2013-11-14 21:53:30 +00:00
|
|
|
[This is a new version of this repository. The old version can be found ]
|
|
|
|
|
[here: https://bitbucket.org/mrexodia/x64_dbg_old ]
|
2013-11-14 20:57:07 +00:00
|
|
|
|
2014-05-13 20:38:08 +00:00
|
|
|
>Downloads:
|
|
|
|
|
These can be found at https://sf.net/projects/x64dbg/
|
2013-11-14 22:05:31 +00:00
|
|
|
|
|
|
|
|
>Overview:
|
2013-11-14 21:53:30 +00:00
|
|
|
This is a x64/x32 debugger that is currently in active development.
|
2013-11-14 20:55:18 +00:00
|
|
|
|
|
|
|
|
The debugger has (currently) three parts:
|
|
|
|
|
- DBG
|
|
|
|
|
- GUI
|
|
|
|
|
- Bridge
|
|
|
|
|
|
|
|
|
|
DBG is the debugging part of the debugger. It handles debugging (using
|
|
|
|
|
TitanEngine) and will provide data for the GUI.
|
|
|
|
|
|
2013-11-14 21:53:30 +00:00
|
|
|
GUI is the graphical part of the debugger. It is built on top of Qt and it
|
2014-06-15 11:39:07 +00:00
|
|
|
provides the user interaction, the dump window, the disassembly,
|
|
|
|
|
the register window, the memory map view, the log view etc.
|
2013-11-14 20:55:18 +00:00
|
|
|
|
|
|
|
|
Bridge is the communication library for the DBG and GUI part (and maybe in
|
|
|
|
|
the future more parts). The bridge can be used to work on new features,
|
2014-06-15 11:39:07 +00:00
|
|
|
without having to update the code of the other parts. It also ensures
|
|
|
|
|
low-level code stays (partially separated from the high level GUI code).
|
2013-11-14 20:55:18 +00:00
|
|
|
|
2013-11-14 22:05:31 +00:00
|
|
|
>Features:
|
2013-11-14 20:55:18 +00:00
|
|
|
- variables (with regard to the upcoming script feature)
|
|
|
|
|
- basic calculations (var*@401000+.45^4A)
|
|
|
|
|
- hide debugger (very basic)
|
|
|
|
|
- software breakpoints (INT3, LONG INT3, UD2)
|
|
|
|
|
- memory breakpoints (read, write, execute)
|
|
|
|
|
- hardware breakpoints (access, write, execute)
|
|
|
|
|
- stepping (into, over, n instructions)
|
|
|
|
|
- rtr (return from function)
|
|
|
|
|
- memory allocation/deallocation in the debuggee
|
|
|
|
|
- quickly accessing API addresses (GetProcAddress->76E13620)
|
2014-06-15 11:39:07 +00:00
|
|
|
- fully customizable GUI colors and instruction highlighting
|
|
|
|
|
- IDA-like sidebar with jump arrows
|
|
|
|
|
- IDA-like instruction token highlighting (hold 'Z' in disassembly)
|
2013-11-14 21:53:30 +00:00
|
|
|
- memory map
|
|
|
|
|
- basic module labeling
|
2014-06-15 11:39:07 +00:00
|
|
|
- import reconstruction (using Scylla)
|
2013-11-14 21:53:30 +00:00
|
|
|
- drag&drop files
|
|
|
|
|
- goto window
|
2014-06-15 11:39:07 +00:00
|
|
|
- register/flags view with editing support and change highlighting
|
2013-11-14 21:53:30 +00:00
|
|
|
- quite fast working in really big code pages (tested up to 5GB)
|
|
|
|
|
- GUI hotkeys
|
|
|
|
|
- dynamic jump arrow (just like OllyDbg)
|
2013-11-24 23:10:25 +00:00
|
|
|
- user databases for labels/comments/breakpoints/bookmarks (*.dd64 or *.dd32 files)
|
2013-11-19 21:56:25 +00:00
|
|
|
- easy context menu in disassembly (to set breakpoints etc)
|
2013-11-24 23:10:25 +00:00
|
|
|
- plugin support
|
2013-12-28 01:45:44 +00:00
|
|
|
- (manual) function analysis
|
2014-03-03 00:24:16 +00:00
|
|
|
- easily follow calls/jumps/ret (press ENTER when selecting)
|
2014-06-15 11:39:07 +00:00
|
|
|
- (buggy) dynamic commenting (strings)
|
2014-02-10 23:42:19 +00:00
|
|
|
- scripting support (using the debugger commands)!
|
2014-06-15 11:39:07 +00:00
|
|
|
- simple dump window with various data modes
|
2014-02-24 12:00:47 +00:00
|
|
|
- symbols (+ exports) view with search
|
2014-03-03 00:24:16 +00:00
|
|
|
- simple stack view
|
|
|
|
|
- programmable reference view
|
2013-11-14 21:53:30 +00:00
|
|
|
|
2013-11-14 22:05:31 +00:00
|
|
|
>Known bugs:
|
2013-11-24 23:10:25 +00:00
|
|
|
- memory breakpoints sometimes fail (TitanEngine bug)
|
2013-11-14 21:53:30 +00:00
|
|
|
|
2013-11-14 22:05:31 +00:00
|
|
|
>Last words:
|
2013-11-14 21:53:30 +00:00
|
|
|
The debugger core is based on TitanEngine (an updated version,
|
|
|
|
|
https://bitbucket.org/mrexodia/titanengine-update)
|
|
|
|
|
|
|
|
|
|
Disassembly powered by BeaEngine (http://beaengine.org/).
|
|
|
|
|
|
|
|
|
|
The icon is taken from VisualPharm (http://www.visualpharm.com/)
|
|
|
|
|
|
2014-06-15 11:39:07 +00:00
|
|
|
Licensed under GLPv3
|
|
|
|
|
|
2013-11-14 22:05:31 +00:00
|
|
|
>Special thanks:
|
2013-11-14 21:53:30 +00:00
|
|
|
- acidflash
|
|
|
|
|
- Ahmadmansoor
|
2013-11-14 21:58:51 +00:00
|
|
|
- cyberbob
|
|
|
|
|
- Teddy Rogers
|
2013-11-14 21:53:30 +00:00
|
|
|
- EXETools community
|
|
|
|
|
- Tuts4You community
|
2013-11-24 23:10:25 +00:00
|
|
|
- DMichael
|
2014-04-22 23:21:47 +00:00
|
|
|
- TEAM DVT
|
2014-05-26 13:40:14 +00:00
|
|
|
- Artic
|
2013-11-14 21:58:51 +00:00
|
|
|
- Sorry if I forgot you!
|
2013-11-14 21:53:30 +00:00
|
|
|
|
2014-06-15 11:39:07 +00:00
|
|
|
>Developers:
|
2013-11-14 22:05:31 +00:00
|
|
|
- Mr. eXoDia
|
2014-06-15 11:39:07 +00:00
|
|
|
- Sigma
|
|
|
|
|
- tr4ceflow
|
