables a bit these last days, especially looking up the way main function arguments were pushed onto the stack.
...
- 51
-1
votes
1
answer
738
views
Program closing even with IsDebuggerPresent Patched!
i'm in some serious problems when trying to debug a program with ollydbg, i patched IsDebuggerPresent but still after starting debugging with it patched it will Terminate anyways.
Steps i Followed ...
- 1
5
votes
1
answer
962
views
function call trace with radare2 or break on all function call
I want to script with python using r2pipe. Is there a way that when debugging I can break on each call function, thus I can get the parameter? What's more, I won't jump into system library.
Or is ...
- 51
0
votes
2
answers
228
views
crackme disassembly - are these local variables ever initialized?
I'm working on a crackme, where the objective is to find the valid password given a program. I'm using radare2 to reverse engineering the program. To do so, I need to enter a password that forces this ...
- 103