3

There are no set definitions for "32-bit disassembler" and "64-bit disassembler". The terms are in fact ambiguous. 32-bit and 64-bit just refer to CPU architectures. Specifically to things such as register size and bus size. These can apply to many things. Specifically, in the case of a disassembler, they can apply to two things: The CPU architecture for ...


3

Not sure why you used pxr as you could get the output with px 1 @ eax+0x4. But another options would be that you could run this opcode and then read the register value of al to get that. But in order to do that you need to use debugger commands instead (of course you need to be in debugging mode): [0x7f5953803e90]> dr? Usage: dr Registers commands | dr ...


3

A more flexible solution using x64dbg In addition to ollydbg2's built-in experimental support, it's relatively easy to achieve something similar in x64dbg, although some manual scripting is required. Using x64dbg's SetExceptionBPX function, you can define any exception to be treated as a breakpoint by x64dbg instead of being treated by regular exception ...


3

if you were on windows then you can try ollydbg v2


2

As an (2019) addition to all the other answers: Try Ghidra. It is the Software Reverse Engineering (SRE) suit of the NSA and it's free and open source. It was leaked as part of Wikileaks' "Vault 7" but the NSA decided to release it and they published it as open source software. It's written in Java and is cross platform, supporting Windows, Linux and ...


2

This is not a radare2 problem. What you are experiencing is "Address space layout randomization" or ASLR. Basically every time that you run the program the addresses are different. all the breakpoints and info still in radare2 but they are not pointing to the same addresses since it change. Radare2 has an option to disable ASLR while you used with radare2 (...


2

The latest r2 (radare2 3.5.0-git) uses dbw command to add watchpoints. [0x00000000]> db? Usage: db # Breakpoints commands ... | dbw <addr> <r/w/rw> Add watchpoint


1

osboxes@osboxes:~/proto/bin$ ll | grep stack0 -rwsr-xr-x 1 root root 22412 Jan 22 07:16 stack0* osboxes@osboxes:~/proto/bin$ ./stack0 bash: ./stack0: No such file or directory The program is marked as executable, but trying to execute it says there is no such file or directory. I didn't even notice it, because radare2 and gdb were able to execute it. ...


1

Eventually, I have used kdsrv(x86) in the host machine : Kdsrv -t tcp:port=5006 And in IDA the following connection string: kdsrv:server=@{tcp:port=5006,server=HOST},trans=@{com:port=com1,baud=115200} and it worked.


1

Depending on the CPU architecture the process targets, there are many dynamic instrumentation tools that can perform this function. However, you have not specified the environment the process of interest runs in. Architecture-specific examples: Intel's pintool. Someone on stackoverflow has already asked about how to use pintool to print all executed ...


1

You can probably find the details in GDB’s source code but I think it just single-steps the program until the condition matches. IIRC this is done for any condition that can’t be handled by a hardware breakpoint.


1

IDE: High Tech RT but it is usually tied up to one TriCore processor with other limitations. However you can compile your C into TriCore executable JTAG Debugger: Mini Wiggler from Infineon or if your budget allows that, Lauterbach. However ECUs are safety critical devices, so they use a system of internal and external watchdogs. If you set a breakpoint in ...


1

You can use GDBFrontend. This is a very hackable GDB frontend. Full disclosure: I am the developer.


1

Yep, the answer depends on what exactly you are trying to achieve. In terms of analyzing the .NET app itself, you can get a complete source code by using, e.g. DotPeek written by JetBrains. You can even export it into a fully-functional Visual Studio Project, build it and debug. However, some apps may be obfuscated. Another scenario is when a .NET app is a ...


Only top voted, non community-wiki answers of a minimum length are eligible