Exetools

Exetools (https://forum.exetools.com/index.php)
-   Developer Section (https://forum.exetools.com/forumdisplay.php?f=48)
-   -   x64dbg (https://forum.exetools.com/showthread.php?t=15328)

mr.exodia 10-28-2013 04:36

x64dbg
 
Hi everyone,
 
Maybe some of you heard it already, but Sigma and I are working on an x32/x64 debugger for Windows for a few months now... The debugger currently has the following features:
  • variables, currently command-based only
  • basic calculations, can be used in the goto window and in the register edit window. Example: var*@401000+(.45^4A)
  • software breakpoints (INT3, LONG INT3, UD2), currently command-only (just type 'bp addr')
  • hardware breakpoints (access, write, execute), also command-only
  • stepping (over, into, out, n instructions), can be done with buttons/shortcuts
  • memory allocation/deallocation inside the debuggee
  • quickly access API adresses (bp GetProcAddress)
  • syntax highlighting, currently not customizable
  • simple memory map (just addr+size+module+protection basically)
The debugger has an easy GUI, for which we looked a lot at Olly ;)
 
Screenshot:
http://rghost.net/49769041/image.png
 
Debug engine is TitanEngine, disassembler BeaEngine, icons are from various sources (see About dialog). We use QT for the GUI part.
 
If you have a suggestion, a bug report, need more info, want to contribute, just post here or send me a private message.
 
The latest public build + source can always be found on http://x64dbg.com (click 'Source'->'bin_public') to download the latest build. For now, you can download the first 'alpha' here: http://rghost.net/49769396
 
We would love to hear from you!
 
Greetings,
 
Mr. eXoDia & Sigma

ferrit.rce 10-28-2013 07:43

The idea is cool! :) BTW are you using TitanEngine version 2.0.3? Previously I've implemented some unpackers with this version but I've found several major bugs inside. I've reported all of these issues but seems like this code is dead. Because of that I've tried to fix them alone but I've found a spagetti code :D Just for your information...

mr.exodia 10-28-2013 08:33

Quote:

Originally Posted by ferrit.rce (Post 87628)
The idea is cool! :) BTW are you using TitanEngine version 2.0.3? Previously I've implemented some unpackers with this version but I've found several major bugs inside. I've reported all of these issues but seems like this code is dead. Because of that I've tried to fix them alone but I've found a spagetti code :D Just for your information...

Thanks! We use an updated version of TitanEngine... If you still know these bugs, you could report them here: https://bitbucket.org/mrexodia/titanengine-update/issues (I've fixed many)

Greetings,

Mr. eXoDia

ferrit.rce 10-28-2013 19:52

OK, I'll look for these issues and report them on the URL when I've found something...

Quote:

Originally Posted by mr.exodia (Post 87631)
Thanks! We use an updated version of TitanEngine... If you still know these bugs, you could report them here: https://bitbucket.org/mrexodia/titanengine-update/issues (I've fixed many)

Greetings,

Mr. eXoDia


JeRRy 10-28-2013 23:33

"Yes (mainly x32)" should be "Yes (mainly x64)"

ahmadmansoor 10-29-2013 04:32

I like this Idea very much .... but look on the steps to build this project will take a long time ,especially to get bug report and begin fix it, so for x32 it will be a waste of time ,but for x64 no problem.
anyway I would like to join this project too , maybe as a tester at this time and a coder later.
and I prefer to work on X64 more than x32 .u know ollyDbg take tha place .
so the best thing is thinking in x64 and make one like an ollyDbg x1.0 which all guys like it ,and try to emulate it Functionally.

mr.exodia 10-29-2013 05:40

@ferrit.rce: thanks in advance for that!

@Jerry: you're right, I wanted to change it, but I was too late to edit the post (maybe one of the admins could do that?)

@ahmadmansoor: great you want to join, of course you are welcome! As for the development time x32 and x64 require (almost) no different code. In fact, porting the GUI from x64->x32 took a few minutes :)

Our aim is indeed to add features like ollyDbg, our design is very different though (GUI and DBG are separate, so bugs can be easily fixed without having to recompile all modules) also the plugin architecture is going to be very different (currently there are only some ideas but there will be many types/places to add plugins to)

Also, a new release available in public_bin.

Changelog:
- added Scylla 'plugin' (start scylla with the current process/dll you have loaded)
- fixed many GUI bugs (redraw bugs etc), by Sigma
- fixed this disassembly bug with truncated QWORDS

Download in the repo

Greetings

NeOXOeN 10-30-2013 09:26

mr.exodia: nice.. i hope you will finish the project a lot of work..

bye NeO

sendersu 10-30-2013 13:06

Time of 1 man a hero in the field is out nowadays (IMHO)
only the Team could do things today
so if I'll see some parts I could do and I'll have some free time I'll join as well
right now as a QA only

ahmadmansoor 10-31-2013 22:01

what u use to compile !! ,I have installed Qt ,and try to compile in both qt and vs2010 .
no success .
so any some steps to help .

mr.exodia 10-31-2013 23:21

Quote:

Originally Posted by ahmadmansoor (Post 87702)
what u use to compile !! ,I have installed Qt ,and try to compile in both qt and vs2010 .
no success .
so any some steps to help .

The building process is sadly enough quite complicated, I'm working on a full guide right now, but it might take some time to get that.

Greetings

Sailor_EDA 11-02-2013 06:38

This is an excellent idea. In the past I had looked at incorporating an actual x86 simulator engine like Bochs to help with unpacking but it looks like TitanEngine is an excellent resource to do as well. Looking forward to this tool.

Ember 11-02-2013 07:16

Really good job, mr.exodia! I like to write patches in OllyDbg using the assemble command, it would be nice to have the assemble command so I could patch 64-bit programs in the same way.

mr.exodia 11-03-2013 08:11

Quote:

Originally Posted by Ember (Post 87726)
Really good job, mr.exodia! I like to write patches in OllyDbg using the assemble command, it would be nice to have the assemble command so I could patch 64-bit programs in the same way.

Good, I'm working on a NASM DLL, it should do for assembling I think. The only problem is that I wanna interpret everything as hex an nasm has no commandline for that and another problem is relative memory addresses that are in x64.

Greetings

emo 11-03-2013 20:14

source is have svn link?

mr.exodia 11-03-2013 23:18

Quote:

Originally Posted by emo (Post 87746)
source is have svn link?

No,

Its a Git repository.

Greetings

ahmadmansoor 11-04-2013 08:16

Hi friend ,pls check ur Email at G...
really this bridge of Qt make some more trouble to deal with vc++ .
and make it more complicated.
can u describe the way on how we can comiple a dll (VC++) file to work with ur debugger,how to get ur exported Functions?
what *.h we needed and not make a trouble .
Thanks in adv

mr.exodia 11-06-2013 23:03

Hi,

You can currently compile the project (EXE+DBG+BRIDGE) with VS2010. I'm currently porting the GUI to Qt v5.1.1 (which also has x64 builds available for download). If you are interested in compiling the GUI, please install Visual Studio 2012.

Greetings

mr.exodia 11-07-2013 22:14

GUI is compatible with Qt5, download the latest sources from the repo and compile with VS2012 (Just install vs12 and use Qt Creator)

Greetings

mr.exodia 11-15-2013 06:00

Code:

[This is a new version of this repository. The old version can be found ]
[here: https://bitbucket.org/mrexodia/x64_dbg_old                      ]

This is a x64/x32 debugger that is currently in active development.

The debugger has (currently) three parts:
- DBG
- GUI
- Bridge

DBG is the debugging part of the debugger. It handles debugging (using
TitanEngine) and will provide data for the GUI.

GUI is the graphical part of the debugger. It is built on top of Qt and it
provides the user interaction, the dump window (not yet implemented), the
disassembly, the register window, the memory map view, the log view etc.

Bridge is the communication library for the DBG and GUI part (and maybe in
the future more parts). The bridge can be used to work on new features,
without having to update the code of the other parts.

Right now the debugger supports the following features:
- variables (with regard to the upcoming script feature)
- basic calculations (var*@401000+.45^4A)
- hide debugger (very basic)
- software breakpoints (INT3, LONG INT3, UD2)
- memory breakpoints (read, write, execute)
- hardware breakpoints (access, write, execute)
- stepping (into, over, n instructions)
- rtr (return from function)
- memory allocation/deallocation in the debuggee
- quickly accessing API addresses (GetProcAddress->76E13620)
- highlighting (not yet customizable, but really helpful)
- memory map
- basic module labeling
- import reconstruction (plugin using Scylla)
- drag&drop files
- goto window
- register/flags view with editing support
- quite fast working in really big code pages (tested up to 5GB)
- GUI hotkeys
- dynamic jump arrow (just like OllyDbg)

Known bugs are:
- hardware breakpoints do not work properly on x64 (TitanEngine bug)
- sometimes the disassembly view is not updated (click anywhere to solve)
- ??? (please report)

The debugger core is based on TitanEngine (an updated version,
https://bitbucket.org/mrexodia/titanengine-update)

Disassembly powered by BeaEngine (http://beaengine.org/).

The icon is taken from VisualPharm (http://www.visualpharm.com/)

Special thanks:
- acidflash
- Ahmadmansoor
- EXETools community
- Tuts4You community

Greetings,

Mr. eXoDia & Sigma


mr.exodia 11-20-2013 05:59

Updated to v0.2Alpha:
- GUI hotkeys
- user databases for labels/comments/breakpoints (*.dd64 or *.dd32 files)
- easy context menu in disassembly (to set breakpoints etc)
- many bugfixes

Greetings,

Mr. eXoDia & Sigma

PS Please report bugs if you find any, we will fix then as soon as we can.
PS2 Plugin support is coming after we consider the disassembly view 'stable'

cxj98 11-20-2013 11:09

If I hit unload then hit restart debug, Ctrl + F2, it will not restart.

when will support modify disassemble code and copy all modified code to new exe?

also comment can't edit yet.

no breakpoint manager and bookmark manager.

mr.exodia 11-20-2013 14:29

Quote:

Originally Posted by cxj98 (Post 88151)
If I hit unload then hit restart debug, Ctrl + F2, it will not restart.

when will support modify disassemble code and copy all modified code to new exe?

also comment can't edit yet.

no breakpoint manager and bookmark manager.

Hi,

The restart feature is currently not implemented indeed. Will do that for the next release.

Comments you can set using the command: cmt, addr,"label" clearing goes like: cmtc addr

Command for labels is 'lbl' and 'lblc' (did I forget this in the help?) the gui will support comments and labels for the next release also.

Breakpoint, comment, label, bookmark manager also for the next release :)

Thanks for the message, most stuff I actuallt forgot to implement :D

Greetings

mr.exodia 11-25-2013 07:17

Hi everybody,

Today a small release (V0.03ALPHA) with the following important changes:
- fixed many bugs
- more context menu options (you can now select a HWBP to replace when DRX is full)
- bookmarks (ctrl+d)
- plugin support
- user database is stable, so your labels+comments+bookmarks+breakpoints are saved automatically

Download here: https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia & Sigma

PS If you have questions (about plugin support) or want to contribute in some way, feel free to contact me

anon_c 11-25-2013 12:29

Thanks for your work!

Indeed we are in need for good x64 debuggers

Am I missing something obvious or is it not possible yet to attach to a process?

AC

mr.exodia 11-25-2013 14:51

Quote:

Originally Posted by anon_c (Post 88307)
Thanks for your work!

Indeed we are in need for good x64 debuggers

Am I missing something obvious or is it not possible yet to attach to a process?

AC

Hi,

Its true, currently its not possible to attach, I will add this to the next release.

sendersu 11-25-2013 18:55

add Detach feature as well please

Insid3Code 12-14-2013 18:15

1 Attachment(s)
Please, take a look in this crash report...

mr.exodia 12-14-2013 20:43

Quote:

Originally Posted by Insid3Code (Post 88719)
Please, take a look in this crash report...

Thanks a lot for the report, the bug is now fixed inside the code and a new release will come out soon!

Greetings

mr.exodia 12-28-2013 22:20

Quick release v0.4alpha

Changelog:
- fixed many, many bugs
- added function analysis (currently manual, select some data, press SHIFT+F)
- added attach feature (little crash when you close x64_dbg, but basically it works)
- pageup/pagedown in disassembly
- string detection (very basic, no support for UNICODE yet)
- middle mouse to copy address of the currently selected instruction
- ??? probably some more improvements, check BitBucket for a full changelog

We are working on the dump/stack windows, but as Sigma is offline for some time now already I decided to do a quick release in between. Hopefully there will be a dump+stack window in the next release...

Detach feature currently has problems, so it will not work. Probably this has to do with TitanEngine and it's DebugLoop function, but more investigation is required.

Focus on the DBG side of the project will be adding support for loop highlighting, also manual and a good API that allows creation of analysis plugins.

Screenshot:
http://rghost.net/51253283/image.png

Happy new year everyone!

Mr. eXoDia

Insid3Code 12-30-2013 23:23

1 Attachment(s)
Hello mr.exodia,
Please, check the attachment...

mr.exodia 12-31-2013 00:25

Quote:

Originally Posted by Insid3Code (Post 88997)
Hello mr.exodia,
Please, check the attachment...

Hi, thanks for the report! I actually forgot that the breakpoint window was still in progress :D

Will be fixed in the next release...

justlovemm 01-19-2014 16:30

Is the ollydebug for x64?

cxj98 01-20-2014 21:58

Quote:

Originally Posted by justlovemm (Post 89488)
Is the ollydebug for x64?

No, it isn't.

mr.exodia 02-09-2014 04:39

v0.5alpha out!

Main improvements:
- draft implementation of hex dump (by Sigma)
- bugfixes
- generates crash dumps on crash

Download: https://bitbucket.org/mrexodia/x64_dbg/downloads

Next on the todo list are: scripting support, working dump, improved plugin support

Greetings

mr.exodia 02-09-2014 07:46

Hotfix released (now exceptions are no longer reported, just creates a crash dump)

Download
https://bitbucket.org/mrexodia/x64_dbg/downloads

mr.exodia 02-11-2014 07:45

V0.6ALPHA Released!

Changelog:
- scripting support (using the debug commands)

Just post here when you need a certain script command, I know other stuff isn't finished yet, but I'm waiting for Sigma to come back online so we can continue with the HEX dump etc.

Download:
https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia

cxj98 02-11-2014 10:26

can you provide complete files, I don't need download this, that and extractor them all the time.

mr.exodia 02-11-2014 14:52

@cxj98: I do not want to upload 20mb every time I do a small update, thats why you have to download more files. When the debugger gets more stable, you will only have to download release_XXX.rar and extract it to your x64_dbg directory to update :)

Greetings

mr.exodia 02-13-2014 23:16

V0.7ALPHA Released!

Changelog:
- many fixes with the scripting support
- added many general purpose commands (see help)
- added some script commands (msg and msgyn)

Download:
https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia


All times are GMT +8. The time now is 10:08.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2021, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX