52
votes
Cross debugging for ARM / MIPS ELF with QEMU/toolchain
Get Ready for an Adventure!
You need a few things for your quest! Let's start at the beginning.
QEMU and GDB
QEMU is an emulator for various architectures. Generally, it's used to emulate an ...
- 2,279
31
votes
Accepted
How to reverse engineer a Windows 10 UWP app?
I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning.
I feel that this answer deserves another post of its own as it'...
- 1,026
28
votes
Accepted
Debugging with radare2 using two terminals
It is actually very simple and works for me just fine as you can see in the following gif:
First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
- 8,579
25
votes
Accepted
How to debug the DLL of an EXE using IDA Pro?
Very easy, if I got you right:
Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page.
In Menu Debugger, Process Options, put the path to your exe into the textbox "...
- 1,804
24
votes
Accepted
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
UPDATE: GDB 8.1 has a starti command, as mentioned below by /u/ruslan
Setting a breakpoint on an unmapped address before starting the target process does this, effectively. It's not correct ...
- 2,279
21
votes
How to reverse engineer a Windows 10 UWP app?
As promised, I am back to post a more specific answer to the question that was asked by the OP.
Decided to write this as a separate answer as I believe that this content stands out on its own and ...
- 1,026
18
votes
Accepted
How can I find the source of a string in an old DOS game?
This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-...
- 2,274
18
votes
Accepted
How to investigate Windows 32/64bit (WOW64) transition
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
- 11.3k
12
votes
Accepted
What is the difference between step into and step over when debugging?
The gdb terms (and commands) are step and next and the difference is that step continues to run until it changes line of source code, while next doesn't trace into a subroutine, but rather skips over ...
- 2,381
12
votes
Is there any tool to visually see program stack in linux while debugging?
You can easily view it using Visual Panels in radare2. Here's a teaser:
Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$...
- 8,579
11
votes
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Starting with GDB 8.1, there's a special command for this: starti. Example GDB session:
$ gdb /bin/true
Reading symbols from /bin/true...(no debugging symbols found)...done.
(gdb) starti
Starting ...
- 283
9
votes
Accepted
How to get current PHP function name in gdb?
According to this link, it should be possible to find the function in use with the following steps:
Attach gdb to the currently-running PHP process: gdb -p <processid>
Load in the PHP .gdbinit ...
- 218
9
votes
Accepted
When to use OllyDgb over Immunity Debugger
Immunity Debugger is forked from OllyDbg v1.10.
So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
- 20.4k
9
votes
How to reverse engineer a Windows 10 UWP app?
"I'd like to see details on how to hook and step into the function
that processes a button click event in a UWP app."
I would suggest using the EventHook Library which is intended to hook global ...
- 1,026
9
votes
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
- 10.5k
8
votes
Accepted
How to stop debugger right after the execution?
Binaries are usually stripped. For ELF binaries, you can check it with file command
$ file /bin/true
/bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared ...
- 455
8
votes
Accepted
How can I set breakpoint and get value of a register with IDApython
I can think of two methods to achieve this:
Using RunTo.
Setting a breakpoint, hooking debugger events and implementing dbg_bpt
1. Using RunTo
This is nearly trivial to do, but does not give the ...
- 11.3k
8
votes
Accepted
Faster Kernel debugging for Windows
You want VirtualKd. It is excellent and robust.
http://virtualkd.sysprogs.org
- 206
7
votes
Accepted
How to start a DOS application in DOSbox in debug mode?
If you build with --enable-debug[=heavy] and run the program via debug.com, it automatically breaks on the first instruction. See the DOS_Execute function in src/dos/dos_execute.cpp and ...
- 1,561
7
votes
WinDbg Debugging without symbols
Make sure if you have the correct breakpoint address
issue lm an exe without symbol will be shown as
0:000> lm
start end module name
00400000 0040f000 image00400000 (no symbols) ...
- 14.8k
7
votes
Accepted
Any documentation available for r2 other than official book
I wrote some articles (search for radare2) about using r2 for crackmes, and there is a talk section on the official website.
Also you can find useful articles from the blog.
Also, feel free to come ...
- 2,486
7
votes
Accepted
how to setup IDA pro linux GDB server
Ensure that networking is enabled on the guest system and that it can communicate via TCP/IP with the host system.
Copy <IDA installation directory>\dbgsrv\linux_serverx64 to your host system ...
- 20.4k
7
votes
How to set a breakpoint on a 64 bit process button with x64dbg?
Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them.
After running the exe, go to Handles tab > ...
- 71
7
votes
How to break when specific text is found
You are searching for Conditional Breakpoints
OllyDBG
It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00
Conditional Breakpoint
Displays dialog window asking user to ...
- 8,579
7
votes
Accepted
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I'm not sure I fully understood you, but I'll give it a try anyway.
The following instructions will explain how to achieve something like this:|
radare2 comes with its own webserver. Although at ...
- 8,579
7
votes
What is the difference between IDA and OllyDbg?
To put it very simply, there are two primary methods of analysis:
Static Analysis: Analyzing an executable while it's not running.
Dynamic Analysis: Analyzing an executable while it's running.
IDA ...
- 2,144
6
votes
Accepted
registers set by function
In general, this concept is referred to as register preservation or register volatility.
From http://en.wikipedia.org/wiki/X86_calling_conventions#Register_preservation --
According to the Intel ...
- 20.4k
6
votes
Accepted
Debugging Virtual Machine using Windbg
It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html
However, Virtual PC is extremely ...
- 20.4k
6
votes
Accepted
How to break on not-yet-loaded kernel driver
For some reason I have yet to determine, every effort to set a breakpoint on this module by name (fdisk.sys) is failing. The driver isn't loaded at bootup (at least, not at the point that I'm ...
- 403
6
votes
Accepted
Why did the program entry point become 'sub esp, 1C'?
No, this is not a bug. Likely this is because you confuse the executable's entry point address (where Olly breaks) with the address of your main() function (where you expect it to break). You should ...
Only top scored, non community-wiki answers of a minimum length are eligible