We’re rewarding the question askers & reputations are being recalculated! Read more.
7

Binaries are usually stripped. For ELF binaries, you can check it with file command $ file /bin/true /bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x73796652ea437df8ac7b3ba1864a7ac177e27600, stripped Notice the stripped at the end of file's result. It means, among ...


6

Run radare2 in debug mode. r2 -d


5

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to set or modify parameters of simple conditional INT3 breakpoints at one or more addresses addr[naddr] in the memory of the debugged process. [Source: Official ...


5

This is a tricky question. On x86 platform the maximum length of an instruction is 15 bytes. You can read 15 bytes backwards from the current EIP and pass it to Disasm function of BeaEngine. This returns the length of the disassembled instruction. If this equals 15 you have found the previous instruction. If it is less than 15, then pass 1 byte less (i.e ...


5

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.


4

From http://lldb.llvm.org/tutorial.html: (lldb) process launch --stop-at-entry -- -program_arg value Note your break main is a gdb command; lldbs error message isnt "no such symbol", it's "invalid command". To do the same in lldb, use (lldb) breakpoint set --name main


4

This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that Hardware Breakpoints, as its name hints, are depends on the hardware you're running on and thus the implementation of such breakpoints is differ between each ...


4

All messages in a gui application passes through the Application Defined Callback WinProc whose prototype is LRESULT CALLBACK WindowProc( _In_ HWND hwnd, _In_ UINT uMsg, _In_ WPARAM wParam, _In_ LPARAM lParam ); so when you have breakpointed on a wndproc esp -> return Address esp+4 -> hwnd esp+8 -> uMsg ..... ** MSDN Doc ...


4

Open BreakPoint list with {Cntrl-Alt-B} then select all with {Cntrl-A}, then RightClick on selection, go to Groups->Selection->ExportBreakPointAsIDC... to load them in another project go to File->ScriptFile and select saved idc file, then press {Cntrl-Alt-B} to see loaded BreakPionts.


3

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the value becomes visible on the stack. You use it like this: This will break as soon as the value 00E60000 appears on the stack: It should be easy enough to ...


3

You are probably using an obsolete version of radare2. Uninstall your current radare2 version then git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh If you are using archlinux use radare2-git If you are using windows or another platform (like iOS or Android), please use the git link on rada.re or build it. ...


3

Writing an hypervisor The best way to currently do this is by creating a micro-hypervisor, exploiting technologies originally created to support faster virtualization to monitor usermode as well as kernelmode code. This became quite a common replacement for AVs once SSDT hooking was protected by Microsoft using patch-guard. Additionally, a few security ...


3

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed. #include <idc.idc> static main() { for(;;) { StepInto(); if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP) { if (eax == 0) { ...


3

From http://www.delorie.com/gnu/docs/gdb/gdb_29.html: GDB normally ignores breakpoints when it resumes execution, until at least one instruction has been executed. If it did not do this, you would be unable to proceed past a breakpoint without first disabling the breakpoint. This rule applies whether or not the breakpoint already existed when your program ...


3

The options are explained in the help but I guess it could be a little laconic. The actions in Actions group are performed whenever the breakpoint is triggered (also expressed as hit or fired), and the condition (if specified) is satisfied. The actions explained: Break: Suspend the debugged application (default action). You might want to turn it off if you ...


3

if you were on windows then you can try ollydbg v2


3

A more flexible solution using x64dbg In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. Using x64dbg's SetExceptionBPX function, you can define any exception to be treated as a breakpoint by x64dbg instead of being treated by regular exception ...


2

The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the application in lldb, no slide is applied so the addresses are the same. Here is an example of it in action from two different Calculator apps running 0x00000200 ...


2

if you are setting a breakpoint on the specific address 0x412d18 you must make sure that the specific address will be hit ( setting a breakpoint on a specific address and expecting it to break on CreateWindowCalls is not going to work ) to set a common breakpoint to catch all CreateWindow Calls you should set a breakpoint on system dll (user32.dll) you ...


2

Why I can not set the BP ? The warning message in the screenshot is telling you that you can set the BP.


2

MSG Structure is as below typedef struct tagMSG { HWND hwnd; UINT message; WPARAM wParam; LPARAM lParam; DWORD time; POINT pt; } MSG; GetMessageAorW is as below BOOL WINAPI GetMessage( _Out_ LPMSG lpMsg, _In_opt_ HWND hWnd, _In_ UINT wMsgFilterMin, _In_ UINT wMsgFilterMax ); so it takes a pointer to MSG structure ...


2

Yes For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access: The same applies to values in the hex dump: 1: A breakpoint on access will break whenver the address is read, written or executed. An execution breakpoint will never break on read/write.


2

I found out the reason myself and it was truly enlightening! To insert a breakpoint, gcc replaces the bytes at the beginning of the breakpoint location with INT 3 instruction (0xCC byte) and records the original byte replaced in its internal table. The input was writing a shellcode at the location I was trying to set a breakpoint on. Since the shellcode was ...


2

NOTE! I realized afterward that it was about Ollydbg... Anyway, I stick to my answer... GDB is great! GDB is a wonderful debugger! In fact, and only a few people knows about it, it gives access to all the usual libc functions. For example, in your case, you may find interesting to set up a conditional on a breakpoint like that (by using strcmp()): break *...


2

This is a limitation of OllyDbg v1. There are a couple of plugins designed to fix this in v1 (such as Breakpoint Manager), but the better solution is to upgrade to OllyDbg v2.


2

The various bits in the DR7 (debug control) register determines the applicability of the hardware breakpoint in question. Such breakpoints can be local or global. Global breakpoint, as its name suggests affects all tasks. Local breakpoint are specific to the currently executing task. For the Intel Architecture, local breakpoint enable flag bits in the DR7 ...


2

You can use IDC functions to write to memory addresses. I recommend write_dbg_memory() function. write_dbg_memory(ESP+8, 0, size) https://www.hex-rays.com/products/ida/support/idapython_docs/ Actually the line/s you put in condition of a breakpoint is also considered as a script which is executed when encountering the BP. So it has to follow the rules of ...


2

This type of breakpoint is done through the use of hardware breakpoints. Hardware breakpoints set the debug registers for the thread context (dr0-dr3). The first four debug registers specify the address for the breakpoint, dr7 enables you to specify the condition for each hardware breakpoint set (write, general access, execute). IDA implements this in its ...


2

open procmon from sysinternals add a filter with your process name and take a look at stack trace if you have configured symbols then you get a pretty good overview a small python server and client (mod from wiki.python) :\>cat server.py import socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.bind(('127.0.0.1', 5005)) s.listen(1) ...


2

This happens due to way the Win32 debugging API implements process attaching. A new thread with DbgBreakPoint call is injected by the OS to ensure that the process gets stopped, since it could be in unknown state otherwise, and this thread is what you see. What you can do is inspect the thread list, switch to the main one (usually first in the list), set ...


Only top voted, non community-wiki answers of a minimum length are eligible