70
votes
Accepted
Decent GUI for GDB
I started my own gdb frontend called gdbgui which is a server (in python) that lets you access a full-featured frontend in your browser.
Install
pip install gdbgui --upgrade
or download at gdbgui....
- 816
31
votes
Accepted
What is the linux equivalent to OllyDbg and Ida Pro?
Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI.
Hopper and Radare2 run ...
- 12.8k
30
votes
How do I acquire SoftICE?
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why ...
- 401
20
votes
Accepted
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
Debugging software with a combination of managed and unmanaged code:
Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
- 216
17
votes
Accepted
Immunity Debugger on Windows 10?
I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently ...
- 1,043
12
votes
Is there any tool to visually see program stack in linux while debugging?
You can easily view it using Visual Panels in radare2. Here's a teaser:
Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$...
- 8,779
12
votes
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
Disclaimer: I am the main developer of x64dbg, take that into account :)
I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
- 1,622
10
votes
Accepted
Is it possible to find static pointer with disassembler?
Yes, it is possible
I'm going to explain you a bit how most games do it (I have never reversed any GTA but I suppose it's something like this anyway).
I'm going to cover static and dynamic ...
- 1,283
10
votes
What is the linux equivalent to OllyDbg and Ida Pro?
edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's.
https://github.com/eteran/edb-debugger
- 226
10
votes
Accepted
How to debug (like gdb) with radare2?
Go to archives of hack.lu conference here.
You can find there Radare2 workshop materials.
There are some mentions of debugging there.
In addition you have a radare 2 book, see basic debugging ...
- 8,155
9
votes
Displaying IDA names in x64dbg or OllyDbg
The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
- 1,622
9
votes
Accepted
How to switch to "Graph View" in IDA Pro while debugging with WinDbg inside a system DLL?
IDA can only display functions in graph mode, so in order to see that code as a graph, you must:
Find the start of the function
Search for a prologue, such as push ebp, mov ebp, esp1, and find the ...
- 448
8
votes
Accepted
How can I set breakpoint and get value of a register with IDApython
I can think of two methods to achieve this:
Using RunTo.
Setting a breakpoint, hooking debugger events and implementing dbg_bpt
1. Using RunTo
This is nearly trivial to do, but does not give the ...
- 11.6k
7
votes
Accepted
how to attach to a process as soon as it is loaded in memory
One way to do is create a new process using CreateProcess with dwCreationFlags as CREATE_SUSPENDED. Next attach to the suspended process using your debugger, and resume all threads.
Some other way ...
- 5,950
7
votes
Accepted
What is the command to "go to current statement" in IDA debugger?
You can navigate back to the previous position simply by pressing ESC. If you want to back to the current IP address, just press the right mouse button a select Jump to IP
.
Alternatively you can ...
- 1,739
6
votes
Debugger hiding plugin for WinDbg?
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
- 1,622
6
votes
How to reverse a dll and call its functions?
You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:
- 20.6k
6
votes
Accepted
How to print from pointers in radare2 in debug session
Check out the afa command (a for analysis, f for function, and the latest a for arguments), you should find the value of the args.
You can then use pxr (p as in print, x and in hexdump, r as in ...
- 870
6
votes
How can i add plugins in x64dbg?
Download
Download the files
apis_def.zip
xAnalyzer.dp32
xAnalyzer.dp64
from
here
Steps
Copy xAnalyzer.dp32 to x32/plugins directory
Copy xAnalyzer.dp64 to x64/plugins directory
Create a folder ...
5
votes
Accepted
What does Hopper's Debugger Server do?
I'm surprised nobody posted an answer, but here's what I eventually came to realize:
A lot of times disassembling is used for taking apart potential malicious apps like viruses, worms, or malware to ...
- 171
5
votes
What is the linux equivalent to OllyDbg and Ida Pro?
As an (2019) addition to all the other answers:
Try Ghidra.
It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" ...
- 151
5
votes
What is the linux equivalent to OllyDbg and Ida Pro?
I would say radare2. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of ...
- 335
5
votes
Find Address of Windows Kernel Functions
From WinDbg you can use the x command.
For example:
kd> x nt!NtCreateThread
830e4fda nt!NtCreateThread (<no parameter info>)
When I lookup the address for the NtCreateThread ...
- 20.6k
5
votes
Accepted
Find Address of Windows Kernel Functions
It can be done programmatically with a combination of NtQuerySystemInformation, LoadLibraryEx, and GetProcAddress.
The code below may not work perfectly, as I don't have a Windows box to build it for ...
- 2,297
5
votes
Accepted
Getting past a whole lot of anti-debug measures for a windows exe
You can use something like Scylla Hide
https://github.com/nihilus/ScyllaHide
It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida.
...
- 220
4
votes
Decent GUI for GDB
VisualStudio.Code (VS.Code) runs on Linux and has a "Native Debug" extension that lets you use gdb. It has very responsive UI. It's extremely light on resources. The experience somewhat approximates ...
4
votes
Decent GUI for GDB
There is Affnic Debugger GUI. It is not free but a lite version exists. It's available for Windows, Linux & MacOS.
From the official website,
Affinic Debugger GUI .aka. ADG, is designed as a ...
- 5,950
4
votes
Extract non-extractable private key from OS X Keychain
I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here.
In my case, I did the following:
$ pip2 install hexdump pycrypto pyopenssl
$ git clone ...
- 141
4
votes
Accepted
Program crashes after resuming from breakpoint
Basically, your approach is a good first approach. Programs used to be easily crackable using it 10 years ago. But times have changed, and many programs try to detect if they are being cracked and ...
- 12.8k
4
votes
Is there any tool to visually see program stack in linux while debugging?
please have a look to gef it is incredibly useful and continuously improved. Here some notes from the main github page:
Entirely OS Agnostic, NO dependencies: GEF is battery-included and
is ...
- 141
Only top scored, non community-wiki answers of a minimum length are eligible