Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [debugging]

Debugging is a methodical process of finding and reducing the number of bugs, or defects, in a computer program.

1
vote
1answer
88 views

Is the developer mode like the opened door for hackers to debug the mobile app?

The very good security recommendation is: the mobile app should check if the developer mode is turned on and it should not start. Both in android and iOS. Do you agree with this sentence? What the ...
5
votes
4answers
130 views

What is the use of disabling detailed exception pages on open-sourced apps?

Frameworks for web apps typically can run in either production mode or development mode. One of the major differences between the two modes is how exceptions are handled: in development mode the ...
2
votes
1answer
3k views

Does GHIDRA have a debugger?

Does GHIDRA have a debugger attached for dynamic analysis of application?
1
vote
1answer
40 views

Masking configuration of physical workstation

Environment: Physical workstation, HP, Dell, etc Windows 7,8,10, no matter Windows executables Our goal: For additional privacy, is it possible to wipe/change all configuration that can be read by ...
1
vote
2answers
178 views

Why does my stack contain the return address to __libc_csu_init after main is initialised?

I wrote a simple program in C, compiled it, opened it in gdb, set a breakpoint at line 11 and inspected the stack. 1 #include<stdio.h> 2 3 int main(int argc, char *argv[]){ 4 char ...
2
votes
0answers
112 views

How to extract the information about the stack or EIP/RIP registers from the ASAN (sanitizer) crash output?

I am testing Netwide Assembler(NASM) and verifying the latest bug [CVE-2018-10254] Stack-buffer-overflow (out of bound read). I am trying to overwrite the EIP/RIP and make it crash but I don't know ...
0
votes
2answers
106 views

Is revealing login name of macOS into internet a security risk?

For example, sometimes I need to post debug messages to internet like this: No such file : /Users/xxxxx/Documents/test.sh My question is, is forgetting replacing the login name into xxxxx a security ...
2
votes
2answers
603 views

Unable to understand $EIP changes with Buffer Overflow

I am learning Buffer Overflow, so the question might seem silly but here it is. I started with this very simple buggy program int main(int argc, char *argv[]) { char buf[128]; printf("You entered ...
1
vote
0answers
76 views

Why is there no SEH handler found in Windows 10?

I use immunity debugger and mona.py to find SEH pointer in Windows 10. Command is !mona seh. But it says no pointer is found. I want to know what has changed in Windows 10 to protect against this ...
-2
votes
1answer
80 views

If I put a variable in the private section of a class, will the variable have more protection againsted reverse engineering? [closed]

class LockdownUnlock{ private: /*snip*/ std::string rootCertificate; //Will this protect the data? /*snip*/ public: /*snip*/ }LDUnlock;
2
votes
1answer
453 views

Buffer Overflow CTF challenge

I am having trouble solving a challenge that requires using a buffer overflow to overwrite the return address and call another function that gives a shell. The program prompts the user for input, ...
1
vote
1answer
2k views

Buffer overflow: Why does the ESP Register change its value after access violation

Background: Currently trying to exploit a BoF vulnerability. After setting up the environment, running a compiled C program that contains the strcpy function, I disassembled the program as it's ...
1
vote
0answers
58 views

Android Debugging: Error accessing memory address [closed]

I'm attempting to debug different native binaries in my Android device using the adb shell and gdbserver. I receive the following error when i place a breakpoint in a program using gdb and continue ...
4
votes
1answer
119 views

Methods for analysing android app on runtime [closed]

I want to analyse security of android app by monitoring its behaviour on runtime. I need to monitor variables modifications, accesses and api calls while android app is running on the device. I tried ...
2
votes
2answers
861 views

Debugging SUID for privilege escalation

When doing privilege escalation, assuming an application with the SUID set and a debugger, what stops us from starting a shell from within the debugger? I mean just write the shell code in an ...
12
votes
2answers
1k views

Malware sandbox detection

I started some reverse engineering exercises using Ollydbg, IDA Pro and other tools like Sysinternals suite, etc. Some of these exercises are about malware. I downloaded some different malware from ...
1
vote
0answers
809 views

Trick needed to make use of a local buffer overflow vulnerability to obtain root

I am working on a certain CTF trying to gain root privileges in it, I found a vulnerable program to buffer overflow vulnerability with Non executable stack security level (NX), I developed an exploit ...
1
vote
1answer
10k views

return to libc- finding libc's address and finding offsets

So I tried performing a return-to-libc according to https://sploitfun.wordpress.com/2015/05/08/bypassing-nx-bit-using-return-to-libc/ . I found libc's address by using "ldd vuln", and found system's ...
1
vote
1answer
412 views

Shell not always escalating privileges in narnia

I'm going through the various overthewire wargames and I have a question about narnia0. The code in c contains if(val==0xdeadbeef) system("/bin/sh"); else { printf("WAY OFF!!!!\n"); I got it to work ...
1
vote
0answers
159 views

How to debug a particular .c or .cpp file of AOSP?

I'm interested in security stuff and I want to start with Android devices to test this OS. I've seen that there are many exploits for Android (the most famous is the StageFright case) and I'm also ...
2
votes
0answers
308 views

What are your favorite BLE (Bluetooth Low Energy) sniffing tools? (Hardware and Software) [closed]

I will soon need to debug BLE communication for a newly developed BLE device. What are your favorite BLE (Bluetooth Low Energy) sniffing tools? (Hardware and Software)
0
votes
2answers
911 views

Buffer Overflow: Advice on exploiting

int play() { int a; int b; char buffer[010]; a = 0x41414141; b = 0x42424242; if (write(STDOUT_FILENO, "For a moment, nothing happened. Then, after a second or so, nothing ...
4
votes
1answer
286 views

several questions about linux kernel debugging - memory examination

I've read this Does Linux kernel use DEP for kernel memory? but I'm debugging linux kernel (x86_64) on Vmware using vmware stub. I've attached gdb to my linux kernel. the kernel version is 3.x and I ...
1
vote
2answers
3k views

How does Server-side Handle the same multiple requests at the same time?

According this YouTube video: https://www.youtube.com/watch?v=oIkhgagvrjI&feature=youtu.be&t=7m19s YouTube Videos views are frozen at 300 until they're verified, sometimes at 301 or even up to ...
4
votes
2answers
649 views

How attaching to a process with a debugger can compromise system's security?

Visual Studio shows a warning, trying to attach to a different user's process: Searching for an explanation, I've found the MSDN article, claiming that: An untrusted process that contains ...
11
votes
1answer
2k views

Does analysing Malicious code in gdb pose a security risk?

I have encountered a Malicious Shell-Code & i have ported the shellcode into a compatible C Code which can run the shellcode, i compiled it using gcc -fno-stack-protector -z execstack shellcode.c ...
3
votes
1answer
376 views

Can a JTAG device be attached to a running system?

JTAG, or Joint Test Action Group, is a standard for debugging. Many modern motherboards, both on mobile devices and on desktops and workstations have JTAG ports. They allow a CPU to be controlled like ...
3
votes
3answers
1k views

Bug Bounty Methodology for a Newbie [closed]

Question: Once I join a bug bounty program and start hunting for bugs on a website, how do I efficiently start looking for bugs? I am very familiar with common vulnerabilities (XSS, sql injection, ...
5
votes
2answers
2k views

Disabling android application debug mode as a security practice

There's a security practice which says you should not publish your android application with debug mode enabled. While an attacker can use apktool to decompile your application, enable the debug flag ...
3
votes
2answers
4k views

How to capture WhatsApp API requests using Fiddler?

I am trying to capture WhatsApp network requests and not able to do it using Fiddler. This is what I did: Installed Fiddler. Exported Root certificate and installed on my Android device. I modified ...
5
votes
2answers
399 views

Privilege escalation fails outside gdb

I have an application with the following source code: #include <stdlib.h> #include <stdio.h> #include <string.h> int bof(char *str) { char buffer[12]; strcpy(buffer, str); ...
5
votes
1answer
3k views

Program getting exploited inside gdb, new shell is spawned but terminated immediately

I am trying to exploit a SUID program. The program is: #include <stdlib.h> #include <unistd.h> #include <string.h> #include <stdio.h> #define e(); if(((unsigned int)ptr &...
0
votes
0answers
73 views

unable to execute shellcode,which is place on stack [duplicate]

I am trying to execute the shellcode to spawn an "sh" shell. I have taken shellcode as command line arguement,copied it to stack and tried to overwrite the return address of main function with the ...
7
votes
1answer
2k views

Why is my debugger detected as a Trojan by anti-virus software?

I'm trying to use a deugger (namely OllyDbg) to analyze some exe files. However, all the versions I downloaded from the Internet are considered as Trojans by some anti-virus software. (I use www....
1
vote
2answers
2k views

How is Thread local storage used by malware/Virus?

I have been told that code in TLS is run before the entry point of an exe is reached ,so if one puts a breakpoint on this TLS address he/she could debug the behavior of the virus.Can Fiber local ...
0
votes
1answer
2k views

Why is there a path to a .pdb file in an exe I am trying to reverse?

My query is ,if I'm seeing a .pdb path in a exe(VC++) what conclusion can I draw from it.Why does the exe have these paths and does it have significance in malware analysis? eg H:\...
1
vote
2answers
3k views

What are the possible exploits over a debuggable APK?

I have heard that an Android APK can be debugged if android:debuggable="true" is set. What are the possible threats in allowing an app to be debugged?
-2
votes
2answers
354 views

Olly Debugger Linux not functioning

In Kali Linux whenever I open a binary in Olly Debugger after compiling the c source file, it gives an error: "The file is not a valid PE file." No debugging takes place thereafter. Is there any ...
1
vote
0answers
1k views

Google Chrome Crash Report Analysis

I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though. ...
19
votes
4answers
3k views

Is this verbose error message on the DOT website a security issue?

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace. Hopefully, you can get the same result ...
2
votes
1answer
2k views

EIP pointer is overwritten but EBP remains intact

I was trying out a simple stack buffer overflow exploit by creating a malicious crash.m3u file. as you can see the EIP pointer is overwritten by "A" but EBP hasn't changed. isn't EBP supposed to get ...
1
vote
1answer
2k views

Reverse TCP connection from exploited SearchIndexer.exe failing

I'm working on a tool that exploits SearchIndexer.exe on Windows 7 x86 and connects back to a metasploit multi/handler, using standard metasploit reverse TCP stagers. The exploit seems to function as ...
2
votes
2answers
3k views

Is exploit researching different from penetration testing

I'm confused by some terminology - reverse engineering seems to me to be pretty similar to exploit researching. I mean if you can reverse one program probably you will be able to find a vulnerability, ...
4
votes
1answer
1k views

Explaining a buffer overflow vulnerability in C

Given this C program: #include <stdio.h> #include <string.h> int main(int argc, char **argv) { char buf[1024]; strcpy(buf, argv[1]); } Built with: gcc -m32 -z execstack prog.c -o ...
1
vote
3answers
1k views

How to know if a specific address is on stack or heap using immuntiy debugger?

I have an address (i.e. 0x010f73fc) and I need to know where this address exist ? is it on stack or heap ? In another way, how to differentiate between addresses that belong to the stack and ...
11
votes
1answer
1k views

Help in understanding an application's crash - exploitable?

Being new to researching vulnerabilities in native applications (as opposed to web apps), I'm having difficulties understanding a crash in Debian's browser, Epiphany (version 2.30.6), and determining ...
46
votes
7answers
4k views

Why is application crash considered insecure?

If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again. Crash is a bad behaviour in general and should be avoided, but why are ...
-10
votes
1answer
6k views

How to find bugs/ vulnerabilities in web apps/sites? [closed]

What knowledge is needed? What software is to be used? How are the reports written? PS: Websites like facebook.com
3
votes
1answer
1k views

How to debug/reverse engineer java applets?

I need to analyze a java application (a .jar file) for a war game. I know java can be decompiled, but the coder apparently did a lot of obfuscation to prevent the reverse engineers from understanding ...
0
votes
1answer
1k views

Different types of segmentation faults in Linux [closed]

In Linux, when the NX-bit triggers the segmentation fault seems to be "error 15", whereas a more typical error, such as attempting to read from invalid memory, results in "error 7", (seen from dmesg ...