New answers tagged

1

I am not sure what you are asking (never used sticky notes and don't have it installed ) but if you want to run sticky notes from command line you can do something like this the command below will run calculator instead of the wildcard calc use stick C:\>powershell -c "(get-startapps -name *calc*).Appid Microsoft.WindowsCalculator_8wekyb3d8bbwe!App ...


0

It was pretty easy one so I could do myself:) We have exploit.c file where I need to debug it in order to get the flag with 'gcc'. I run the program with: gcc -g exploit.c -o exploit and got 'exploit' which is executable exploit.c file. Then: gdb exploit We have bool c = false; on line 21, so put the break line on it: break 21 Then: I changed the value of c ...


0

The if statement is likely compiled into a conditional jump so you just need to step until the comparison and change the result. For example, if the jump is je or jne, you need to change the zero flag (ZF) to force the jump in the opposite direction. For changing flags in GDB, see https://stackoverflow.com/a/31339372 Another option is to change the ...


1

You have two possible approaches in here: Analyze the APK of the device, reverse engineer it and try to make sense of how it communicates with the USB device. Connect the USB device to a computer, sniff the USB packets, and try to make sense of how it communicates with the host. I believe the former would be straightforward and simpler than the latter, not ...


2

A program might act differently in gdb environment and the shell environment, due to the environment variables GDB sets upon execution. GDB sets two environment variables LINES and COLUMNS to show the output on terminal correctly. Use the following commands inside GDB, then run the program inside GDB and adjust the shellcode accordingly. Unset environment ...


1

The earliest break is sxe ibp break on kd communication if you want to break earlier than that you need to lookup boot debugging you can use ctrl+alt+d for a debug spew of kdcom kdnet packets sent to and fro


3

This means that there is no valid opcode for this spot. The other 'valid' opcodes in your picture look also not useful at all. I assume the whole block there is nothing that can be executed.


1

Yes, this is possible with some cooperation from the debugger. The OllyMigrate plugin supports migration between following debuggers: OllyDbg Immunity Debugger IDA Pro/Freeware WinDbg x64dbg It seems Visual Studio is not supported but you can always do it the manual way: Patch an infinite loop (EB FE) at the current EIP/RIP; Detach the current debugger. ...


Top 50 recent answers are included