177
Conventions used plus preliminary remarks
I am trimming the output of GDB for brevity since it usually shows the copyright and other information at the beginning of ever session. When I reproduce the output I'll start at the first (gdb) prompt line, or in case or auto-executed commands from the first genuine output line.
In order to distinguish commands ...
63
I started my own gdb frontend called gdbgui which is a server (in python) that lets you access a full-featured frontend in your browser.
Install
pip install gdbgui --upgrade
or download at gdbgui.com
Works on all platforms (Linux, macOS, and Windows) and browsers with JavaScript.
Run
Just type
gdbgui
in your terminal, and your browser will open a new ...
51
Although some people don't care for its interface, it's worth mentioning that GDB has its own built-in GUI as well (called TUI).
You can start GDB in GUI mode with the command: gdb -tui
A quick reference to TUI commands may be found here: http://beej.us/guide/bggdb/#qref
34
SoftICE is pretty much dead. If you're looking for the same look and feel you can always check out Syser or BugChecker. Haven't used them myself as I think most kernel level debugging now a days is done through remote debugging either via a VM or another machine on the network. The same type of person who would use SoftIce would probably use WinDbg today.
...
32
I've generally used Emacs GUD as a GDB frontend.
It isn't too hard to use, allows you to set breakpoints visually (or though the GDB window if you prefer).
It has multiple different views that you can access from a top-level GDB menu:
It also allows niceties like allowing you to inspect values by mousing over them:
In order to use it, you first need to ...
29
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why they discontinued support. SoftICE required constant updates in order to continue working against the various updates of Windows that were coming out, and there ...
29
You can use the Image File Execution Options registry key to specify a debugger which will be launched automatically when the executable starts.
You can also always do the ancient trick of patching an endless loop (EB FE) at the entry point or somewhere later. This would allow you to attach at you leisure, restore the patched bytes and resume the execution.
29
Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI.
Hopper and Radare2 run on Linux as well.
27
My opinion is a bit biased but, for debugging assembler, the best GDB 'frontend' out there is IDA (it supports communication with remote GDB targets). For source code debugging, though, I would recommend KDBG.
22
Even at the risk of severe downvoting, I'd like to side with the plain old gdb prompt and recommend against a GUI frontend. I started out learning more advanced use of GDB by reading Art of Debugging some years ago. It describes GDB and DDD as well as Eclipse as frontends to GDB.
Admittedly most of the time I am using Vim as my IDE on the terminal and tmux (...
18
I'd like to suggest DDD.
If you've got source code, you should check out QTCreator. Its debugger is similar to Visual Studio's, if you're familiar with that.
18
(OP didn't specify if he knows how structures are laid out. Looks like he assumes they aren't complex. I'll answer a more general question to avoid locality issues by assuming the structures are somewhat complex)
Few ways to find the other structures come to mind:
Scanning memory for signatures
Once you have a few examples of the structures, maybe the ...
17
I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently latest release for the 2.x series.
So, to make Immunity Debugger work on Windows 10 modify(and ADD if necessary) the following environment variables(assuming ...
16
Explanation
The break on attach is due to the ntdll DbgUiRemoteBreakin and DbgBreakPoint functions being called. If you check the kernel32 DebugActiveProcess function called by the debugger, OllyDbg or ImmunityDebugger, you will see a call to the CreateRemoteThread, CreateRemoteThreadEx, or ZwCreateThreadEx function depending on your OS.
So, i guess one way ...
16
Debugging software with a combination of managed and unmanaged code:
Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which shows the .Net functions and code perfectly).
There are times when, if the malware makes a lot of calls to unmanaged code (native code DLLs) it is far more ...
15
These terms are currently defined on this site as follows:
Disassembler:
A disassembler is a software tool which transforms machine code into a
human readable mnemonic representation called assembly language.
Debugger:
Debuggers allow the user to view and change the running state of a program.
Decompiler:
Software used to revert the process of ...
13
SoftICE is no longer maintained or widely used. The standard for kernel-mode debugging is currently Windbg. Windbg can also be used for user-mode debugging.
I would recommended you check out the following link for more information about windbg and debugging in general:
http://www.codeproject.com/Articles/6084/Windows-Debuggers-Part-1-A-WinDbg-Tutorial
...
12
Not GUI but a good replacement once you get used to it (and personally I think it's faster for most stuff) -> https://github.com/gdbinit/Gdbinit.
I remembered when I started *nix reversing and I had to face gdb for the first time. Hated it and +mammon original's gdbinit saved my day. These days I prefer gdb to most GUI debuggers.
Give it a try :-)
Full ...
11
I don't really like DDD, it's so 90's in it's GUI.
I would like to recommend KDBG, which is a KDE frontend to gdb.
Besides, you might want to take a look at Cgdb, which is a curses extension for gdb.
Lately I came across Nemiver, it looks really promising.
11
In OllyDBG and ImmunityDbg, in Options->Debugging Options-> Events you have an option "Break on new module". If this option is set, whenever a new DLL is loaded, Olly/Immdbg will break and let you do your business.
In Windbg follow Debug-> Event Filters, in the list you will find Load module, on the side set the options to "Enabled" and "Handeled" which ...
11
You can easily view it using Visual Panels in radare2. Here's a teaser:
Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh
Debugging
To debug a program with radare2 call it with the debug flag -d:
$ r2 -d /bin/ls
Now the program is opened in debug mode.
...
10
Chances are that you are looking into old documents and training material if you are looking into SoftICE. There is no legal way of acquiring the software since it was discontinued at 2006.
The last version of SoftICE was included in Compuware's DriverStudio.
10
The gdb terms (and commands) are step and next and the difference is that step continues to run until it changes line of source code, while next doesn't trace into a subroutine, but rather skips over it. The stepi and nexti commands are similar but operate at the machine instruction level rather than source code level. Read more in The Fine Manual.
Here's an ...
10
Yes, it is possible
I'm going to explain you a bit how most games do it (I have never reversed any GTA but I suppose it's something like this anyway).
I'm going to cover static and dynamic allocation of structures.
The static way:
GlobalGameInfo g_info;
// ...
g_info.some_data = 1;
This is what ends up being a static offset in IDA, like so:
lea eax, [...
10
Go to archives of hack.lu conference here.
You can find there Radare2 workshop materials.
There are some mentions of debugging there.
In addition you have a radare 2 book, see basic debugging session chapter.
I'd suggest to read all the book and workshop materials.
9
So, it is totally untested but here is the result of a few Internet browsing.
First the stack base address is present in /proc/<pid>/maps, then it must be accessible from user-space at some point.
I looked at the code of the pstack command which is printing the content of the stack of a running process. This code is getting the base address from a ...
9
I would suggest this as a solution http://accessroot.com/arteam/site/download.php?view.185 as I had similar problem in one of crackmes. What I did was to write my own hooks for SoftICE to bypass ring0 hooks of int 3 and int 1. Could be useful for your problem. Interesting section is "SoftICE comes to the rescue".
9
This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) of the generated structure.
class test {
int a;
int b;
test() { ...; }
~test() { ...; }
void somefunc() { ...; }
int c;
...
9
edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's.
https://github.com/eteran/edb-debugger
9
The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
Only top voted, non community-wiki answers of a minimum length are eligible
