Questions tagged [debugging]

Process of analyzing live programs through software (e.g. ptrace) or hardware (e.g. JTAGs) devices.

Filter by
Sorted by
Tagged with
3
votes
3answers
2k views

How to see all functions that called with debugger

I debugging with IDA, and I want to see/print all the functions that get called. In the functions window I see over than 1000 functions. So I want to see which functions are called when I press ...
0
votes
1answer
2k views

How to run ida in windows xp

I tried to install IDA 6.6 on Windows XP VM. After the installation I get that this is not a valid win 32 application. I search and found that IDA is not supported with Windows XP. How can I run IDA ...
0
votes
1answer
305 views

How to identify different memory regions of an elf binary in radare2?

I'm just starting out with reverse engineering, one thing I'm finding difficult is identifying different areas of memory. I'm using radare2, and I would like to be able to easily seek and identify ...
1
vote
0answers
220 views

How to find which event is bound to which GUI part

let's say, I am debugging (with x64dbg) a specific program (in Windows, native programs, probably they are called standard MFC-kind programs ): that program has a button xyz: 1) how to find out ...
1
vote
1answer
1k views

Run any line/command in x64dbg

Is it possible, to run whichever line I want? For example, if it is at black position, and i want to run the RED CIRCLED command: I couldn't find a way to do that, neither in right click or etc......
2
votes
1answer
6k views

Reconstructing Unity APK

Note: I am only doing this for educational purposes with no intent to redistribute I have decompiled an APK built with Unity successfully (Somewhat). Using an array of programs, I managed to extract ...
0
votes
1answer
180 views

Where to find address of registers populated in a binary

This question might sound very naive, however, I got stuck when one of my friends asked me where can I find the address of an initialized register in the stack. For e.g., info registers in gdb gives ...
3
votes
1answer
2k views

IDA Pro's debugging - Stack view , Register values and ASCII decoding

Below questions are related to IDA Pro debugging: 1) How can I see values of general registers directly in Registers view of IDA Pro similar to Olly instead of clicking on jump link? It is having ...
7
votes
2answers
1k views

Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll

As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
3
votes
2answers
14k views

Find base address and memory size of program debugged in gdb

I want to find out the base address and the imagesize of the program being debugged in gdb. As in, where it got loaded in memory. For shared libraries I can do "info sharedlibrary" and I get very ...
1
vote
0answers
139 views

How to dump firmware from R5F71424 MCU

I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware. It has a limited boot mode that only allows writing to the MCU. Any pointers or ideas would be helpful....
1
vote
3answers
944 views

IDA Debug DLL with non exported function

I am trying to debug a dll by IDA but it have no exported functions so I can not use rundll32.exe to debug it. How can i do that? Thanks so much./
3
votes
1answer
1k views

Extract firmware images from COTS embedded devices

I am on the hook to collect some of legacy firmware images from real-world embedded devices. Before digging into it, I am trying to confirm some high-level points. Is it in general possible to ...
1
vote
2answers
489 views

IDA PRO - compare running process

I have a software which writes some data to specific location in memory depending on user choices. Say i can have 2 choices, A & B. I want to run IDA, set option A and save all the data, then run ...
2
votes
2answers
2k views

OllyDBG - Game Hacking

I am trying to reverse game called Assault Cube where I am gonna be making game hacks for. I using Ollydbg to reverse though I have no theoretical understanding of asm at all. I just follow online ...
1
vote
1answer
202 views

How to set hardware breakpoint by value?

I want to set in IDA breakpoint when a specific value is written on the stack. I know how to set hardware breakpoint, but I can set it only by address.
-1
votes
3answers
994 views

Proxy debugging tool doesn't capture traffic from some online games

I'm analyzing Android games with Fiddler 2 to see how the game collects data. There is a problem, both Fiddler 2 and Charles Proxy doesn't capture any traffic from some online games. All i got are ads ...
1
vote
1answer
290 views

How to debug a crash in wow64.dll in 32bit process

I have a 32bit application and a few wrapper tools that I use one after another to inject code, hook system dll functions (using the patch-first-bytes-of-the-function-with-jump approach). Also I have ...
2
votes
1answer
812 views

Trying to hook DirectX9 using C++ - Keeps crashing

I posted a thread on StackOverflow a few days ago, and it's got little attention, so i though it's possible this might be a better place for it. As the title says, i'm trying to hook/detour DirectX9 ...
1
vote
1answer
316 views

IDA PRO does miss calls when tracing

I am following this tutorial: enter link description here Though it uses Olly I am following with IDA. Basically i am tying to catch where a popup decision is taking place in the program. I though ...
3
votes
2answers
4k views

How to use API monitor on specific process

I want to monitor specific process with API Monitor but I didn't understand how do I do it please. I will happy to understand that. By the way, can I monitor process while I debugging it with ida?
0
votes
1answer
1k views

How to breakpoint atached process with ida when move on

In IDA pro, there is an option to attach to a process using the WinDbg backend. When I want is to see the process' control flow when the IDA attaches to it. The only way (that I know) to see the ...
4
votes
2answers
8k views

What is the difference between IDA and OllyDbg?

When I want to debug an exe in Windows, what advantages does OllyDbg have over IDA? In IDA, I'm using the WinDbg debugger back-end.
4
votes
1answer
1k views

getting the static address/offset of a variable

I'm fairly new to reverse engineering at all and I'm currently struggling to get the static offset/address of a variable of a program I've written myself. So I've written the following program in C++,...
2
votes
1answer
876 views

How debug process that not started with ida? [duplicate]

I am trying to debug two different exe files,in windows. The first exe launches the second, and the second exe doesn't work well unless the first starts it. I want to be able to debug the second exe....
6
votes
0answers
418 views

Radare2 - How to save/restore metadata in debug session (BPs, flag, comments..)?

How can i save/reuse/preserve Radare2 metadata (BPs, comments, flags..) of a debug session for a new debug session? I restart the debugger alot and preserving environment would be very helpful. I ...
2
votes
0answers
218 views

(iOS lldb) Unable to debug past a splash/loading screen

I'm trying to lldb debug this certain iOS application. Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity. However, whenever I try to debug ...
4
votes
1answer
3k views

Radare2 debugging - How to get into lazy imported functions?

I have a linux binary that imports functions from an external library (shared object). The functions are lazy loaded and not available when rip is at @main or @entry. When i step into such a function (...
1
vote
0answers
97 views

Is there any way to get value from bytecode under JDWP without access to source?

When I debug android app through jdwp using jdb, it seems I can't get anything from the bytecode level. I know normally it's fine as long as we have the source line info and use a decompiler, but the ...
0
votes
1answer
64 views

Find out where the string comes from (in Browser)

i.e. on a page, I see that after i.e. 5 seconds of page load, there appears a message: Hello Akubatula, you are wonderful. Lets say, i want to find out, from where does the word wonderful comes from....
1
vote
2answers
357 views

How to stop debugging while a specific value is on the stack?

I'm debugging an .exe file with IDA , and always I see specific value in my stack , for ex. AABBCCDDEEFF . That value interests me, I want to know where this value comes from, how it gets pushed onto ...
1
vote
1answer
1k views

IDA - Remote debug on linux

I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink). Because the exploit is via gets() I try to pass input through the "...
2
votes
1answer
68 views

What does this mean in OllyDbg: function+hex value

Im trying to debug a binary - and I wanted to know if someone can explain what does it mean when there's a value 'added' on to a function. eg: CRYPTSP.CryptDuplicateHash+0C What does the '0C' mean ...
1
vote
2answers
1k views

How do I create an ASCII string in OllyDBG?

During the debugging process, I can use binary edit in order to add commands where I want, etc. However, I can't find any way to add an ASCII string at an address in which I can reference later. If I ...
3
votes
1answer
9k views

gdb debug show error "not in executable format: file format not recognized"

[root@localhost Relay]# file RelayD RelayD: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), stripped [root@localhost Relay]# ./start : no process ...
1
vote
1answer
783 views

How to move one step back in a debugger

When I debug a .exe file on Windows with IDA, I do it step by step. Can I move one step back and reset all the registers and stack to what they were one instruction ago? By the way, when I'm looking ...
2
votes
2answers
2k views

What is the difference between Windbg and local debugger in IDA

When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger. What is the difference? By the way, is there any difference if I use Windbg tool (windows software) ...
2
votes
1answer
72 views

How to identify when a function is being called using IDA?

I'm debugging a .exe file on Windows with IDA's debugger. How can I identify when the code calls the random() function?
2
votes
2answers
1k views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
12
votes
3answers
805 views

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I'm trying to reverse the Dbgv.sys (x86 kernel driver) for the DbgView tool. It has this sub_10D4A function that is called almost at the beginning of the driver's DriverEntry function. It goes as such:...
4
votes
1answer
919 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
1
vote
0answers
59 views

how can i get real hex values of vdso outputs [closed]

I'm trying to get an algorithm in a program but i can't see the hex codes. At the moment i break all debug checks it fully debugging but i can't see how it creates the request.
1
vote
0answers
167 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...
5
votes
1answer
665 views

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I understand that I can execute my script within a session using [0x401000]> . server.py and the pipe will be connected to it when I call r2pipe.open() with no arguments. Ideally I would like to ...
1
vote
0answers
235 views

Reverse engineering IE thick client

Internet Explorer allows for creating thick clients that run in the browser via a Browser Helper Object (BHO). In trying to reverse one such thick client I noticed that the website downloads about ...
0
votes
1answer
1k views

Radare2 cannot debug on windows 7

I downloaded radare 2.5 for windows. I am trying to debug a binary on windows with radare and have tried the following: radare2 -d a.exe fork_and_ptraceme/CreateProcess: The request is not supported. ...
0
votes
1answer
101 views

Empty Parameter an MessagerBox

I am trying to learn to reverse Engineering , i am very new and my English is very Poor... .I wanting to make this exercise , but can't it , because not receive the hWnd identified from the MessageBox ...
3
votes
0answers
337 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
1
vote
1answer
434 views

What are guidelines to find COM functions definition through a proxy DLL? [duplicate]

I've successfully reverse a DLL file which uses a COM interface and found the Class ID (CLSID) and Interface ID (IID). In Visual Studio debugging memory, it shows S_OK with CoCreateInstance() and all ...
0
votes
2answers
972 views

RFLAGS info and Radare?

Stepping through instructions I can see the result of rflags change, rflags C1PSI rflags 1PZI Is there anything that expands this into the appropriate flags. I know Z is Zero-flag, and P is Parity, ...

1
3 4
5
6 7
11