X64_dbg: An open-source x64/x86 debugger for Windows

by dgavrilov • 12 years ago

133 42 12 years ago

Meai• 12 years ago

That looks awesome, is there something like this for linux as well? Or what is the current way linux programmers debug x86?

sspiff2• 12 years ago

GDB or LLDB?

bndr• 12 years ago

Linux standard debugger is gdb.

MichaelBurge• 12 years ago

You can use GDB on Windows too - MinGW have Windows versions of the usual set of tools(gcc, gdb, objdump, grep, etc.).

I highly recommend MinGW if you do any serious work on a Windows machine.

diydsp• 12 years ago

Can you recommend a good way to get GUI for gdb on Linux? I played a bit with xgdb, but it was very primitive in my experience. Thank you.

scaramanga2• 12 years ago

There's generally very little call for binary-level debuggers in linux. So everything is oriented towards source-level debuggng. Which makes sense since normally source code is available.

IMO gdb isn't very good for binary-level debugging, which is pretty much a euphemism for reverse-engineering anyway. It'd be nice to have something like that. I tinkered around with building such a thing years ago[0] but I wanted it to be cross-platform (I was using PPC at the time). But found libdisasm to be a bit limited as a disassembler suitable for such a thing.

[0]. http://www.scaramanga.co.uk/stuff/debugger/l33t-debugger.png

wspeirs3• 12 years ago

You don't always have the code, check out edb here: http://codef00.com/projects#debugger or here https://code.google.com/p/edb-debugger/

gue5t• 12 years ago

Check out radare2 (http://radare.org/), which is one of the best tools for binary reversing available on Linux.

userbinator2• 12 years ago

So everything is oriented towards source-level debuggng. Which makes sense since normally source code is available.

Maybe it's just the way I use debuggers, but I don't find this to be a particularly compelling reason; I use instruction-level debugging quite often even when I have the source (debugging a program I wrote, when simpler methods fail), to [1] verify that the high-level language statements are doing the expected, [2] ensure that the compiler is generating the expected instructions, and [3] to observe where exactly the bug is.

IMO gdb isn't very good for binary-level debugging

Having come from a Windows background, I'd say using gdb for that is an absolute nightmare - it appears to almost be designed to actively make it harder to do instruction-level debugging, despite the fact that the implementation of a debugger for source code is far more complex than one that doesn't. E.g. the "disassemble" command absolutely requires a symbol table, and will still complain if there's no "function" at some address, when all it really needs to do is start reading the bytes at the address it's given as a parameter - which could be the name of a symbol - and interpret them as instructions. Instead the somewhat unintuitive "workaround" is to use "x/i".

mackal• 12 years ago

IDA Pro is available on Linux, but I think you were looking for a free option. Although the shareware version of IDA Pro works very well under WINE (the shareware version is an old release that is missing some features and is before they added Linux support)

mkup• 12 years ago

IDA Pro running on Windows can connect to GDB server running on Linux, even to embedded platforms like ARM/MIPS.

sspiff2• 12 years ago

Minor nitpick: X32 is not "32-bit x86", it's an entirely different ABI[1], using 32-bit pointers but the (faster) 64-bit instructions.

You're better of just calling it x86 to describe the 32-bit instruction set.

I love the connections between jumps and landing sites though, very helpful!

[1] https://en.wikipedia.org/wiki/X32_ABI

ekr• 12 years ago

How does this compare to WinDBG, which already seems fairly mature? Why would I switch to this? (if you ask me, the problem of FOSS doesn't come into play here, since Windows itself is a closed platform).

And indeed, a similar GUI-based debugger for Linux would be awesome as well.

userbinator2• 12 years ago

if you ask me, the problem of FOSS doesn't come into play here, since Windows itself is a closed platform

There are many Windows users who prefer to use FOSS despite the OS itself not being so, and have more pragmatic reasons for using Windows over some other (possibly FOSS) OS.

asveikau• 12 years ago

To me the strength of windbg is not the 1990s style Multiple Document Interface UI. It's the fact that the commands are so terse and powerful. Once you get over the (steep, I'll admit) learning curve, you get a lot done without typing very much. I find gdb a lot more painful to get around for even simple stuff.

The remote debugging support is also phenomenal, though you need a culture to support it. I've only seen it work really well on the MS campus.

WalterBright• 12 years ago

Windbg was broken on Win 7, in that it no longer is able to walk the stack by following [EBP]. If I want to get a call stack, I have to use Windbg on Windows XP.

farresito2• 12 years ago

Hey, great work! It's a little bit unfortunate it doesn't work for Linux, since I've been looking for something like that for a long time and haven't found one, yet.

How hard would it be to port this to Linux? What would need to be ported? I don't have much free time, but I might be able to contribute to a port for Linux, given enough free time.

wspeirs3• 12 years ago

No need to port anything, you can use edb: http://codef00.com/projects#debugger or https://code.google.com/p/edb-debugger/

farresito2• 12 years ago

I've used it for some time and don't really like it much.

rossy• 12 years ago

This looks nice. From the layout of some of the menus, it seems like it was written by fans of OllyDbg, maybe because OllyDbg still has no 64-bit support. OllyDbg is great, so hopefully I can get some use out of this tool as well.

scaramanga2• 12 years ago

Yeah exactly what I thought, too, seems to have feature parity with OllyDbg? As well as extras?

_nullandnull_• 12 years ago

This 64-bit version of Olldbg is in the works

http://ollydbg.de/odbg64.html

MBS• 12 years ago

The link to the downloads page is broken. Anyone?

jagger27• 12 years ago

The site is quite broken on my Nexus 4.

http://i.imgur.com/H72QriT.png

Cyph0n• 12 years ago

I don't think that's a major issue.

jpmonette• 12 years ago

It's really good to see such a lightweight interface, like Ollydbg. I stopped using Ollydbg back then when I had to debug some x64, but didn't find anything free with such a minimalist and powerful UI. I guess you guys made it, good job :)! I wish it was available for Mac too thought - not using Windows anymore.

leeoniya• 12 years ago

in case anyone missed it, there is Olly for x64: http://www.ollydbg.de/

lawnchair_larry• 12 years ago

You might want to check that again. There is no x64 olly available to anyone other than the author. It's been a "work in progress" for a decade or so.

JoachimS• 12 years ago

For OSX there is now hopper, a binary debugger and reverse Engineering tool. Something between Olly and IDA with a nice interface. Can work on x86 as well as ARM binaries. Hopper is not open source. http://www.hopperapp.com

voltagex_2• 12 years ago

I'm really really hoping Hopper can catch up to IDA. I'm still not good enough with assembly to make much use of either, but the free version of IDA can make some really nice flowcharts which are pretty helpful.

voltagex_2• 12 years ago

This is based on the TitanEngine. http://www.reversinglabs.com/resources/open-source/titanengi...

Is there a word for open source that has no revision history? (there's just a .rar file on that site). 7zip does it too and it drives me crazy.

danbmil99• 12 years ago

Is there a word for open source that has no revision history?

Open Crap?

phire• 12 years ago

Source Dump.

mrexodia• 12 years ago

We completely rewrote TitanEngine into TitanEngine Community Edition: https://bitbucket.org/mrexodia/titanengine-update

zer0zzz• 12 years ago

Hey look, it's GPLv3. So the only people using it are probably writing malware. I don't expect any commercial windows shops or anyone at MS will use this tool. That said, seems like a pretty cool project.

X64_dbg: An open-source x64/x86 debugger for Windows

Related Stories