72 votes
Accepted

Decent GUI for GDB

I started my own gdb frontend called gdbgui which is a server (in python) that lets you access a full-featured frontend in your browser. Install pip install gdbgui --upgrade or download at gdbgui....
cs01's user avatar
  • 836
30 votes

How do I acquire SoftICE?

After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why ...
Rick Papo's user avatar
  • 401
21 votes
Accepted

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Debugging software with a combination of managed and unmanaged code: Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
Clint_2018's user avatar
18 votes
Accepted

Immunity Debugger on Windows 10?

I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently ...
ubnix's user avatar
  • 1,063
14 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
mrexodia's user avatar
  • 1,652
12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
Megabeets's user avatar
  • 8,919
11 votes

What is the linux equivalent to OllyDbg and Ida Pro?

edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's. https://github.com/eteran/edb-debugger
firebitsbr's user avatar
10 votes
Accepted

How to debug (like gdb) with radare2?

Go to archives of hack.lu conference here. You can find there Radare2 workshop materials. There are some mentions of debugging there. In addition you have a radare 2 book, see basic debugging ...
w s's user avatar
  • 8,408
10 votes
Accepted

How to switch to "Graph View" in IDA Pro while debugging with WinDbg inside a system DLL?

IDA can only display functions in graph mode, so in order to see that code as a graph, you must: Find the start of the function Search for a prologue, such as push ebp, mov ebp, esp1, and find the ...
Martin's user avatar
  • 458
9 votes

Displaying IDA names in x64dbg or OllyDbg

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
mrexodia's user avatar
  • 1,652
8 votes
Accepted

How can I set breakpoint and get value of a register with IDApython

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the ...
NirIzr's user avatar
  • 11.7k
7 votes
Accepted

What is the command to "go to current statement" in IDA debugger?

You can navigate back to the previous position simply by pressing ESC. If you want to back to the current IP address, just press the right mouse button a select Jump to IP . Alternatively you can ...
ebux's user avatar
  • 1,759
6 votes
Accepted

How to print from pointers in radare2 in debug session

Check out the afa command (a for analysis, f for function, and the latest a for arguments), you should find the value of the args. You can then use pxr (p as in print, x and in hexdump, r as in ...
Maijin's user avatar
  • 880
6 votes

Debugger hiding plugin for WinDbg?

You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
mrexodia's user avatar
  • 1,652
6 votes

What is the linux equivalent to OllyDbg and Ida Pro?

As an (2019) addition to all the other answers: Try Ghidra. It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" ...
NullDev's user avatar
  • 161
6 votes
Accepted

Find Address of Windows Kernel Functions

It can be done programmatically with a combination of NtQuerySystemInformation, LoadLibraryEx, and GetProcAddress. The code below may not work perfectly, as I don't have a Windows box to build it for ...
Zach Riggle's user avatar
  • 2,317
6 votes

How can i add plugins in x64dbg?

Download Download the files apis_def.zip xAnalyzer.dp32 xAnalyzer.dp64 from here Steps Copy xAnalyzer.dp32 to x32/plugins directory Copy xAnalyzer.dp64 to x64/plugins directory Create a folder ...
GameMaster Greatee's user avatar
5 votes

Decent GUI for GDB

VisualStudio.Code (VS.Code) runs on Linux and has a "Native Debug" extension that lets you use gdb. It has very responsive UI. It's extremely light on resources. The experience somewhat approximates ...
Sergiy Migdalskiy's user avatar
5 votes

What is the linux equivalent to OllyDbg and Ida Pro?

I would say radare2. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of ...
u185619's user avatar
  • 335
5 votes

Find Address of Windows Kernel Functions

From WinDbg you can use the x command. For example: kd> x nt!NtCreateThread 830e4fda nt!NtCreateThread (<no parameter info>) When I lookup the address for the NtCreateThread ...
Jason Geffner's user avatar
5 votes
Accepted

Getting past a whole lot of anti-debug measures for a windows exe

You can use something like Scylla Hide https://github.com/nihilus/ScyllaHide It has plugins for most popular debuggers. It has lots of hiding options and presets for advanced packers like Themida. ...
Ghassan Idriss's user avatar
5 votes

How do you use the Radare debugger with command line arguments (parameters)?

Seems like radare has problems with passing arguments starting with dash ("-"). Please consider open an issue. Anyway, you can pass arguments to radare2 debugged program in several ways. The ...
Megabeets's user avatar
  • 8,919
5 votes

Find base address and memory size of program debugged in gdb

info file shows the memory map of the current process: Local exec file: `/bin/less', file type elf64-x86-64. Entry point: 0x402080 0x0000000000400238 - 0x0000000000400254 is ....
Igor Skochinsky's user avatar
  • 36.4k
4 votes

Extract non-extractable private key from OS X Keychain

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone ...
standy's user avatar
  • 141
4 votes

Is there any tool to visually see program stack in linux while debugging?

please have a look to gef it is incredibly useful and continuously improved. Here some notes from the main github page: Entirely OS Agnostic, NO dependencies: GEF is battery-included and is ...
Alberto's user avatar
  • 141
4 votes

Is there any tool to visually see program stack in linux while debugging?

You can use gdb, for example let see this simple program #include <stdio.h> int main(){ printf("hello world\n"); return 0; } Compile it gcc -o simple simple.c -g Run with gdb gdb ./...
invictus85's user avatar
4 votes
Accepted

Why most debuggers don't auto recognize functions?

As assembly instruction sets are reasonably complex, properly figuring out a function boundaries inside a big executable binaries is a somewhat difficult task. Even IDA, which specializes in that, has ...
NirIzr's user avatar
  • 11.7k
4 votes
Accepted

Disassembly - Why the CMP instruction is multiplying by 2 the value being compared

The cmp instruction does not multiply anything by two. Instead, the piece of code seen in your ollydbg screen shot is the implementation of the following line from the poor quality source code image ...
NirIzr's user avatar
  • 11.7k
4 votes
Accepted

Find base address and memory size of program debugged in gdb

You can do the following: info inferior or print getpid() gives you a process id shell pmap -x {the process id} gives you a memory map of the process (it is not functionality of gdb, pmap is other ...
w s's user avatar
  • 8,408
4 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Outside of maybe custom plug-ins or perhaps buried features and usability differences, there's really no incentive to use OllyDbg over x32dbg/x64dbg. Since OllyDbg was the debugger of choice for so ...
dsasmblr's user avatar
  • 2,234

Only top scored, non community-wiki answers of a minimum length are eligible