19 votes

Does analysing Malicious code in gdb pose a security risk?

It certainly does. gdb will not isolate the process at all and will merely give you some control over it to understand what it does. To do that kind of analysis, you should resort to a fully ...
Julie Pelletier's user avatar
12 votes

Does GHIDRA have a debugger?

Edit: As the question is a little unclear there might be a misunderstanding. From my point of view there are 2 possible answers: GHIDRA does not offer a debugger for other binaries currently. (It is ...
Euphrasius von der Hummelwiese's user avatar
9 votes
Accepted

Malware sandbox detection

Start with this guide -- https://github.com/hfiref0x/VBoxHardenedLoader -- it's incredibly up-to date in terms of making a VirtualBox guest VM more-difficult to detect, including techniques valid in ...
atdre's user avatar
  • 19k
6 votes

Why does my stack contain the return address to __libc_csu_init after main is initialised?

Your main function contains pointer to __libc_csu_init just before its return pointer, because that's how stack frame works; before entering a function, caller pushes a stack frame pointer and a ...
Daniel 0xdbeef Zalega's user avatar
5 votes
Accepted

Buffer overflow: Why does the ESP Register change its value after access violation

As you correctly pointed out ESP always points at the top of the stack. Also stack overflows occur due to an overflow of a buffer on the stack (not due to an overflow of lets say a malloc-allocated ...
game0ver's user avatar
  • 615
5 votes

Malware sandbox detection

Please direct binary analysis and reverse engineering questions to https://reverseengineering.stackexchange.com/ especially if you are just starting out, since there is already a wealth of relevant ...
julian's user avatar
  • 1,289
5 votes
Accepted

Disabling android application debug mode as a security practice

This is likely the same reason that you don't want to release a C/C++ program with the -g flags. Unnecessary symbols are likely stripped away or obfuscated. The build system might leave out certain ...
RoraΖ's user avatar
  • 12.4k
5 votes

Does GHIDRA have a debugger?

From Ghidra 10.0, Ghidra debugger is included in the official release: https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0_build/Ghidra/Configurations/...
Minh-Triet Pham Tran's user avatar
4 votes
Accepted

How to capture WhatsApp API requests using Fiddler?

According to the paper "WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages" from 2015 WhatsApp does not use HTTP(S) but: WhatsApp uses the FunXMPP ...
Steffen Ullrich's user avatar
4 votes
Accepted

return to libc- finding libc's address and finding offsets

First, before you can approach your problem, you need to check if the executable is running under ASLR (https://en.wikipedia.org/wiki/Address_space_layout_randomization) If that's the case, you will ...
lightnet's user avatar
4 votes

Does GHIDRA have a debugger?

As of December 17th (2020), it has. See the announcement in Twitter https://twitter.com/NSACyber/status/1339652646513291264 and the debugger branch of Ghidra in GitHub https://github.com/...
Juanan's user avatar
  • 171
4 votes

Is the developer mode like the opened door for hackers to debug the mobile app?

No, that's a terrible idea. A few reasons why: There are a lot of legitimate app developers, and they shouldn't need a separate phone to test their own app than they do to use yours. There are a lot ...
Joseph Sible-Reinstate Monica's user avatar
4 votes
Accepted

What mechanisms prevent me from "ptraceing" a signed OSX application?

You should probably start with trying to debug the application with lldb to determine why you can't attach to the process. System Integrity Protection If an application is signed with the Hardened ...
Alexander O'Mara's user avatar
3 votes

Debugging SUID for privilege escalation

Only root can attach to a process with elevated privileges. In a bit more detail, attaching to a running process with the ptrace system call (which is what debuggers use under the hood) requires ...
Gilles 'SO- stop being evil''s user avatar
3 votes

Debugging SUID for privilege escalation

what stops us from starting a shell from within the debugger? If you run a setuid program under debugger, and you're not root, it will run as if was not setuid. Meaning it will execute under your id, ...
George Y.'s user avatar
  • 3,524
3 votes

Buffer Overflow: Advice on exploiting

The 0x414141 and 0x424242 that are placed in books for educational purposes because these are simply the strings "AAAAAAAA" and "BBBBBBB" in hexadecimal notation. Assigning them to integers has ...
grochmal's user avatar
  • 5,857
3 votes

several questions about linux kernel debugging - memory examination

I have never debugged the kernel, so I may be wrong, but I believe that what you are seeing makes complete sense. Let's go through it: add BYTE PTR [rax],al why is that? is this because I'...
grochmal's user avatar
  • 5,857
3 votes

return to libc- finding libc's address and finding offsets

Here are two methods: 1. strings -t x -a /path/to/libc | grep "/bin/sh"--> this outputs the offset of the string in libc. 2. with pwntools: first define the libc with libc=ELF('/path/to/libc') ...
Arav Garg's user avatar
3 votes

Bug Bounty Methodology for a Newbie

You should check this github repo: https://github.com/jhaddix/tbhm Welcome! This repo is a conglomeration of tips, tricks, tools, and data analysis to use while doing web application security ...
null's user avatar
  • 1,203
3 votes

How attaching to a process with a debugger can compromise system's security?

Your note that it's a "different user's process" is the key here. If the malicious process is limited to that user's context, then attaching a debugger (which usually requires deep permissions) gives ...
schroeder's user avatar
  • 128k
3 votes

How is Thread local storage used by malware/Virus?

You're thinking of TLS callbacks! TLS includes TLS callbacks, an array of pointers to functions that are to run before the EP is reached. This functionality exists so the developer can initialize the ...
dNetGuru's user avatar
3 votes

What is the use of disabling detailed exception pages on open-sourced apps?

It can reveal details of the implementation to an attacker that can be used to mount a better attack. Quoting from the OWASP page on improper error handling: Even when error messages don’t provide ...
Swashbuckler's user avatar
  • 2,185
3 votes

What is the use of disabling detailed exception pages on open-sourced apps?

There are a couple things to consider when you enable debugging mode. Information leakage: framework version number, config values, API keys. Django has some rudimentary protection to scrub off ...
Lie Ryan's user avatar
  • 31.4k
2 votes

Can a JTAG device be attached to a running system?

Actually, on modern processors JTAG access and the level of service that can be reached with JTAG is controlled by OTP fuses inside the SoC, or in case of Intel processors with patches to the CPU RTL....
juansolsona's user avatar
2 votes

Shell not always escalating privileges in narnia

Looks like this is due to the program running under the currently logged in user's account (narnia0) when you run it with gdb vs. the program running under the narnia1 user account when the program is ...
SecretSasquatch's user avatar
2 votes
Accepted

How does Server-side Handle the same multiple requests at the same time?

The way that a programming language runtime ensures that concurrent requests that target the same state don't interfere with one another is ultimately through a mechanism called "compare-and-set" ...
Jonah Benton's user avatar
  • 3,497
2 votes
Accepted

How attaching to a process with a debugger can compromise system's security?

If you scroll down the page of the provided msdn link under the See Also heading there's a link to Debugger Security which states: The ability to debug another process gives you extremely broad ...
user2320464's user avatar
  • 1,852
2 votes

Masking configuration of physical workstation

There are myriad of ways to fingerprint a system from the OS version, registry entries, functionality advertised, driver versions, applications, hardware available (chipsets, drivers associated, etc.)....
Daisetsu's user avatar
  • 5,100
2 votes

Does GHIDRA have a debugger?

Now yes! From Ghidra 10.0 change history New Features Debugger. Introduced the Debugger, along with GDB and dbgeng.dll connectors for debugging user-mode applications on Linux and Windows, ...
Mah35h's user avatar
  • 121

Only top scored, non community-wiki answers of a minimum length are eligible