32 votes
Accepted

How to reverse engineer a Windows 10 UWP app?

I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning. I feel that this answer deserves another post of its own as it'...
TechLord's user avatar
  • 1,046
28 votes
Accepted

Debugging with radare2 using two terminals

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
Megabeets's user avatar
  • 8,989
22 votes

How to reverse engineer a Windows 10 UWP app?

As promised, I am back to post a more specific answer to the question that was asked by the OP. Decided to write this as a separate answer as I believe that this content stands out on its own and ...
TechLord's user avatar
  • 1,046
18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
NirIzr's user avatar
  • 11.8k
12 votes

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Starting with GDB 8.1, there's a special command for this: starti. Example GDB session: $ gdb /bin/true Reading symbols from /bin/true...(no debugging symbols found)...done. (gdb) starti Starting ...
Ruslan's user avatar
  • 293
12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
Megabeets's user avatar
  • 8,989
10 votes
Accepted

Faster Kernel debugging for Windows

You want VirtualKd. It is excellent and robust. http://virtualkd.sysprogs.org
Elias Bachaalany's user avatar
10 votes

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
0xC0000022L's user avatar
  • 10.9k
9 votes
Accepted

How to get current PHP function name in gdb?

According to this link, it should be possible to find the function in use with the following steps: Attach gdb to the currently-running PHP process: gdb -p <processid> Load in the PHP .gdbinit ...
Moshe's user avatar
  • 218
9 votes

How to reverse engineer a Windows 10 UWP app?

"I'd like to see details on how to hook and step into the function that processes a button click event in a UWP app." I would suggest using the EventHook Library which is intended to hook global ...
TechLord's user avatar
  • 1,046
9 votes

What is the difference between IDA and OllyDbg?

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA ...
dsasmblr's user avatar
  • 2,234
8 votes
Accepted

How to change address in the hex view in IDA debugger?

Click on the hex view plane and press G to change the address.
ebux's user avatar
  • 1,759
8 votes
Accepted

How can I set breakpoint and get value of a register with IDApython

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the ...
NirIzr's user avatar
  • 11.8k
8 votes
Accepted

x64dbg how to debug a DLL called from an application

I'm going to add my findings as an answer as it turns out its actually very simple in the new debuggers (I don't believe ollyDBG has this function). X32DBG and X64DBG can be used with the same ...
Raz Razman's user avatar
8 votes

GDB hangs when I try to run and debug a binary

It looks like the problem is partially fixed by running set startup-with-shell off inside the gdb. Why? I don't know, no clue, I just read it somewhere. If anyone has a different solution or know why ...
user3732445's user avatar
7 votes

How to set a breakpoint on a 64 bit process button with x64dbg?

Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them. After running the exe, go to Handles tab > ...
ThunderCls's user avatar
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
Megabeets's user avatar
  • 8,989
7 votes
Accepted

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I'm not sure I fully understood you, but I'll give it a try anyway. The following instructions will explain how to achieve something like this:| radare2 comes with its own webserver. Although at ...
Megabeets's user avatar
  • 8,989
6 votes

Decompiling a 1990 DOS application

The Reko Decompiler is updated regularly and works for 16-bit DOS executables. It can generate C code from the disassembly. It's written in C#/.NET so requires mono if you want to run it on linux ...
movAX13h's user avatar
  • 161
6 votes

Open-source equivalent for FLIRT

There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API. There are options to support: FLIRT ...
Anton Kochkov's user avatar
6 votes
Accepted

Window application - Does the debugger stop the window thread?

x64dbg's "Threads" page only refreshes once every two seconds, not nearly fast enough to see much going on in threads that are mostly blocked waiting (such as an application's message loop thread). ...
josh poley's user avatar
6 votes

What is the difference between Windbg and local debugger in IDA

The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd. The Windbg plugin is very similar to IDA Pro's Win32 ...
user22363's user avatar
  • 365
6 votes

What is the difference between IDA and OllyDbg?

OllyDbg is a debugger for Windows x32 and x64 and its only focus is dynamic analysis, although it can be also used for non deep static analysis. IDA is the de-facto tool for doing static analysis and ...
joxeankoret's user avatar
  • 4,488
6 votes
Accepted

How do I type in hex input into radare2 debug mode?

Write the string in a file: $ echo -e '\x48\x65\x6c\x6c\x6f' > p.text or $ python -c "print('\x48\x65\x6c\x6c\x6f')" > p.text Execute radare2: $ r2 -d program Once ...
Ricardo's user avatar
  • 476
6 votes

x64dbg (x32dbg) log registers every step like windbg

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this ...
mrexodia's user avatar
  • 1,652
5 votes

OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...
mrexodia's user avatar
  • 1,652
5 votes
Accepted

Debug a .dll file within powershell

The file decrypter.dll is a .NET dll which (if it's not obfuscated) means you can decompile it to full readable source code with tools like Reflector, dotPeek or JustDecompile. Here are a couple of ...
Remko's user avatar
  • 3,228
5 votes

How to reverse engineer a Windows 10 UWP app?

I searched in the System32 folder inside every file named SystemSettting*.* for the word Shutdown. I used Total Commander as it can search with multiple encodings such as ASCII and Unicode: Then ...
Remko's user avatar
  • 3,228
5 votes

How do you use the Radare debugger with command line arguments (parameters)?

Seems like radare has problems with passing arguments starting with dash ("-"). Please consider open an issue. Anyway, you can pass arguments to radare2 debugged program in several ways. The ...
Megabeets's user avatar
  • 8,989
5 votes

Does IDA support remote debugging in their Freeware Version?

I'll start by saying that there's already IDA Free 7.0 which is much better than version 5.0. However, both the free edition of IDA 7.0 and IDA 5.0 are not supporting remote debugging of any kind. Hex-...
Megabeets's user avatar
  • 8,989

Only top scored, non community-wiki answers of a minimum length are eligible