3

There are no set definitions for "32-bit disassembler" and "64-bit disassembler". The terms are in fact ambiguous. 32-bit and 64-bit just refer to CPU architectures. Specifically to things such as register size and bus size. These can apply to many things. Specifically, in the case of a disassembler, they can apply to two things: The CPU architecture for ...


3

Not sure why you used pxr as you could get the output with px 1 @ eax+0x4. But another options would be that you could run this opcode and then read the register value of al to get that. But in order to do that you need to use debugger commands instead (of course you need to be in debugging mode): [0x7f5953803e90]> dr? Usage: dr Registers commands | dr ...


3

A more flexible solution using x64dbg In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. Using x64dbg's SetExceptionBPX function, you can define any exception to be treated as a breakpoint by x64dbg instead of being treated by regular exception ...


3

if you were on windows then you can try ollydbg v2


2

As an (2019) addition to all the other answers: Try Ghidra. It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" but the NSA decided to release it and they published it as open source software. It's written in Java and is cross platform, supporting Windows, Linux and ...


2

This is not a radare2 problem. What you are experiencing is "Address space layout randomization" or ASLR. Basically every time that you run the program the addresses are different. all the breakpoints and info still in radare2 but they are not pointing to the same addresses since it change. Radare2 has an option to disable ASLR while you used with radare2 (...


2

The latest r2 (radare2 3.5.0-git) uses dbw command to add watchpoints. [0x00000000]> db? Usage: db # Breakpoints commands ... | dbw <addr> <r/w/rw> Add watchpoint


1

Eventually, I have used kdsrv(x86) in the host machine : Kdsrv -t tcp:port=5006 And in IDA the following connection string: kdsrv:server=@{tcp:port=5006,server=HOST},trans=@{com:port=com1,baud=115200} and it worked.


1

Depending on the CPU architecture the process targets, there are many dynamic instrumentation tools that can perform this function. However, you have not specified the environment the process of interest runs in. Architecture-specific examples: Intel's pintool. Someone on stackoverflow has already asked about how to use pintool to print all executed ...


1

IDE: High Tech RT but it is usually tied up to one TriCore processor with other limitations. However you can compile your C into TriCore executable JTAG Debugger: Mini Wiggler from Infineon or if your budget allows that, Lauterbach. However ECUs are safety critical devices, so they use a system of internal and external watchdogs. If you set a breakpoint in ...


1

In general, stepping back for a debugger is a hard problem. gdb has a limited step back feature but it comes with a cost, see here. But, when you think about it, the whole difficulty solved by the programmer when debugging is to step-back until it reach the bug. This is the whole difficulty and we do not have a nice and automated solution for it right now.


1

I found an easier way with chainbreaker fork. It works with MacOS 10.14 Mojave. See full instructions here. In my case, I did the following: $ pip2 install hexdump pycrypto pyopenssl $ git clone https://github.com/gremwell/chainbreaker.git && cd chainbreaker $ python2 chainbreaker.py -f ~/Library/Keychains/login.keychain-db -p <PASS> $ ...


1

Yep, the answer depends on what exactly you are trying to achieve. In terms of analyzing the .NET app itself, you can get a complete source code by using, e.g. DotPeek written by JetBrains. You can even export it into a fully-functional Visual Studio Project, build it and debug. However, some apps may be obfuscated. Another scenario is when a .NET app is a ...


Only top voted, non community-wiki answers of a minimum length are eligible