4

If you were given a piece of source code written in a language you had never seen before, you would want to study the syntax and rules of the language so that you could understand what the piece of code is doing. A compiler transforms a high-level human friendly language (C for example) into in binary instructions that a CPU can run directly. These binary ...


4

Binary MIDI data bytes are 7 bits, meaning they can have decimal values from 0 to 127. In a 7-bit binary number: the bit on the right represents a decimal value of 1. the next bit to the left represents a decimal value of 2. the next bits to the left represent decimal values of 4, 8, 16, 32, and 64. Decimal values from 0 to 127 can be expressed in seven ...


3

gdb is primarily a Source Level Debugger to set a bp on an address instead of symbol use * (gdb) break main Breakpoint 1 at 0x100401094: file mingtest.cpp, line 4. (gdb) break *0x100401094 Note: breakpoint 1 also set at pc 0x100401094. Breakpoint 2 at 0x100401094: file mingtest.cpp, line 4. (gdb) you can disassemble using address, length at any arbitrary ...


3

can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ? if that is the case then it means you allocate memory etc just after windbg/cdb broke on System Breakpoint if you are doing .dvalloc when you are on System Breakpoint then HttpRequestA might cause the block go to the ...


3

reading your question several times and the discussion in the comments i did not understand what you're trying to get/obtain, so i will be answering to parts that i think that are relevant according to the problems you posed. maybe other and more experienced people here would help elaborate and improve: if you're trying to "reverse" an interpreted code, ....


3

I think that the code is supposed to be checking for hooks. The adr instruction sets x8 to the start of the function so if there was a breakpoint or a jump placed there by a hook library, the byte there would be different from the original value FF. One possibility is that there is a breakpoint there but the debugger is masking it by showing you the ...


3

From the looks of it that's an easy one. Yes, these are variables on the stack and the magic number in EAX is used to denote uninitialized values. Quote: CCCCCCCC Used by Microsoft's C++ debugging runtime library and many DOS environments to mark uninitialized stack memory. CC resembles the opcode of the INT 3 debug breakpoint interrupt on x86 processors. ...


2

You don't need to make install the binary, this often strips the binary removing all the debug information. In the HACKING file these is a section on how to debug this tool, they advise the following settings, personally I would add -ggdb to enable gdb specific bindings. (This advice also applies to other projects, although this project has explicitly added ...


2

I think you're not doing anything wrong, you're experiencing this bug: https://sourceware.org/bugzilla/show_bug.cgi?id=24069 Usually if you retry several times you might get it to work eventually; it looks like a race condition. The patch proposed in the bug report kind of works for me on macOS 10.15.5: instead of just hanging, GDB errors out upon run with: ...


2

Mozilla rr In addition to the closed source Undo mentioned at https://reverseengineering.stackexchange.com/a/2503/12321 , we now also have an amazing open source working implementation: https://github.com/mozilla/rr I have given a minimal runnable example of it at: https://stackoverflow.com/questions/1206872/how-to-go-to-the-previous-line-in-gdb/46996380#...


2

I figured it out by trial and error. From the main Eclipse window: Click on the dropdown arrow on the "Debug As..." button in the toolbar. Select "Debug Configurations..." In the Configuration Editor: You can edit your existing Ghidra configuration for your project or you can make a duplicate of it like I did. Then select that project in the left side. ...


2

I managed to find a solution. When the SIGTRAP emitted by the program causes a breakpoint in gdb, I use the command : signal SIGTRAP to send the signal to the program (and then to the handler), the program continues as expected. Don't need to use the "handle" command shown in the question, because it seems to make gdb malfunction.


2

The CPU exceptions are reported to the OS fault handler which then may either terminate the program or notify it via an OS specific mechanism. On Windows this is Structured Exception Handling (SEH), on Unix-like systems usually signals. Check your OS documentation for more info. If you want to learn how to handle the raw exceptions yourself, you basically ...


2

Those are vectors for interrupt like int1....intn here is sample c code that generates and a handles int0 (#DE) ,int1 (#DB) ,int3 (#BP) and int6 (#UD) #include <stdio.h> #include <windows.h> unsigned int Exec_Search(unsigned int code) { printf("unknown Exception %x\n",code); return EXCEPTION_CONTINUE_SEARCH; } unsigned int ...


2

It sounds like you are looking for proper debugger integration in Ghidra. This has recently been published to the GitHub repository in the debugger branch. There is also a good blogpost showcasing it. Sadly there does not seem to be a x64dbg backend yet, but I would expect that this will appear as either an official backend or a community plugin at some ...


2

Try to find the string of the error message in the binary (Hotkey: Alt+B, Search for binary). If the auto analysis worked well, the string should be annotated with all functions that reference the string, and you should be able to jump to the instructions that refer to the message using the cross references popup (Hotkey: Ctrl+X)


2

ActiveX controls (.ocx) are actually simple DLLs conforming to the COM standard. In practice, it means that it exports standard COM entry points such as: DllRegisterServer DllUnregisterServer DllCanUnloadNow DllGetClassObject The most important for us is DllGetClassObject as this is the one called by the host process to create the ActiveX control(s). ...


2

if visual studio 2017 community is generating the pattern fill then compiler option /RTCsu is being used this also switches on Incremental linking (*.ilk files will be generated) earlier versions of compiler used /GZ option which if used now will generate a deprecation warning your code is also not using scanf_s a secure version of vulnerable scanf(); that ...


1

You need to set ds to the actual segment value used by the program. Usually it's one of the segments near the end. I suggest you to check which of the segments has something fitting at 8401h, or try to see how ds is set up in the calling function (you may need to go several levels up). You can also try to map the value you see in DOSBox debugger back to one ...


1

You can press Ctrl+G and check the different settings of the segment registers. You can press Alt+G to edit the segment registers.


1

have you considered the possibility that it might be using the str instead of String which only has length and no capacity and you are looking at a bogus third value ? :\>cat main.rs fn main() { let s1 = String::from("Hello, std::world!"); println!("{}",s1); println!("{} {}",s1.capacity() , s1.len()); ...


1

the instruction lea loads the Effective Address of its operand so after executing lea rcx, qword ptr ds:[xxxxxxx] rcx will hold the address xxxxxxx so if you are sure you need rcx to be 0 in that instruction simply wipe the address from that specific operand that is make 48:8d05 xyzabcd as 48:8d0425 00000000 or assemble lea rax,qword ptr ds:[0] keep in mind ...


1

as I understand your question, if your binary doesn't have a packer / protector, and you can't use any way to hook the original source, try using a kernel hooke like TitanHide, and observe the behavior, now if not having anything so complicated check the sides of your debugger look for flags and find the "zero flag", and change your return, this is ...


1

official way is as pointed out by other answers use symchk.exe from windbg installation but you can also fetch it by putting together few dbghelp and winsock functions find below a poc that uses wget.exe #include <stdio.h> #include <windows.h> #include <dbghelp.h> #pragma comment(lib,"dbghelp.lib") #pragma comment(lib,"user32....


1

Usually it’s not possible because one process must control the other and most debugging commands (e.g. reading or writing registers) need the target process to be stopped. A common approach is run a copy of itself as a separate process (can be done on Unix systems using fork()) and debug that. In theory you could implement a custom debug-like functionality ...


1

Instead of trying to dump the encrypted executable, it may be better to just monitor the API calls at runtime using something like Rohitab API Monitor. This is usually the easiest approach in cases where you can get the executable to run the code of interest. It also gives you the address of the calling code and call stack information, which you can then ...


1

I don't use Eclipse for Ghidra myself, but as far as I just checked it should also support this. I can confirm that this approach (remote debugging plus Python stubs) works well with PyCharm. Remote Debugging with pydevd The basic idea is to use remote debugging with pydevd or similar. https://stackoverflow.com/a/41492711/13220684 explains the basic usage. ...


1

Run the debug server as admin, this should be enough.


1

You can click on the top part of the desired window (which is blue in color when selected, and which has the title of the window written in it). You can then hold and drag it out of the screen. At this point, it may appear weird that only this title bar is moving with your mouse, but try releasing the mouse button while this title bar is someone outside the ...


1

That's how the concept of virtual address space works. Every process has their own address space which can be addressed. Thanks to this you can't directly read from/write to memory of another process. You can specify the address where the process base module will be mapped into process memory during compilation/linking process, for example for MSVC linker it ...


Only top voted, non community-wiki answers of a minimum length are eligible