3

which debugger are you using ? most debuggers will decipher the handle on the spot that is you can find out the handle info when you have broken on the WriteProcessMemory() Call itself here is how you can do it with windbg i am debugging ollydbg and olllydbg ais debugging calc.exe ollydbg is setting a breakpoint in calc.exe (uses WriteProcessMemory() ) ...


3

It is also easy using x64dbg. When you break on the WriteProcessMemory the handle will be at [esp+0x4] in the memory. After you write down the handle (in this case 0xDC) you may go to the Handles tab in the x64dbg main window, then Right click -> Refresh. All the handles associated with your debugged process will be listed. Now you need to find the ...


3

There are no set definitions for "32-bit disassembler" and "64-bit disassembler". The terms are in fact ambiguous. 32-bit and 64-bit just refer to CPU architectures. Specifically to things such as register size and bus size. These can apply to many things. Specifically, in the case of a disassembler, they can apply to two things: The CPU architecture for ...


2

You can use jdb to attach to a running program without having compiled it with debug flags. on my machine with jdb located at /usr/local/jdk/jdk1.8.0_202/bin/jdb and pid of my running java process = 14476 sudo /usr/local/jdk/jdk1.8.0_202/bin/jdb -connect sun.jvm.hotspot.jdi.SAPIDAttachingConnector:pid=14476 However if you did not compile your program with ...


2

Many programs, especially malware, start a suspended child process (CreateProcess variants), overwrite its code with their own (WriteProcessMemory with or without VirtualAllocEx) and resume the main thread (ResumeThread). Also look for ReadProcessMemory, it is possible that the call to OpenProcess that you see is actually the same process reading from its ...


1

Is movq rax, xmm0 buggy in Radare2? No, it's just not fully implemented in all debuggers yet. Native Debugger Works! This instruction works fine using the native debugger. The native debugger is launched with r2 -d yourFileGoesHere. Alternatively, if you are already in r2 looking at the file, but r2 wasn't launched with the -d switch, the file can be ...


1

osboxes@osboxes:~/proto/bin$ ll | grep stack0 -rwsr-xr-x 1 root root 22412 Jan 22 07:16 stack0* osboxes@osboxes:~/proto/bin$ ./stack0 bash: ./stack0: No such file or directory The program is marked as executable, but trying to execute it says there is no such file or directory. I didn't even notice it, because radare2 and gdb were able to execute it. ...


1

Eventually, I have used kdsrv(x86) in the host machine : Kdsrv -t tcp:port=5006 And in IDA the following connection string: kdsrv:server=@{tcp:port=5006,server=HOST},trans=@{com:port=com1,baud=115200} and it worked.


1

You can use GDBFrontend. This is a very hackable GDB frontend. Full disclosure: I am the developer.


1

Yep, the answer depends on what exactly you are trying to achieve. In terms of analyzing the .NET app itself, you can get a complete source code by using, e.g. DotPeek written by JetBrains. You can even export it into a fully-functional Visual Studio Project, build it and debug. However, some apps may be obfuscated. Another scenario is when a .NET app is a ...


Only top voted, non community-wiki answers of a minimum length are eligible