7

Binaries are usually stripped. For ELF binaries, you can check it with file command $ file /bin/true /bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26, BuildID[sha1]=0x73796652ea437df8ac7b3ba1864a7ac177e27600, stripped Notice the stripped at the end of file's result. It means, among ...


6

Run radare2 in debug mode. r2 -d


5

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to set or modify parameters of simple conditional INT3 breakpoints at one or more addresses addr[naddr] in the memory of the debugged process. [Source: Official ...


5

This is a tricky question. On x86 platform the maximum length of an instruction is 15 bytes. You can read 15 bytes backwards from the current EIP and pass it to Disasm function of BeaEngine. This returns the length of the disassembled instruction. If this equals 15 you have found the previous instruction. If it is less than 15, then pass 1 byte less (i.e ...


5

This is a really good question since this topic isn't as popular as anti-debugging techniques to detect software breakpoints. Since you didn't mention the architecture we have to keep in mind that Hardware Breakpoints, as its name hints, are depends on the hardware you're running on and thus the implementation of such breakpoints is differ between each ...


5

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.


4

From http://www.delorie.com/gnu/docs/gdb/gdb_29.html: GDB normally ignores breakpoints when it resumes execution, until at least one instruction has been executed. If it did not do this, you would be unable to proceed past a breakpoint without first disabling the breakpoint. This rule applies whether or not the breakpoint already existed when your program ...


4

From http://lldb.llvm.org/tutorial.html: (lldb) process launch --stop-at-entry -- -program_arg value Note your break main is a gdb command; lldbs error message isnt "no such symbol", it's "invalid command". To do the same in lldb, use (lldb) breakpoint set --name main


4

All messages in a gui application passes through the Application Defined Callback WinProc whose prototype is LRESULT CALLBACK WindowProc( _In_ HWND hwnd, _In_ UINT uMsg, _In_ WPARAM wParam, _In_ LPARAM lParam ); so when you have breakpointed on a wndproc esp -> return Address esp+4 -> hwnd esp+8 -> uMsg ..... ** MSDN Doc ...


4

Open BreakPoint list with {Cntrl-Alt-B} then select all with {Cntrl-A}, then RightClick on selection, go to Groups->Selection->ExportBreakPointAsIDC... to load them in another project go to File->ScriptFile and select saved idc file, then press {Cntrl-Alt-B} to see loaded BreakPionts.


3

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the value becomes visible on the stack. You use it like this: This will break as soon as the value 00E60000 appears on the stack: It should be easy enough to ...


3

You are probably using an obsolete version of radare2. Uninstall your current radare2 version then git clone https://github.com/radare/radare2 && cd radare2 && ./sys/install.sh If you are using archlinux use radare2-git If you are using windows or another platform (like iOS or Android), please use the git link on rada.re or build it. ...


3

Writing an hypervisor The best way to currently do this is by creating a micro-hypervisor, exploiting technologies originally created to support faster virtualization to monitor usermode as well as kernelmode code. This became quite a common replacement for AVs once SSDT hooking was protected by Microsoft using patch-guard. Additionally, a few security ...


3

You can use the following IDC script for the purpose. It would stop whenever register eax contains 0. The debugger must be running when the script is executed. #include <idc.idc> static main() { for(;;) { StepInto(); if (GetDebuggerEvent(WFNE_SUSP, -1) == STEP) { if (eax == 0) { ...


3

The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the application in lldb, no slide is applied so the addresses are the same. Here is an example of it in action from two different Calculator apps running 0x00000200 ...


3

The options are explained in the help but I guess it could be a little laconic. The actions in Actions group are performed whenever the breakpoint is triggered (also expressed as hit or fired), and the condition (if specified) is satisfied. The actions explained: Break: Suspend the debugged application (default action). You might want to turn it off if you ...


3

Your breakpoint doesn't work as it is put in the part of the code that is not executed with the pass your provided. I'll try not to give too much hint so that you can still solve it by yourself. You wrote Now I can see that the instruction | ========< 0x0040178f 7519 jne 0x4017aa compare the password with the parameter passed as argument. This is ...


3

rip = x64 eip = x86 dr shows eip in your case it is probably some demangled name (not sure why radare2 inserts the GLIBC part ) but if you strip the GLIBC part you can use iD Command to demangle it to std::cout [0x01012d6c]> iD cxx _ZSt4cout__GLIBCXX_3.4 [0x01012d6c]> iD cxx _ZSt4cout__GLIBCXX_ [0x01012d6c]> iD cxx _ZSt4cout__GLIBCXX [...


3

if you were on windows then you can try ollydbg v2


3

A more flexible solution using x64dbg In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. Using x64dbg's SetExceptionBPX function, you can define any exception to be treated as a breakpoint by x64dbg instead of being treated by regular exception ...


2

if you are setting a breakpoint on the specific address 0x412d18 you must make sure that the specific address will be hit ( setting a breakpoint on a specific address and expecting it to break on CreateWindowCalls is not going to work ) to set a common breakpoint to catch all CreateWindow Calls you should set a breakpoint on system dll (user32.dll) you ...


2

Why I can not set the BP ? The warning message in the screenshot is telling you that you can set the BP.


2

This is a limitation of OllyDbg v1. There are a couple of plugins designed to fix this in v1 (such as Breakpoint Manager), but the better solution is to upgrade to OllyDbg v2.


2

NOTE! I realized afterward that it was about Ollydbg... Anyway, I stick to my answer... GDB is great! GDB is a wonderful debugger! In fact, and only a few people knows about it, it gives access to all the usual libc functions. For example, in your case, you may find interesting to set up a conditional on a breakpoint like that (by using strcmp()): break *...


2

MSG Structure is as below typedef struct tagMSG { HWND hwnd; UINT message; WPARAM wParam; LPARAM lParam; DWORD time; POINT pt; } MSG; GetMessageAorW is as below BOOL WINAPI GetMessage( _Out_ LPMSG lpMsg, _In_opt_ HWND hWnd, _In_ UINT wMsgFilterMin, _In_ UINT wMsgFilterMax ); so it takes a pointer to MSG structure ...


2

Yes For a memory access breakpoint1, just right click the desired address > Breakpoint > Memory, on access: The same applies to values in the hex dump: 1: A breakpoint on access will break whenver the address is read, written or executed. An execution breakpoint will never break on read/write.


2

I found out the reason myself and it was truly enlightening! To insert a breakpoint, gcc replaces the bytes at the beginning of the breakpoint location with INT 3 instruction (0xCC byte) and records the original byte replaced in its internal table. The input was writing a shellcode at the location I was trying to set a breakpoint on. Since the shellcode was ...


2

The various bits in the DR7 (debug control) register determines the applicability of the hardware breakpoint in question. Such breakpoints can be local or global. Global breakpoint, as its name suggests affects all tasks. Local breakpoint are specific to the currently executing task. For the Intel Architecture, local breakpoint enable flag bits in the DR7 ...


2

You can use IDC functions to write to memory addresses. I recommend write_dbg_memory() function. write_dbg_memory(ESP+8, 0, size) https://www.hex-rays.com/products/ida/support/idapython_docs/ Actually the line/s you put in condition of a breakpoint is also considered as a script which is executed when encountering the BP. So it has to follow the rules of ...


2

This type of breakpoint is done through the use of hardware breakpoints. Hardware breakpoints set the debug registers for the thread context (dr0-dr3). The first four debug registers specify the address for the breakpoint, dr7 enables you to specify the condition for each hardware breakpoint set (write, general access, execute). IDA implements this in its ...


Only top voted, non community-wiki answers of a minimum length are eligible