52 votes

Cross debugging for ARM / MIPS ELF with QEMU/toolchain

Get Ready for an Adventure! You need a few things for your quest! Let's start at the beginning. QEMU and GDB QEMU is an emulator for various architectures. Generally, it's used to emulate an ...
user avatar
  • 2,279
31 votes
Accepted

How to reverse engineer a Windows 10 UWP app?

I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning. I feel that this answer deserves another post of its own as it'...
user avatar
  • 1,026
28 votes
Accepted

Debugging with radare2 using two terminals

It is actually very simple and works for me just fine as you can see in the following gif: First you need to figure out the tty of the terminal you want to redirect the STDIO to (a.k.a Terminal 2, T2)...
user avatar
  • 8,579
25 votes
Accepted

How to debug the DLL of an EXE using IDA Pro?

Very easy, if I got you right: Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page. In Menu Debugger, Process Options, put the path to your exe into the textbox "...
user avatar
  • 1,804
24 votes
Accepted

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

UPDATE: GDB 8.1 has a starti command, as mentioned below by /u/ruslan Setting a breakpoint on an unmapped address before starting the target process does this, effectively. It's not correct ...
user avatar
  • 2,279
21 votes

How to reverse engineer a Windows 10 UWP app?

As promised, I am back to post a more specific answer to the question that was asked by the OP. Decided to write this as a separate answer as I believe that this content stands out on its own and ...
user avatar
  • 1,026
18 votes
Accepted

How can I find the source of a string in an old DOS game?

This program uses the PharLap DOS extender, as can be seen in its MZ header. The 32-bit executable program starts at offset 18A0, per "offset within header of relocation table" (see http://www.program-...
user avatar
  • 2,274
18 votes
Accepted

How to investigate Windows 32/64bit (WOW64) transition

The technique of jumping to 64bit code from a 32bit WOW64-ed process is commonly called "Heaven's gate" when performed manually. This is usually done to use 64bit features (such as manipulating 64bit ...
user avatar
  • 11.3k
12 votes
Accepted

What is the difference between step into and step over when debugging?

The gdb terms (and commands) are step and next and the difference is that step continues to run until it changes line of source code, while next doesn't trace into a subroutine, but rather skips over ...
user avatar
  • 2,381
12 votes

Is there any tool to visually see program stack in linux while debugging?

You can easily view it using Visual Panels in radare2. Here's a teaser: Installation First of all, install radare2 from git repository: $ git clone https://github.com/radare/radare2.git $ cd radare2 $...
user avatar
  • 8,579
11 votes

Set a breakpoint on GDB entry point for stripped PIE binaries without disabling ASLR

Starting with GDB 8.1, there's a special command for this: starti. Example GDB session: $ gdb /bin/true Reading symbols from /bin/true...(no debugging symbols found)...done. (gdb) starti Starting ...
user avatar
  • 283
9 votes
Accepted

How to get current PHP function name in gdb?

According to this link, it should be possible to find the function in use with the following steps: Attach gdb to the currently-running PHP process: gdb -p <processid> Load in the PHP .gdbinit ...
user avatar
  • 218
9 votes
Accepted

When to use OllyDgb over Immunity Debugger

Immunity Debugger is forked from OllyDbg v1.10. So you should use the latest version of OllyDbg (currently v2.01) instead of Immunity Debugger if you want any OllyDbg v2-specific features/fixes. If ...
user avatar
9 votes

How to reverse engineer a Windows 10 UWP app?

"I'd like to see details on how to hook and step into the function that processes a button click event in a UWP app." I would suggest using the EventHook Library which is intended to hook global ...
user avatar
  • 1,026
9 votes

Trying to understand this construct in Dbgv.sys driver for DbgView tool

I still think this will create a BSOD, what's more I think that this is deliberate. It makes perfect sense to assume that this is deliberate once piecing all the puzzle pieces together. The source ...
user avatar
  • 10.5k
8 votes
Accepted

How to stop debugger right after the execution?

Binaries are usually stripped. For ELF binaries, you can check it with file command $ file /bin/true /bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared ...
user avatar
  • 455
8 votes
Accepted

How can I set breakpoint and get value of a register with IDApython

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the ...
user avatar
  • 11.3k
8 votes
Accepted

Faster Kernel debugging for Windows

You want VirtualKd. It is excellent and robust. http://virtualkd.sysprogs.org
user avatar
7 votes
Accepted

How to start a DOS application in DOSbox in debug mode?

If you build with --enable-debug[=heavy] and run the program via debug.com, it automatically breaks on the first instruction. See the DOS_Execute function in src/dos/dos_execute.cpp and ...
user avatar
  • 1,561
7 votes

WinDbg Debugging without symbols

Make sure if you have the correct breakpoint address issue lm an exe without symbol will be shown as 0:000> lm start end module name 00400000 0040f000 image00400000 (no symbols) ...
user avatar
  • 14.8k
7 votes
Accepted

Any documentation available for r2 other than official book

I wrote some articles (search for radare2) about using r2 for crackmes, and there is a talk section on the official website. Also you can find useful articles from the blog. Also, feel free to come ...
user avatar
  • 2,486
7 votes
Accepted

how to setup IDA pro linux GDB server

Ensure that networking is enabled on the guest system and that it can communicate via TCP/IP with the host system. Copy <IDA installation directory>\dbgsrv\linux_serverx64 to your host system ...
user avatar
7 votes

How to set a breakpoint on a 64 bit process button with x64dbg?

Yes, you can use the enhanced x64dbg feature for placing BP on any window of the debugged app and hence intercept any message being sent to any of them. After running the exe, go to Handles tab > ...
user avatar
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
user avatar
  • 8,579
7 votes
Accepted

Is there a way to explicitly connect r2pipe to an existing radare2 session that I have open?

I'm not sure I fully understood you, but I'll give it a try anyway. The following instructions will explain how to achieve something like this:| radare2 comes with its own webserver. Although at ...
user avatar
  • 8,579
7 votes

What is the difference between IDA and OllyDbg?

To put it very simply, there are two primary methods of analysis: Static Analysis: Analyzing an executable while it's not running. Dynamic Analysis: Analyzing an executable while it's running. IDA ...
user avatar
  • 2,144
6 votes
Accepted

registers set by function

In general, this concept is referred to as register preservation or register volatility. From http://en.wikipedia.org/wiki/X86_calling_conventions#Register_preservation -- According to the Intel ...
user avatar
6 votes
Accepted

Debugging Virtual Machine using Windbg

It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html However, Virtual PC is extremely ...
user avatar
6 votes
Accepted

How to break on not-yet-loaded kernel driver

For some reason I have yet to determine, every effort to set a breakpoint on this module by name (fdisk.sys) is failing. The driver isn't loaded at bootup (at least, not at the point that I'm ...
user avatar
  • 403
6 votes
Accepted

Why did the program entry point become 'sub esp, 1C'?

No, this is not a bug. Likely this is because you confuse the executable's entry point address (where Olly breaks) with the address of your main() function (where you expect it to break). You should ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible