66
I started my own gdb frontend called gdbgui which is a server (in python) that lets you access a full-featured frontend in your browser.
Install
pip install gdbgui --upgrade
or download at gdbgui.com
Works on all platforms (Linux, macOS, and Windows) and browsers with JavaScript.
Run
Just type
gdbgui
in your terminal, and your browser will open a new ...
29
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why they discontinued support. SoftICE required constant updates in order to continue working against the various updates of Windows that were coming out, and there ...
29
Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI.
Hopper and Radare2 run on Linux as well.
19
(OP didn't specify if he knows how structures are laid out. Looks like he assumes they aren't complex. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex)
Few ways to find the other structures come to mind:
Scanning memory for signatures
Once you have a few examples of the structures, maybe the ...
17
I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently latest release for the 2.x series.
So, to make Immunity Debugger work on Windows 10 modify(and ADD if necessary) the following environment variables(assuming ...
16
Debugging software with a combination of managed and unmanaged code:
Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which shows the .Net functions and code perfectly).
There are times when, if the malware makes a lot of calls to unmanaged code (native code DLLs) it is far more ...
15
These terms are currently defined on this site as follows:
Disassembler:
A disassembler is a software tool which transforms machine code into a
human readable mnemonic representation called assembly language.
Debugger:
Debuggers allow the user to view and change the running state of a program.
Decompiler:
Software used to revert the process of ...
11
In OllyDBG and ImmunityDbg, in Options->Debugging Options-> Events you have an option "Break on new module". If this option is set, whenever a new DLL is loaded, Olly/Immdbg will break and let you do your business.
In Windbg follow Debug-> Event Filters, in the list you will find Load module, on the side set the options to "Enabled" and "Handeled" which ...
11
You can easily view it using Visual Panels in radare2. Here's a teaser:
Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh
Debugging
To debug a program with radare2 call it with the debug flag -d:
$ r2 -d /bin/ls
Now the program is opened in debug mode.
...
10
The gdb terms (and commands) are step and next and the difference is that step continues to run until it changes line of source code, while next doesn't trace into a subroutine, but rather skips over it. The stepi and nexti commands are similar but operate at the machine instruction level rather than source code level. Read more in The Fine Manual.
Here's an ...
10
This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) of the generated structure.
class test {
int a;
int b;
test() { ...; }
~test() { ...; }
void somefunc() { ...; }
int c;
...
10
Yes, it is possible
I'm going to explain you a bit how most games do it (I have never reversed any GTA but I suppose it's something like this anyway).
I'm going to cover static and dynamic allocation of structures.
The static way:
GlobalGameInfo g_info;
// ...
g_info.some_data = 1;
This is what ends up being a static offset in IDA, like so:
lea eax, [...
10
Go to archives of hack.lu conference here.
You can find there Radare2 workshop materials.
There are some mentions of debugging there.
In addition you have a radare 2 book, see basic debugging session chapter.
I'd suggest to read all the book and workshop materials.
9
edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's.
https://github.com/eteran/edb-debugger
9
The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
8
opening a vc commandprompt using
start->programs->vc->vc command prompt
Setting environment for using Microsoft Visual Studio 2010 x86 tools.
creating a tempdir in desktop for compiling and linking
C:\Program Files\Microsoft Visual Studio 10.0\VC>cd "c:\Documents and Settings\Admin\Desktop"
C:\Documents and Settings\Admin\Desktop>md pran
C:...
8
Select the MOV EDI, EAX instruction and press Shift+F4 to open the Conditional log breakpoint window.
In that window, specify eax as the expression, set Pause program to Never, and set Log value of expressions to Always:
Press the OK button, run your program, and now the referenced string will get logged to OllyDbg's log window whenever that instruction is ...
8
IDA can only display functions in graph mode, so in order to see that code as a graph, you must:
Find the start of the function
Search for a prologue, such as push ebp, mov ebp, esp1, and find the start of the function. If it gets hard, you can always load debug symbols2 and find the start like that.
1: Actually, most Microsoft DLLs are compiled with the ...
8
Disclaimer: I am the main developer of x64dbg, take that into account :)
I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If you are working on a modern system I think x64dbg is a better choice because it was designed to work there.
That said, x64dbg isn’t better in all aspects. One ...
7
This is pretty broad subject :-) There are several examples:
GetTickCount() - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of the program and then checking the difference can give you some primitive detection.
time() - Get the current calendar time.
RDTSC - Gets the current value of ...
7
You can navigate back to the previous position simply by pressing ESC. If you want to back to the current IP address, just press the right mouse button a select Jump to IP
.
Alternatively you can press G and set EIP as address.
6
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every x86 with x64):
Extract ScyllaHide (download) anywhere;
Run NtApiTool\x86\PDBReaderx86.exe and when it's finished, copy ...
6
I am not sure if plugins exist but you can write simple scripts like below to hide WinDbg on case to case basis.
Peb->BeingDebugged
r?$t0 = (ntdll!_peb *) @$peb;?? @$t0->BeingDebugged;eb (@$t0+2) 0;?? @$t0->BeingDebugged
ZwSetInformationThread (XP SP3 syscalls with sysenter)
bp ntdll!ZwSetInformationThread "r eip = $ip+0n12 ; r eax = 0; gc"
...
6
I had the same problem at first when trying to connect IDAPro to windbg. What I did was the following:
Manually edit the ida.cfg file located inside .\IDA 6.4\cfg\ directory.
Change the DBGTOOLS path with WinDbg tools directory. For example, to:
DBGTOOLS = "C:\\Program Files (x86)\\Windows Kits\\8.0\\Debuggers\\x86\\";
6
Often times malware and/or obfuscated code (such as unpacking stubs) will do something such as the following:
Set up an exception handler.
Throw an exception.
See if the exception handler caught the exception.
If the exception handler didn't catch the exception then the debugged code knows that a debugger was attached and "swallowed" the exception, thus ...
6
It might be said that the goals (motive) of the investigation rather than the tools or techniques determine whether some work would be classified as digital forensics or reversing.
Definitionally digital forensics is the examination and analysis of digital evidence for use in a legal proceeding. It is certainly true that not all DF is for legal cases, but ...
6
ida pro + hexrays for arm.
IDAPro is best disassembler tool for many processors and file types.
HexRays ARM - plugin for IDAPro (doesn't work separately), which trying to decompile assembler to C-like source code
both not free
https://www.hex-rays.com/index.shtml
6
A call to malloc returns the address of the allocated memory in the eax register on x86, rax on x86_64, and r0 on ARM. Nothing is pushed on the stack. Check the line following the call to malloc & you'll understand !
You should check the calling conventions of your platform too.
Suppose you have this in your code :
int *p = malloc(sizeof(int) * ...
6
It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html
However, Virtual PC is extremely outdated (7 years old) and it's much easier nowadays to do VM kernel debugging with VirtualKD along with VMware or VirtualBox.
6
I've arrived at a solution by researching an answer for one of my Keychain subquestions.
https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x.
According to SecItem.h, this kSecAttrIsExtractable has been introduced with OS X 10.6.
http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/...
Only top voted, non community-wiki answers of a minimum length are eligible
