32
votes
Accepted
How to reverse engineer a Windows 10 UWP app?
I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning.
I feel that this answer deserves another post of its own as it'...
- 1,046
28
votes
Accepted
Debugging with radare2 using two terminals
It is actually very simple and works for me just fine as you can see in the following gif:
First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
- 8,909
22
votes
How to reverse engineer a Windows 10 UWP app?
As promised, I am back to post a more specific answer to the question that was asked by the OP.
Decided to write this as a separate answer as I believe that this content stands out on its own and ...
- 1,046
18
votes
Accepted
How to investigate Windows 32/64bit (WOW64) transition
The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
- 11.7k
12
votes
Is there any tool to visually see program stack in linux while debugging?
You can easily view it using Visual Panels in radare2. Here's a teaser:
Installation
First of all, install radare2 from git repository:
$ git clone https://github.com/radare/radare2.git
$ cd radare2
$...
- 8,909
11
votes
Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR
Starting with GDB 8.1, there's a special command for this: starti. Example GDB session:
$ gdb /bin/true
Reading symbols from /bin/true...(no debugging symbols found)...done.
(gdb) starti
Starting ...
- 283
10
votes
Accepted
When to use OllyDgb over Immunity Debugger
Immunity Debugger is forked from OllyDbg v1.10.
So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
- 20.6k
10
votes
Trying to understand this construct in Dbgv.sys driver for DbgView tool
I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
- 10.9k
9
votes
Accepted
How to get current PHP function name in gdb?
According to this link, it should be possible to find the function in use with the following steps:
Attach gdb to the currently-running PHP process: gdb -p <processid>
Load in the PHP .gdbinit ...
- 218
9
votes
Accepted
Faster Kernel debugging for Windows
You want VirtualKd. It is excellent and robust.
http://virtualkd.sysprogs.org
- 216
9
votes
How to reverse engineer a Windows 10 UWP app?
"I'd like to see details on how to hook and step into the function
that processes a button click event in a UWP app."
I would suggest using the EventHook Library which is intended to hook global ...
- 1,046
8
votes
Accepted
How to stop debugger right after the execution?
Binaries are usually stripped. For ELF binaries, you can check it with file command
$ file /bin/true
/bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared ...
- 465
8
votes
Accepted
How to change address in the hex view in IDA debugger?
Click on the hex view plane and press G to change the address.
- 1,759
8
votes
Accepted
How can I set breakpoint and get value of a register with IDApython
I can think of two methods to achieve this:
Using RunTo.
Setting a breakpoint, hooking debugger events and implementing dbg_bpt
1. Using RunTo
This is nearly trivial to do, but does not give the ...
- 11.7k
8
votes
What is the difference between IDA and OllyDbg?
To put it very simply, there are two primary methods of analysis:
Static Analysis: Analyzing an executable while it's not running.
Dynamic Analysis: Analyzing an executable while it's running.
IDA ...
- 2,204
8
votes
GDB hangs when I try to run and debug a binary
It looks like the problem is partially fixed by running set startup-with-shell off inside the gdb. Why? I don't know, no clue, I just read it somewhere.
If anyone has a different solution or know why ...
- 311
7
votes
Accepted
Any documentation available for r2 other than official book
I wrote some articles (search for radare2) about using r2 for crackmes, and there is a talk section on the official website.
Also you can find useful articles from the blog.
Also, feel free to come ...
- 2,506
7
votes
Accepted
how to setup IDA pro linux GDB server
Ensure that networking is enabled on the guest system and that it can communicate via TCP/IP with the host system.
Copy <IDA installation directory>\dbgsrv\linux_serverx64 to your host system ...
- 20.6k
7
votes
How to set a breakpoint on a 64 bit process button with x64dbg?
Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them.
After running the exe, go to Handles tab > ...
- 71
7
votes
Accepted
x64dbg how to debug a DLL called from an application
I'm going to add my findings as an answer as it turns out its actually very simple in the new debuggers (I don't believe ollyDBG has this function).
X32DBG and X64DBG can be used with the same ...
- 341
7
votes
How to break when specific text is found
You are searching for Conditional Breakpoints
OllyDBG
It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00
Conditional Breakpoint
Displays dialog window asking user to ...
- 8,909
7
votes
Accepted
Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?
I'm not sure I fully understood you, but I'll give it a try anyway.
The following instructions will explain how to achieve something like this:|
radare2 comes with its own webserver. Although at ...
- 8,909
6
votes
How to stop debugger right after the execution?
From http://lldb.llvm.org/tutorial.html:
(lldb) process launch --stop-at-entry -- -program_arg value
Note your break main is a gdb command; lldbs error message isnt "no such symbol", it's "invalid ...
- 12.9k
6
votes
Accepted
How to print from pointers in radare2 in debug session
Check out the afa command (a for analysis, f for function, and the latest a for arguments), you should find the value of the args.
You can then use pxr (p as in print, x and in hexdump, r as in ...
- 880
6
votes
Open-source equivalent for FLIRT
There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API.
There are options to support:
FLIRT ...
- 696
6
votes
Accepted
Window application - Does the debugger stop the window thread?
x64dbg's "Threads" page only refreshes once every two seconds, not nearly fast enough to see much going on in threads that are mostly blocked waiting (such as an application's message loop thread).
...
- 851
6
votes
What is the difference between Windbg and local debugger in IDA
The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd.
The Windbg plugin is very similar to IDA Pro's Win32 ...
- 355
6
votes
Accepted
How do I type in hex input into radare2 debug mode?
Write the string in a file:
$ echo -e '\x48\x65\x6c\x6c\x6f' > p.text
or
$ python -c "print('\x48\x65\x6c\x6c\x6f')" > p.text
Execute radare2:
$ r2 -d program
Once ...
- 476
6
votes
x64dbg (x32dbg) log registers every step like windbg
There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com.
In this ...
- 1,652
5
votes
Decompiling a 1990 DOS application
The Reko Decompiler is updated regularly and works for 16-bit DOS executables.
It can generate C code from the disassembly.
It's written in C#/.NET so requires mono if you want to run it on linux ...
- 151
Only top scored, non community-wiki answers of a minimum length are eligible