68 votes
Accepted

Decent GUI for GDB

I started my own gdb frontend called gdbgui which is a server (in python) that lets you access a full-featured frontend in your browser. Install pip install gdbgui --upgrade or download at gdbgui....
user avatar
  • 796
31 votes
Accepted

What is the linux equivalent to OllyDbg and Ida Pro?

Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI. Hopper and Radare2 run ...
user avatar
29 votes

How do I acquire SoftICE?

After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why ...
user avatar
  • 391
19 votes
Accepted

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Debugging software with a combination of managed and unmanaged code: Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
user avatar
  • 206
17 votes
Accepted

Immunity Debugger on Windows 10?

I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently ...
user avatar
  • 1,043
15 votes
Accepted

What's the difference between a disassembler, debugger and decompiler?

These terms are currently defined on this site as follows: Disassembler: A disassembler is a software tool which transforms machine code into a human readable mnemonic representation called ...
user avatar
12 votes
Accepted

What is the difference between step into and step over when debugging?

The gdb terms (and commands) are step and next and the difference is that step continues to run until it changes line of source code, while next doesn't trace into a subroutine, but rather skips over ...
user avatar
  • 2,381
12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
user avatar
  • 8,589
12 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
user avatar
  • 1,602
10 votes
Accepted

How to find the location of the vtable?

This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) ...
user avatar
10 votes

What is the linux equivalent to OllyDbg and Ida Pro?

edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's. https://github.com/eteran/edb-debugger
user avatar
10 votes
Accepted

Is it possible to find static pointer with disassembler?

Yes, it is possible I'm going to explain you a bit how most games do it (I have never reversed any GTA but I suppose it's something like this anyway). I'm going to cover static and dynamic ...
user avatar
  • 1,253
10 votes
Accepted

How to debug (like gdb) with radare2?

Go to archives of hack.lu conference here. You can find there Radare2 workshop materials. There are some mentions of debugging there. In addition you have a radare 2 book, see basic debugging ...
user avatar
  • 7,710
9 votes

Displaying IDA names in x64dbg or OllyDbg

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
user avatar
  • 1,602
9 votes
Accepted

How to switch to "Graph View" in IDA Pro while debugging with WinDbg inside a system DLL?

IDA can only display functions in graph mode, so in order to see that code as a graph, you must: Find the start of the function Search for a prologue, such as push ebp, mov ebp, esp1, and find the ...
user avatar
  • 428
8 votes
Accepted

How can I set breakpoint and get value of a register with IDApython

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the ...
user avatar
  • 11.3k
7 votes
Accepted

What is the command to "go to current statement" in IDA debugger?

You can navigate back to the previous position simply by pressing ESC. If you want to back to the current IP address, just press the right mouse button a select Jump to IP . Alternatively you can ...
user avatar
  • 1,731
6 votes

Debugger hiding plugin for WinDbg?

You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
user avatar
  • 1,602
6 votes
Accepted

At which address on the stack or in memory is eax stored after the malloc call?

A call to malloc returns the address of the allocated memory in the eax register on x86, rax on x86_64, and r0 on ARM. Nothing is pushed on the stack. Check the line following the call to malloc & ...
user avatar
  • 2,603
6 votes
Accepted

Debugging Virtual Machine using Windbg

It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html However, Virtual PC is extremely ...
user avatar
6 votes

Extract non-extractable private key from OS X Keychain

I've arrived at a solution by researching an answer for one of my Keychain subquestions. https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x. According to ...
user avatar
  • 289
6 votes
Accepted

how to attach to a process as soon as it is loaded in memory

One way to do is create a new process using CreateProcess with dwCreationFlags as CREATE_SUSPENDED. Next attach to the suspended process using your debugger, and resume all threads. Some other way ...
user avatar
  • 5,850
6 votes

How to reverse a dll and call its functions?

You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:
user avatar
6 votes
Accepted

How to print from pointers in radare2 in debug session

Check out the afa command (a for analysis, f for function, and the latest a for arguments), you should find the value of the args. You can then use pxr (p as in print, x and in hexdump, r as in ...
user avatar
  • 862
6 votes

How can i add plugins in x64dbg?

Download Download the files apis_def.zip xAnalyzer.dp32 xAnalyzer.dp64 from here Steps Copy xAnalyzer.dp32 to x32/plugins directory Copy xAnalyzer.dp64 to x64/plugins directory Create a folder ...
user avatar
5 votes

Anti-debug techniques for MS-Windows?

@peter-ferrie compiled a very good list of anti-debugging tricks at http://pferrie.host22.com/papers/antidebug.pdf The server for the link above seems to be down right now, but there's a copy at ...
user avatar
5 votes
Accepted

Which condition has to be met to execute this if branch

Extended Base Pointer, as the name suggests, is usually used as a frame pointer. That, among other things, means that it's used to access function parameters and local variables. If you think about ...
user avatar
  • 4,624
5 votes

At which address on the stack or in memory is eax stored after the malloc call?

Normally, return values are stored in eax. Structures and Floats/Doubles may be exceptions, depending on the ABI & the compiler used, but for malloc, eax is the return value. So nowhere on the ...
user avatar
5 votes

Reverse engineer Android native code

Get the Android NDK and unzip. Use objdump as follows: android-ndk-r9d\toolchains\arm-linux-androideabi-4.6\prebuilt\windows-x86_64\arm-linux-androideabi\bin\objdump.exe -d libinquestion_jni.so > ...
user avatar
  • 151
5 votes

What is the linux equivalent to OllyDbg and Ida Pro?

I would say radare2. It is opensource fast moving project, and it has analysis capibilites similar to that of ida, and supports many architectures like x86 and the 64bit version of x86 plus lots of ...
user avatar
  • 335

Only top scored, non community-wiki answers of a minimum length are eligible