Hot answers tagged

2

I know that this question was asked some time ago, but here comes the solution working on Windows. Note: See the last section of this answer to get the solution for other systems and architectures. x86 32 bit files OllyDbg2 is the tool that can be used for logging every single assembly instruction along with memory reads and writes. A short guide how to ...


1

It might be useful to check the command line that was used to start the program. Open the Details tab of Task Manager and right click on any column (Name/PID/status). Then choose "Select columns" and in the new window scroll down and check the "Command line" box (below the I/O ones).


1

This is called Virtual Machine Introspection (VMI) and, while definitely possible, requires you to implement parsing of the internal OS structures to isolate individual processes, modules etc instead of relying on the built-in OS support (such as used by WinDbg kernel debugger). You can check for an example of how it could be done using IDA over VMWare's ...


1

Yes, you can do that. The python script doing that is attached below with appropriate comments. #!/usr/bin/env python3 import r2pipe r = r2pipe.open('programName', flags=['-d']) r.cmd('aei') modules = r.cmd('dmm') #list all modules along with start and end addresses modules2 = [] #modules' start addresses moduleNames = [] #since modules is just one big ...


1

By default tracing is limited to reduce its overhead: it stops once it goes to a location not in the current database (external modules, runtime-allocated memory etc.), as well as functions marked as library code. You can change this behavior in tracing options (disable the “trace over” checkboxes). Note that in some cases IDA may be unable to trace the ...


Only top voted, non community-wiki answers of a minimum length are eligible