32 votes
Accepted

How to reverse engineer a Windows 10 UWP app?

I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning. I feel that this answer deserves another post of its own as it'...
TechLord's user avatar
  • 1,046
28 votes
Accepted

Debugging with radare2 using two terminals

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
Megabeets's user avatar
  • 8,909
22 votes

How to reverse engineer a Windows 10 UWP app?

As promised, I am back to post a more specific answer to the question that was asked by the OP. Decided to write this as a separate answer as I believe that this content stands out on its own and ...
TechLord's user avatar
  • 1,046
18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
NirIzr's user avatar
  • 11.7k
12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
Megabeets's user avatar
  • 8,909
11 votes

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Starting with GDB 8.1, there's a special command for this: starti. Example GDB session: $ gdb /bin/true Reading symbols from /bin/true...(no debugging symbols found)...done. (gdb) starti Starting ...
Ruslan's user avatar
  • 283
10 votes
Accepted

When to use OllyDgb over Immunity Debugger

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
Jason Geffner's user avatar
10 votes

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
0xC0000022L's user avatar
  • 10.9k
9 votes
Accepted

How to get current PHP function name in gdb?

According to this link, it should be possible to find the function in use with the following steps: Attach gdb to the currently-running PHP process: gdb -p <processid> Load in the PHP .gdbinit ...
Moshe's user avatar
  • 218
9 votes
Accepted

Faster Kernel debugging for Windows

You want VirtualKd. It is excellent and robust. http://virtualkd.sysprogs.org
Elias Bachaalany's user avatar
9 votes

How to reverse engineer a Windows 10 UWP app?

"I'd like to see details on how to hook and step into the function that processes a button click event in a UWP app." I would suggest using the EventHook Library which is intended to hook global ...
TechLord's user avatar
  • 1,046
8 votes
Accepted

How to stop debugger right after the execution?

Binaries are usually stripped. For ELF binaries, you can check it with file command $ file /bin/true /bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared ...
Hackndo's user avatar
  • 465
8 votes
Accepted

How to change address in the hex view in IDA debugger?

Click on the hex view plane and press G to change the address.
ebux's user avatar
  • 1,759
8 votes
Accepted

How can I set breakpoint and get value of a register with IDApython

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the ...
NirIzr's user avatar
  • 11.7k
8 votes

What is the difference between IDA and OllyDbg?

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA ...
dsasmblr's user avatar
  • 2,204
8 votes

GDB hangs when I try to run and debug a binary

It looks like the problem is partially fixed by running set startup-with-shell off inside the gdb. Why? I don't know, no clue, I just read it somewhere. If anyone has a different solution or know why ...
user3732445's user avatar
7 votes
Accepted

Any documentation available for r2 other than official book

I wrote some articles (search for radare2) about using r2 for crackmes, and there is a talk section on the official website. Also you can find useful articles from the blog. Also, feel free to come ...
jvoisin's user avatar
  • 2,506
7 votes
Accepted

how to setup IDA pro linux GDB server

Ensure that networking is enabled on the guest system and that it can communicate via TCP/IP with the host system. Copy <IDA installation directory>\dbgsrv\linux_serverx64 to your host system ...
Jason Geffner's user avatar
7 votes

How to set a breakpoint on a 64 bit process button with x64dbg?

Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them. After running the exe, go to Handles tab > ...
ThunderCls's user avatar
7 votes
Accepted

x64dbg how to debug a DLL called from an application

I'm going to add my findings as an answer as it turns out its actually very simple in the new debuggers (I don't believe ollyDBG has this function). X32DBG and X64DBG can be used with the same ...
Raz Razman's user avatar
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
Megabeets's user avatar
  • 8,909
7 votes
Accepted

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I'm not sure I fully understood you, but I'll give it a try anyway. The following instructions will explain how to achieve something like this:| radare2 comes with its own webserver. Although at ...
Megabeets's user avatar
  • 8,909
6 votes

How to stop debugger right after the execution?

From http://lldb.llvm.org/tutorial.html: (lldb) process launch --stop-at-entry -- -program_arg value Note your break main is a gdb command; lldbs error message isnt "no such symbol", it's "invalid ...
Guntram Blohm's user avatar
6 votes
Accepted

How to print from pointers in radare2 in debug session

Check out the afa command (a for analysis, f for function, and the latest a for arguments), you should find the value of the args. You can then use pxr (p as in print, x and in hexdump, r as in ...
Maijin's user avatar
  • 880
6 votes

Open-source equivalent for FLIRT

There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API. There are options to support: FLIRT ...
Anton Kochkov's user avatar
6 votes
Accepted

Window application - Does the debugger stop the window thread?

x64dbg's "Threads" page only refreshes once every two seconds, not nearly fast enough to see much going on in threads that are mostly blocked waiting (such as an application's message loop thread). ...
josh poley's user avatar
6 votes

What is the difference between Windbg and local debugger in IDA

The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd. The Windbg plugin is very similar to IDA Pro's Win32 ...
user22363's user avatar
  • 355
6 votes
Accepted

How do I type in hex input into radare2 debug mode?

Write the string in a file: $ echo -e '\x48\x65\x6c\x6c\x6f' > p.text or $ python -c "print('\x48\x65\x6c\x6c\x6f')" > p.text Execute radare2: $ r2 -d program Once ...
Ricardo's user avatar
  • 476
6 votes

x64dbg (x32dbg) log registers every step like windbg

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this ...
mrexodia's user avatar
  • 1,652
5 votes

Decompiling a 1990 DOS application

The Reko Decompiler is updated regularly and works for 16-bit DOS executables. It can generate C code from the disassembly. It's written in C#/.NET so requires mono if you want to run it on linux ...
movAX13h's user avatar
  • 151

Only top scored, non community-wiki answers of a minimum length are eligible