问:
How do I become a Malware Analyst?
Sorry if this is posted in the wrong section.

A little about me: I'm going to be a sophomore in the fall at university, my major is Computer Science (Information Assurance). I've been interested in malware/antivirus since the sixth grade. I remember removing the McAfee security software from my family computer and replacing it with other vendors (kaspersky, bitdefender, eset, etc). I also used to watch youtube reviews of said vendors and other antimalware software, and have just recently acquired my own Virtual Machine and I install malware on there and use different products to see which can best remove the malware.

Anyway, how would you suggest I go about becoming a malware analyst? I've made a list of books to study (pratical malware analysis, art of memory forensics, malware rootkits, botnets: a beginners guide, etc). I also like to read kaspersky's theatpost and malwarebytes' blog, any other tips to get me started in my dream career?

Also, I plan on getting my Masters in Information Assurance, how much will that help me in terms of material learned and job competitiveness?

Title: How do I become a Malware Analyst?


问:
JTAG finding BS registers for IC's pins
On the internet, it always shows that each pin of the IC has its own Boundary Scan register (the yellow boxes)

But looking at BSDL files there are actually more BS registers than pins.

So for the questions:

Is it right to say that there are always more BS registers than pins?

What are the other BS registers used for OR Why are they there?

How can we use JTAG(TAP controller, state machine etc) to find out which are the pin's BS register?

ContentLicense: CC BY-SA 3.0

Title: JTAG finding BS registers for IC's pins


问:
How to find a verification routine that enables a button and a textbox
I have an app (reverseme) that looks like calc.exe.
It has 9 number btns, clear and enter buttons.
The enter is disabled.

There is another input textbox without any enter or submit button. It takes inlut from the keyboard but when i press enter it doesnt throw any badboy or goodboy messages just a sound of a bad press.

I need to enable the enter button and find the serial.

The app compiled with borland and writteb in c++.
It uses kernel32, user32, comctc32.

I have disabled the entered button by enabling it in reseditor and noping the disabling routine in the code but im shure there is another way.


问:
C Generated File by IDA Pro
I have produce a C File from IDA Pro and wanted to know what does the commented register@number notation mean? E.g. ebx@1 right to the int v1; declaration?

Thanks!

```
int __stdcall sub_421E20(int a1)
{
  int v1; // ebx@1
  int v2; // esi@1
  int v3; // ecx@3
  int v4; // eax@5
  int result; // eax@10
  int v6; // edx@11
  int v7; // [sp+10h] [bp-48h]@5
  int v8; // [sp+28h] [bp-30h]@1
  int *v9; // [sp+2Ch] [bp-2Ch]@5
  char v10; // [sp+30h] [bp-28h]@8
  ....

```

Title: C Generated File by IDA Pro


问:
How to debug under Olly the Windows 8.1 Store apps?
Ive tried to attach to some windows store app. It seems like there is no way
since when OllyDebugger stopped reacting, showing the 'Loading .udd data' message. If I re-launch olly, it reacts the same way. The only difference is that it may be different .udd file... What to do further I do not know.
   I pointed out the correct .UDD directory(which is the same where my ollydbg saved).</p>


问:
How can I parse VMTs in IDA if I have the base address?
I have run the Class Informer plugin to identify virtual method tables.  I am trying to write a python script which will rename each function in the table.  I am struggling to find the correct API call to change an .rdata subroutine name.  I have read through this guide, but I'm still confused:  http://www.offensivecomputing.net/papers/IDAPythonIntro.pdf

e.g.,  if I have this vmt for ExampleClassA:

```<code>.rdata:004F0EE8     ??_7?$ExampleClassA@$@@@ dd offset sub_25DFAD
.rdata:004F0EE8                                             ; DATA XREF: sub_256CB0+98
.rdata:004F0EE8                                             ; CNetChan____45+86 ...
.rdata:004F0EEC                     dd offset sub_3B0760
.rdata:004F0EF0                     dd offset sub_1A2080
....
</code>```

I want to enter the base address ( 0x004F0EE8 ) and iterate over the table to rename each subroutine based on a user-supplied name.  I can iterate, get input, move ea.

How do I modify the subroutine name of the current line?


问:
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :

Project!??0?$allocator@D@std@@QAE@XZ

to

Project!public: __thiscall
  std::allocator::allocator(void)

I found that IDAPython has an API for this but I don't know how to use IDAPython in linux.


问:
unpack a malware manually
I`m working on this malware to analyze:

```<code>http://www.freeuploadsite.com/do.php?id=74209
password: infected
</code>```

It seems it is packed but when I use "PE View" , etc tools to find the packer, their results are nothing.

How can I unpack this malware manually?

Thanks a lot.

Title: unpack a malware manually


问:
Decoding A/C IR Codes
I captured infrared codes from an air conditioner remote to realize each code contains the entire state (i.e. temperature, mode, fan speed, etc.) every time a button is pressed. I believe this is so if one or more button press are missed the system remains in sync (ex.: hide the IR emitter and press the temp up a few times).

Now instead of capturing every possible combination by cycling through all the modes and options and pressing all the buttons one by one I thought it might be wiser to try to understand the logic behind managing the state myself.

Below are some codes captured in the same mode/fan speed. Only the temperature, on/off and louver function were triggered. I divided bits to isolate the groups I could identify.

First group appears to be constant across and includes an init code showing as "2" (the constant sections below may contain other settings like mode/fan speed which were not captured)

Second group is the power button (on-20/off-20 is the on/off button pressed at 20 degrees)

Third group is constant

Fourth group is the temperature truncated at 4 bits (and the bits are reversed - I am assuming endianess)

Fifth group is constant

Sixth group is the louver on/off (3 bits)

Seventh group is constant

Eighth group appears to be a checksum (not sure)

I think it should be trivial enough identifying each group but what I am not sure about is the last group which appears to be a checksum, but what kind of checksum, and a checksum of which group?

```<code>*FUNC********* *1***************************************** 2 *3*********** *4** *5***** *6* *7******************************** *8******
16:            2001110110010110010011011011111111111111111 0 1101100111111 0000 1111111 111 1111111111111111111111111111111111 00101101
17:            2001110110010110010011011011111111111111111 0 1101100111111 1000 1111111 111 1111111111111111111111111111111111 10101101
18:            2001110110010110010011011011111111111111111 0 1101100111111 0100 1111111 111 1111111111111111111111111111111111 01101101
19:            2001110110010110010011011011111111111111111 0 1101100111111 1100 1111111 111 1111111111111111111111111111111111 11101101
20:            2001110110010110010011011011111111111111111 0 1101100111111 0010 1111111 111 1111111111111111111111111111111111 00011101
21:            2001110110010110010011011011111111111111111 0 1101100111111 1010 1111111 111 1111111111111111111111111111111111 10011101
22:            2001110110010110010011011011111111111111111 0 1101100111111 0110 1111111 111 1111111111111111111111111111111111 01011101
23:            2001110110010110010011011011111111111111111 0 1101100111111 1110 1111111 111 1111111111111111111111111111111111 11011101
24:            2001110110010110010011011011111111111111111 0 1101100111111 0001 1111111 111 1111111111111111111111111111111111 00111101
25:            2001110110010110010011011011111111111111111 0 1101100111111 1001 1111111 111 1111111111111111111111111111111111 10111101
26:            2001110110010110010011011011111111111111111 0 1101100111111 0101 1111111 111 1111111111111111111111111111111111 01111101
27:            2001110110010110010011011011111111111111111 0 1101100111111 1101 1111111 111 1111111111111111111111111111111111 11111101
28:            2001110110010110010011011011111111111111111 0 1101100111111 0011 1111111 111 1111111111111111111111111111111111 00000011
29:            2001110110010110010011011011111111111111111 0 1101100111111 1011 1111111 111 1111111111111111111111111111111111 10000011
30:            2001110110010110010011011011111111111111111 0 1101100111111 0111 1111111 111 1111111111111111111111111111111111 01000011

ON-20:         2001110110010110010011011011111111111111111 0 1101100111111 0010 1111111 111 1111111111111111111111111111111111 00011101
OFF-20:        2001110110010110010011011011111111111111111 1 1101100111111 0010 1111111 111 1111111111111111111111111111111111 00111101

LOUVER-ON-20:  2001110110010110010011011011111111111111111 0 1101100111111 0010 1111111 000 1111111111111111111111111111111111 00000001
LOUVER-OFF-20: 2001110110010110010011011011111111111111111 0 1101100111111 0010 1111111 111 1111111111111111111111111111111111 00011101
</code>```

Title: Decoding A/C IR Codes


问:
IDA Flair all functions skipped when creating .pat file
I'm trying to create .pat file with IDA Flair tools, but it skips all the functions.
Here is what I did:

```<code>pelf.exe tier0.lib tier0.pat
tier0.lib: skipped 395, total 395
</code>```

I also tried other tools like pcf and plb and it didn't work.

here is my input file: http://www.mediafire.com/download/xk2gxp9ja8hm00v/tier0.lib

Help?


问:
Extract resources from compiled "resource file"
I am facing a compiled resource file for a mobile app (an Android one), built using moSync Framework (http://www.mosync.com). This resource file contains media(images, audio), strings, JS/HTML code for that app. It is built using the resource compiler from moSync framework.

The resource file starts with 4D 41 52 53 or MARS as a signature/identifier.

Would it be possible to extract the resources, to apply some modifications to them and to repack the file ?

Later edit (publishing file header, and first bytes for further analysis):

```<code>4D 41 52 53 E0 1C 4D A9 04 3D 72 85 78 56 34 22 10 00 00 00 3F 01 00
00 D7 25 B1 89 00 52 6F 6F 74 00 05 00 00 00 01 64 65 66 61 75 6C 74
2E 63 73 73 00 00 00 00 00 51 0E 00 00 01 48 74 74 70 49 6E 66 6F 45
4E 2E 68 74 6D 6C 00 51 0E 00 00 2C 7A 00 00 01 48 74 74 70 49 6E 66
6F 52 4F 2E 68 74 6D 6C 00 7D 88 00 00 2B 7A 00 00 00 69 6D 61 67 65
73 00 09 00 00 00 01 63 6C 69 65 6E 74 2E 70 6E 67 00 A8 02 01 00 A5
02 00 00 01 64 65 73 74 69 6E 61 74 69 65 2E 70 6E 67 00 4D 05 01 00
AA 03 00 00 01 74 61 78 69 2E 70 6E 67 00 F7 08 01 00 2F 0E 00 00 01
74 61 78 69 30 2E 70 6E 67 00 26 17 01 00 F6 02 00 00 01 74 61 78 69
31 2E 70 6E 67 00 1C 1A 01 00 76 04 00 00 01 74 61 78 69 32 2E 70 6E
67 00 92 1E 01 00 5F 04 00 00 01 74 61 78 69 33 2E 70 6E 67 00 F1 22
01 00 A7 05 00 00 01 74 61 78 69 34 2E 70 6E 67 00 98 28 01 00 0B 05
00 00 01 74 61 78 69 35 2E 70 6E 67 00 A3 2D 01 00 02 06 00 00 00 6A
73 00 01 00 00 00 01 6D 6F 73 79 6E 63 2D 62 72 69 64 67 65 2E 6A 73
00 A5 33 01 00 59 44 00 00
</code>```

If you convert this data from hex to ascii, you will clearly see that the compiled file is a concatenation of several other files(eg:mosync-bridge.js, HttpInfoEN.html, default.css, taxi0.png). After finding that out, i continued analysing the file. After the last png file inside i found serveral audio/mpeg , audio/x-wav file headers. Those aren't referenced anywhere in the file, but loaded within the app sucessfully.

I also tried to hex-edit the file (eg change an attribute in a css file, without preserving attribute name length), repack and sign the APK. I installed it onto one device, and it would complain that it could not load the resources and crash.


问:
Opening program via Ollydbg/Immunity in Win7 causes exception unless in XP Compatibility Mode
When opening the reverseme included with Lena's tutorials for debugging in either Immunity or Ollydbg an exception is produced within ntdll that results in termination of the process with code 4000001E.  If I configure the executable for a compatibility mode of Windows XP (Service Pack 3) within the file properties then this exception does not occur and the binary executes as expected.  The executable does not produce an exception when running with a debugger attached.

What is the root cause of this exception, and how would I determine it?


问:
hidden module when debug with ollydbg 2.01 with size?
i try reversing program with ollydbg2.01, but i Noticed strange thing with ollydbg when try debug program in log file i have 76FC0000 Module <Mod_76FC>(anonymous) and when press alt+E i have size ??? and type hidden.


问:
Automating a custom QGraphicsObject control in an external QT based process
I have injected a DLL into an external application that is based on the QT framework. I, then, use the method QApplication::allWidgets() and iterate through the list of widgets to find a QGraphicsView that represents the window I want to interact with.

The buttons and other controls in the scene are all derived from QGraphicsObject. But, I don't have the source. So, I can only cast to QGraphicsObject and not to the actual type.

The list of methods from the meta-object is incomplete, which is to be expected, because I cast to a QGraphicsObject. I can find the method names using IDA though.

Is it possible to call a particular method, and how would you do it?


问:
gdbserver doesn't trigger breakpoints
I'm debugging a vulnerable app on a remote host. I've set up gbserver on the host with:

```<code>gdbserver host:1234 /my/target/app
</code>```

On my local host I've connected with:

```<code>$ gdb /same/target/app
gdb$ target extended-remote 192.168.0.100:1234
</code>```

I connect successfully and can proceed to set a breakpoint on a target instruction, ie:

```<code>$gdb disas vuln_function
....
   0x08048e6b <+116>:   ret
End of assembler dump.
gdb$ b *0x08048e6b
Breakpoint 1 at 0x8048e6b
</code>```

Looking at the disassembled function code and having tested this on the host itself, I'm 100% sure I'm breaking on the right address and in any case I'm triggering a buffer overflow which should make gdb break by itself.

But instead of getting the usual breakpoint on my gdb client, nothing happens. gdbserver freezes on the BO (so I'm guessing it did break on the ret) without throwing the segfault. gdb doesn't seem to be crashing or behaving abnormally other than not giving me a prompt on the breakpoint.

Is there a special way to set breakpoints when debugging with gdbserver?

Title: gdbserver doesn't trigger breakpoints


问:
Implementation of mul x86 assembly instruction in python
I'm trying to implement the mul x86 assembly instruction in python and would like your advise to do it in the most pythonic way.

Here is what I've done so far:

```<code>eax = 0x51EB851F
edx = 0x5D0FCF

# mul edx

#EDX (higher part of result)
>>> hex(0x5d0fcf * 0x51EB851F & 0xFFFFFFFF00000000)
'0x1dc79e00000000L' # To be truncated (EDX=0x001DC79E)

# EAX (lower part of result)
>>> hex(0x5d0fcf * 0x51EB851F & 0xFFFFFFFF)
'0x66807511'
</code>```

Is there a cleaner/more pythonic way of doing this?

Many thanks in advance for your inputs.


问:
Intercepting syscall in a shared object (dynamically linked)
Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main().

One candidate is to use static binary rewriting (e.g. dyninst). But as I tried, it throws an error (saying about r_debugCheck() failed). Wondering if anyone had experiences in this task.


问:
How to identify the encryption in packet data using OLLYDBG
I've been slowly learning the processes of packet decryption over the last 6 or so months, and it's been slow progress.

I've found the winsock2 send function in OllyDbg, and I'm using this tutorial to work through what encryption is being used - screen of the location;

I'm now about 20,000 feet out of my depth. What I'm hoping to do is figure out the encryption used and then just packet sniff a whole bunch of packets so I can figure out the kind of data being sent etc. (please poke wholes in this plan if you see them!). If anyone can look at the print screen and just 'see' the encryption that would be great, if not any advice on what to do next would be appreciated!

Thanks!


问:
Javascript equivalent of JEB
In case you already know, there is a full-feature decompiler for Java/Android called JEB (https://www.pnfsoftware.com/)

Some of the most important features include the ability to rename identifiers and click-through program trace functionality and cross referencing.

Is there such an equivalent IDE for Javascript? Commercial or free.

Title: Javascript equivalent of JEB


问:
Debug function in MIPS .ko file (with IDA and Qemu)
I have a .ko file which I grabbed from a router (MSB MIPS), and I'm trying to debug a specific function inside it with IDA.

Since i can't just "run" the ko file with QEmu, I tried to change its header to make QEmu think It's an ELF executable. By doing this, I was able to run and connect with IDA (with warnings of course) but when I do the first step inside the function I get "SIGSEGV" signal.

My setup is:

Ubuntu host with statically compiled qemu-mips

VM with IDA PRO

BTW, the function I'm trying to debug is not using any hardware.

I hope you can point me to the right direction.


问:
Math kernel library applications
I am looking for a way to simplify functions accelerated by math kernel libraries ...is there any way to make flair signature out of them to understand it better. For instance, I want to get the original data structure or math function for this code (e.g sin or cos or array in math kernel)

For instance:

```<code>do
      {
        v18 = (__m128i)_mm_cmpneqps(
                         _mm_unpacklo_ps(
                           _mm_unpacklo_ps((__m128)*(_DWORD *)(v17 + 160), (__m128)*(_DWORD *)(v17 + 240)),
                           _mm_unpacklo_ps((__m128)*(_DWORD *)(v17 + 200), (__m128)*(_DWORD *)(v17 + 280))),
                         0LL);
        v16 += 8LL;
        v19 = _mm_sub_epi32(
                0LL,
                (__m128i)_mm_cmpneqps(
                           _mm_unpacklo_ps(
                             _mm_unpacklo_ps((__m128)*(_DWORD *)v17, (__m128)*(_DWORD *)(v17 + 80)),
                             _mm_unpacklo_ps((__m128)*(_DWORD *)(v17 + 40), (__m128)*(_DWORD *)(v17 + 120))),
                           0LL));
        v17 += 320LL;
        v15 = _mm_add_epi32(_mm_add_epi32(v15, v19), _mm_sub_epi32(0LL, v18));
      }
      while ( v16 < v14 );
</code>```

This was created by libmmd.dll 11.1

Title: Math kernel library applications


问:
BSWAP and CMP as obfuscation for Anti-Debugging?
I am trying to attach debug a program that has an "anti-debug" feature on it.  When stepping through, it seems to step through a maze of call and jmp commands that eventually just loop around.  The loop only happens when stepping line by line and I am trying to understand it.

I don't know if there is added obfuscation, but why would lines such as this appear?

```<code>014D658C   0FCA    BSWAP EDX
014D658E   0FCA    BSWAP EDX
</code>```

If I understand correctly, BSWAP will just invert the bits, but twice in a row should leave the EDX register untouched.  I've also noticed other strange things like comparing registers and then seemingly doing nothing with the result (no jump calls after or setcc or anything like that)

```<code>014D657C   66:81FF 8408     CMP DI,884
014D6581   30D8             XOR AL,BL
014D6583   8D96 1A30A4DD    LEA EDX,DWORD PTR DS:[ESI+DDA4301A]
</code>```


问:
Why darwin kernel crashes on function call via lldb while debugging the process?
I wanted to debug the hanging ruby process, but instead my kernel crashes each time when I'm doing the following steps:

I'm re-running my ruby script (vagrant) which hangs:

```<code>$ vagrant destroy -f && VAGRANT_LOG=info vagrant up
...
INFO ssh: Setting SSH_AUTH_SOCK remotely: /tmp/ssh-FP9viQfD9J/agent.1425
(process hanging)
load: 2.48  cmd: ruby 1384 waiting 2.90u 0.62s
</code>```

I'm attaching lldb into the running process (on different terminal):

```<code>$ lldb -p $(pgrep -fn ruby)
</code>```

Popup: Developer Tools Access needs to take control of another process for debugging to continue. Type your password. Continue.

```<code>(lldb) process attach --pid 1442
Process 1442 stopped
Executable module set to "/opt/vagrant/bin/../embedded/bin/ruby".
Architecture set to: x86_64-apple-macosx.

(lldb) thread list
Process 1442 stopped
* thread #1: tid = 0x2427, 0x00007fff84f3f716 libsystem_kernel.dylib`__psynch_cvwait + 10, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
  thread #2: tid = 0x245d, 0x00007fff84f3f9aa libsystem_kernel.dylib`__select + 10
  thread #3: tid = 0x2a8d, 0x00007fff84f4094a libsystem_kernel.dylib`poll + 10
  thread #4: tid = 0x2a9a, 0x00007fff84f3f716 libsystem_kernel.dylib`__psynch_cvwait + 10
</code>```

I'm calling rb_backtrace() for thread #1:

```<code>(lldb) call (void)rb_backtrace()
</code>```

which prints for me the ruby backtrace as expected (on process foreground):

```<code>from /opt/vagrant/embedded/gems/gems/vagrant-1.7.2/plugins/communicators/ssh/communicator.rb:566:in `block in shell_execute'
from /opt/vagrant/embedded/gems/gems/vagrant-1.7.2/plugins/communicators/ssh/communicator.rb:566:in `loop'
</code>```

Since ruby is using different threads, I wanted to do the same for thread #2 (which failed):

```<code>(lldb) thread select 2
* thread #2: tid = 0x245d, 0x00007fff84f3f9aa libsystem_kernel.dylib`__select + 10
    frame #0: 0x00007fff84f3f9aa libsystem_kernel.dylib`__select + 10
libsystem_kernel.dylib`__select + 10:
-> 0x7fff84f3f9aa:  jae    0x7fff84f3f9b4            ; __select + 20
   0x7fff84f3f9ac:  movq   %rax, %rdi
   0x7fff84f3f9af:  jmp    0x7fff84f3c19a            ; cerror
   0x7fff84f3f9b4:  retq

(lldb) thread list
Process 1442 stopped
  thread #1: tid = 0x2427, 0x00007fff84f3f716 libsystem_kernel.dylib`__psynch_cvwait + 10, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
* thread #2: tid = 0x245d, 0x00007fff84f3f9aa libsystem_kernel.dylib`__select + 10
  thread #3: tid = 0x2a8d, 0x00007fff84f4094a libsystem_kernel.dylib`poll + 10
  thread #4: tid = 0x2a9a, 0x00007fff84f3f716 libsystem_kernel.dylib`__psynch_cvwait + 10

(lldb) call (void)rb_backtrace()
</code>```

Kernel panic screen: You need to restart your computer.

At this point the kernel crashed with the following backtrace found in log:

```<code>panic(cpu 2 caller 0xffffff80022dcc1d): Kernel trap at 0xffffff80025f69e4, type 14=page fault, registers:
Fault CR2: 0x0000000001f6d695, Error code: 0x0000000000000000, Fault CPU: 0x2
Backtrace (CPU 2), Frame : Return Address
0xffffff81f0ca3aa0 : 0xffffff8002223139
0xffffff81f0ca3b20 : 0xffffff80022dcc1d
...
BSD process name corresponding to current thread: ruby

Mac OS version:
13F1077

Kernel version:
Darwin Kernel Version 13.4.0: Wed Mar 18 16:20:14 PDT 2015; root:xnu-2422.115.14~1/RELEASE_X86_64
last loaded kext at 244023643290: com.apple.filesystems.msdosfs 1.9 (addr 0xffffff7f8308c000, size 65536)
loaded kexts:
foo.tap 1.0
foo.tun 1.0
org.virtualbox.kext.VBoxNetAdp  4.3.12
org.virtualbox.kext.VBoxNetFlt  4.3.12
org.virtualbox.kext.VBoxUSB 4.3.12
org.virtualbox.kext.VBoxDrv 4.3.12
com.apple.filesystems.msdosfs   1.9
...
</code>```

This happened already twice.

What was the reason for a kernel crash? Is it a lldb/kernel bug, or expected behaviour by doing something wrong? If so, what should be the correct safer approach of calling rb_backtrace() on different threads (without crashing the kernel)?

For clarification, ruby script (vagrant) was run without sudo, the same as lldb.

I'm using lldb-320.4.160.


问:
How to dump PHP backtrace on live running script in lldb?
I'm trying to print PHP backtrace of the live running script using the following 2 simple steps:

Run PHP script as:

```<code>php -r "sleep(1000);"
</code>```

On another console, I've called directly zif_debug_backtrace() from lldb:

```<code>echo 'call (void)zif_debug_backtrace()' | lldb -p $(pgrep -fn php)
</code>```

Above worked, however the process stopped with the following warning:

```<code>Warning: sleep() expects at most 2 parameters, 1606408648 given in Command line code on line 1
Call Stack:
    0.0016     235152   1. {main}() Command line code:0
    0.0021     235248   2. sleep(1000) Command line code:1
</code>```

Why the script stopped and how to prevent that? Is it possible to print PHP backtrace during live run without affecting the script?

Is it because I should specify some return address? If so, which one?

Btw. The same happening when calling zif_debug_print_backtrace() and when calling custom_backtrace() it is showing: Backtrace null function called. I'm using xdebug if that change anything.

Maybe I need to call a different function like zend_fetch_debug_backtrace (see: image dump symtab)? Or use the right arguments, if so, which one?

I'm interested either in lldb or gdb solutions.