67
I started my own gdb frontend called gdbgui which is a server (in python) that lets you access a full-featured frontend in your browser.
Install
pip install gdbgui --upgrade
or download at gdbgui.com
Works on all platforms (Linux, macOS, and Windows) and browsers with JavaScript.
Run
Just type
gdbgui
in your terminal, and your browser will open a new ...
29
After buying NuMega technologies in 1997, Compuware seemed to feel that SoftICE was a liability, both technically and legally (as the #1 hacker tool of the time), and that may have played into why they discontinued support. SoftICE required constant updates in order to continue working against the various updates of Windows that were coming out, and there ...
29
Ida Pro runs on Windows, Linux and Mac OS, so i guess the Linux equivalent of Ida Pro is Ida Pro. The debugger that's used mostly seems to be gdb, possibly enhanced with a GUI.
Hopper and Radare2 run on Linux as well.
18
Debugging software with a combination of managed and unmanaged code:
Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which shows the .Net functions and code perfectly).
There are times when, if the malware makes a lot of calls to unmanaged code (native code DLLs) it is far more ...
17
I am running Windows 10 x64 and I had the same problem as you do. The problem is with the environment variables regarding your Python installation. I am using Python 2.7.11 which is the currently latest release for the 2.x series.
So, to make Immunity Debugger work on Windows 10 modify(and ADD if necessary) the following environment variables(assuming ...
15
These terms are currently defined on this site as follows:
Disassembler:
A disassembler is a software tool which transforms machine code into a
human readable mnemonic representation called assembly language.
Debugger:
Debuggers allow the user to view and change the running state of a program.
Decompiler:
Software used to revert the process of ...
11
In OllyDBG and ImmunityDbg, in Options->Debugging Options-> Events you have an option "Break on new module". If this option is set, whenever a new DLL is loaded, Olly/Immdbg will break and let you do your business.
In Windbg follow Debug-> Event Filters, in the list you will find Load module, on the side set the options to "Enabled" and "Handeled" which ...
11
You can easily view it using Visual Panels in radare2. Here's a teaser:
Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$ ./sys/install.sh
Debugging
To debug a program with radare2 call it with the debug flag -d:
$ r2 -d /bin/ls
Now the program is opened in debug mode.
...
10
The gdb terms (and commands) are step and next and the difference is that step continues to run until it changes line of source code, while next doesn't trace into a subroutine, but rather skips over it. The stepi and nexti commands are similar but operate at the machine instruction level rather than source code level. Read more in The Fine Manual.
Here's an ...
10
This is compiler dependent - the compiler may place the vtable wherever it wants to, as long as it does it consistently. However, in most cases, the vtable pointer is the first element (at offset 0) of the generated structure.
class test {
int a;
int b;
test() { ...; }
~test() { ...; }
void somefunc() { ...; }
int c;
...
10
Yes, it is possible
I'm going to explain you a bit how most games do it (I have never reversed any GTA but I suppose it's something like this anyway).
I'm going to cover static and dynamic allocation of structures.
The static way:
GlobalGameInfo g_info;
// ...
g_info.some_data = 1;
This is what ends up being a static offset in IDA, like so:
lea eax, [...
10
Go to archives of hack.lu conference here.
You can find there Radare2 workshop materials.
There are some mentions of debugging there.
In addition you have a radare 2 book, see basic debugging session chapter.
I'd suggest to read all the book and workshop materials.
10
Disclaimer: I am the main developer of x64dbg, take that into account :)
I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If you are working on a modern system I think x64dbg is a better choice because it was designed to work there.
That said, x64dbg isn’t better in all aspects. One ...
9
edb is a cross platform x86/x86-64 debugger. It was inspired by Ollydbg, but aims to function on x86 and x86-64 as well as multiple OS's.
https://github.com/eteran/edb-debugger
9
The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
8
opening a vc commandprompt using
start->programs->vc->vc command prompt
Setting environment for using Microsoft Visual Studio 2010 x86 tools.
creating a tempdir in desktop for compiling and linking
C:\Program Files\Microsoft Visual Studio 10.0\VC>cd "c:\Documents and Settings\Admin\Desktop"
C:\Documents and Settings\Admin\Desktop>md pran
C:...
8
Select the MOV EDI, EAX instruction and press Shift+F4 to open the Conditional log breakpoint window.
In that window, specify eax as the expression, set Pause program to Never, and set Log value of expressions to Always:
Press the OK button, run your program, and now the referenced string will get logged to OllyDbg's log window whenever that instruction is ...
8
IDA can only display functions in graph mode, so in order to see that code as a graph, you must:
Find the start of the function
Search for a prologue, such as push ebp, mov ebp, esp1, and find the start of the function. If it gets hard, you can always load debug symbols2 and find the start like that.
1: Actually, most Microsoft DLLs are compiled with the ...
7
This is pretty broad subject :-) There are several examples:
GetTickCount() - Retrieves the number of milliseconds that have elapsed since the system was started. Putting those in different parts of the program and then checking the difference can give you some primitive detection.
time() - Get the current calendar time.
RDTSC - Gets the current value of ...
7
You can navigate back to the previous position simply by pressing ESC. If you want to back to the current IP address, just press the right mouse button a select Jump to IP
.
Alternatively you can press G and set EIP as address.
6
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every x86 with x64):
Extract ScyllaHide (download) anywhere;
Run NtApiTool\x86\PDBReaderx86.exe and when it's finished, copy ...
6
It might be said that the goals (motive) of the investigation rather than the tools or techniques determine whether some work would be classified as digital forensics or reversing.
Definitionally digital forensics is the examination and analysis of digital evidence for use in a legal proceeding. It is certainly true that not all DF is for legal cases, but ...
6
ida pro + hexrays for arm.
IDAPro is best disassembler tool for many processors and file types.
HexRays ARM - plugin for IDAPro (doesn't work separately), which trying to decompile assembler to C-like source code
both not free
https://www.hex-rays.com/index.shtml
6
A call to malloc returns the address of the allocated memory in the eax register on x86, rax on x86_64, and r0 on ARM. Nothing is pushed on the stack. Check the line following the call to malloc & you'll understand !
You should check the calling conventions of your platform too.
Suppose you have this in your code :
int *p = malloc(sizeof(int) * ...
6
It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html
However, Virtual PC is extremely outdated (7 years old) and it's much easier nowadays to do VM kernel debugging with VirtualKD along with VMware or VirtualBox.
6
I've arrived at a solution by researching an answer for one of my Keychain subquestions.
https://stackoverflow.com/questions/25109994/non-extractable-private-key-in-keychain-on-os-x.
According to SecItem.h, this kSecAttrIsExtractable has been introduced with OS X 10.6.
http://opensource.apple.com/source/Security/Security-55471.14/libsecurity_keychain/lib/...
6
You can use OllyDbg's loaddll.exe to load a DLL and call (and debug) its functions:
6
Check out the afa command (a for analysis, f for function, and the latest a for arguments), you should find the value of the args.
You can then use pxr (p as in print, x and in hexdump, r as in reference): pxr 1 @ ebp+0x8, 1 to get the first reference.
6
I can think of two methods to achieve this:
Using RunTo.
Setting a breakpoint, hooking debugger events and implementing dbg_bpt
1. Using RunTo
This is nearly trivial to do, but does not give the same amount of control as the second approach. It might be better for quick and dirty type of solutions, if that's what you're after.
Calling idc.RunTo(ea) will ...
5
Get the Android NDK and unzip. Use objdump as follows:
android-ndk-r9d\toolchains\arm-linux-androideabi-4.6\prebuilt\windows-x86_64\arm-linux-androideabi\bin\objdump.exe -d libinquestion_jni.so > libinquestion_jni.txt
While trying different disassemblers, I explored that they are not capable to decode every byte sequence, and even worse, they can ...
Only top voted, non community-wiki answers of a minimum length are eligible