4 ms·

They mentioned WinDbg and OllyDbg but both are quirks of the past (except WinDbg usage for kernel debugging), and there's a better tool for this - x32dbg/x64dbg

by xvilka 6y ago

They mentioned WinDbg and OllyDbg but both are quirks of the past (except WinDbg usage for kernel debugging), and there's a better tool for this - x32dbg/x64dbg[1]. It's open-source, unlike WinDbg and actively developed, unlike OllyDbg. Moreover, recently we worked a lot on improving Windows support in radare2 [2] and Cutter[3]. Most of our fixes should land in the upcoming 4.5.0[4] release. This summer one of our GSoC students works on improving reversible debugging [5] feature as well. And of course, both integrated with Frida as well - see r2frida plugin[6]. [1] https://x64dbg.com/ https://x64dbg.com/ [2] https://github.com/radareorg/radare2 https://github.com/radareorg/radare2 [3] https://github.com/radareorg/cutter https://github.com/radareorg/cutter [4] https://github.com/radareorg/radare2/milestone/51 https://github.com/radareorg/radare2/milestone/51 [5] https://www.radare.org/gsoc/2020/ideas.html#title_10 https://www.radare.org/gsoc/2020/ideas.html#title_10 [6] https://github.com/nowsecure/r2frida https://github.com/nowsecure/r2frida

xeeeeeeeeeeenu 6y ago
Microsoft has recently modernized WinDbg[1]. Sadly, it's available only via the Microsoft Store[2]. [1] - https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-using-windbg-preview https://docs.microsoft.com/en-us/windows-hardware/drivers/de... [2] - https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86 https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn8...
- userbinator 6y ago
  My reaction upon seeing that can be summed up in two words: WTF!?, yuck! Even the latest version of Visual Studio, their flagship IDE, doesn't have that stupid ribbon UI, because they know their developers absolutely abhor it. To see it in WinDbg, whose userbase is even more traditional and "hardcore", is extremely shocking. With that ridiculous full-screen File menu (or page?), it looks like a part of Microsoft Office!
  - oldmanhorton 6y ago
    The vast majority of the interaction with the new windbg is using the same commands in the same tiling inner windows as before. The ribbon is usually hidden if you know the key commands to move around. It's only to help new and infrequent users find their way around.
    - userbinator 6y ago
      It's only to help new and infrequent users find their way around. Visual Studio is what most Windows developers use, including beginners, and it doesn't need --- or want --- a ribbon. It also doesn't have a full-screen File "menu", which is a repulsive visual assault and one of the other abominations that came from recent versions of Office. The UI isn't even the worse of it. Old WinDbg was a pretty portable thing that you could just copy onto a machine wherever you wanted to debug something. New WinDbg is... https://lifeinhex.com/running-windbgx-on-windows-7/ https://lifeinhex.com/running-windbgx-on-windows-7/ ...no. Just... no. (Yes, keep on downvoting me if you want, I don't care. I've had enough of this idiotic 'modern' shit creeping into everything.)
- binarycrusader 6y ago
  It is actually possible to download it if you have the URL without going through the store; see this thread: https://twitter.com/M_Cedervall/status/1228338401876807682 https://twitter.com/M_Cedervall/status/1228338401876807682 I suspect a more formal solution will be available soon, but for now, there's this feedback post at GitHub where you can add your vote for supporting it: https://github.com/microsoftfeedback/WinDbg-Feedback/issues/19 https://github.com/microsoftfeedback/WinDbg-Feedback/issues/...
binarycrusader 6y ago
As the other poster noted, WinDbg is actually being actively developed. In fact, it even supports JavaScript. https://github.com/Microsoft/WinDbg-Samples https://github.com/Microsoft/WinDbg-Samples https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-using-windbg-preview https://docs.microsoft.com/en-us/windows-hardware/drivers/de... As for suitability with userland debugging; I use the WinDbg Preview version almost every day to debug userland programs. I rarely use it for kernel/driver debugging. Quite frankly I was surprised how easy it was to pickup given that I was mostly used to Solaris' mdb and the ubiquitous gdb on other *nixes.
nickysielicki 6y ago
Thanks for all the work on radare, xvilka! I've been using it for a few years at this point and I never thought it would be as good as it is today. I don't even bother with pirating IDA anymore.
weinzierl 6y ago
> They mentioned WinDbg and OllyDbg but both are quirks of the past (except WinDbg usage for kernel debugging), and there's a better tool for this - x32dbg/x64dbg[1]. There is also Immunity Debugger which is kind of the successor of OllyDbg. It's got some popularity in malware analysis and exploit development circles. ImmDgb is actively developed and freely available but is not open source.
cheerlessbog 6y ago
Can it read windows symbol files (pdb)? I understood they are complex and undocumented.
- xvilka 6y ago
  Yes, it can. We have our own parser [1]. It will be improved even more this summer. [1] https://github.com/radareorg/radare2/tree/master/libr/bin/pdb https://github.com/radareorg/radare2/tree/master/libr/bin/pd...

by xvilka 6y ago

xeeeeeeeeeeenu 6y ago

Microsoft has recently modernized WinDbg[1]. Sadly, it's available only via the Microsoft Store[2]. [1] - https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-using-windbg-preview https://docs.microsoft.com/en-us/windows-hardware/drivers/de... [2] - https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn86 https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn8...

userbinator 6y ago
My reaction upon seeing that can be summed up in two words: WTF!?, yuck! Even the latest version of Visual Studio, their flagship IDE, doesn't have that stupid ribbon UI, because they know their developers absolutely abhor it. To see it in WinDbg, whose userbase is even more traditional and "hardcore", is extremely shocking. With that ridiculous full-screen File menu (or page?), it looks like a part of Microsoft Office!
- oldmanhorton 6y ago
  The vast majority of the interaction with the new windbg is using the same commands in the same tiling inner windows as before. The ribbon is usually hidden if you know the key commands to move around. It's only to help new and infrequent users find their way around.
  - userbinator 6y ago
    It's only to help new and infrequent users find their way around. Visual Studio is what most Windows developers use, including beginners, and it doesn't need --- or want --- a ribbon. It also doesn't have a full-screen File "menu", which is a repulsive visual assault and one of the other abominations that came from recent versions of Office. The UI isn't even the worse of it. Old WinDbg was a pretty portable thing that you could just copy onto a machine wherever you wanted to debug something. New WinDbg is... https://lifeinhex.com/running-windbgx-on-windows-7/ https://lifeinhex.com/running-windbgx-on-windows-7/ ...no. Just... no. (Yes, keep on downvoting me if you want, I don't care. I've had enough of this idiotic 'modern' shit creeping into everything.)
binarycrusader 6y ago
It is actually possible to download it if you have the URL without going through the store; see this thread: https://twitter.com/M_Cedervall/status/1228338401876807682 https://twitter.com/M_Cedervall/status/1228338401876807682 I suspect a more formal solution will be available soon, but for now, there's this feedback post at GitHub where you can add your vote for supporting it: https://github.com/microsoftfeedback/WinDbg-Feedback/issues/19 https://github.com/microsoftfeedback/WinDbg-Feedback/issues/...

binarycrusader 6y ago

As the other poster noted, WinDbg is actually being actively developed. In fact, it even supports JavaScript. https://github.com/Microsoft/WinDbg-Samples https://github.com/Microsoft/WinDbg-Samples https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugging-using-windbg-preview https://docs.microsoft.com/en-us/windows-hardware/drivers/de... As for suitability with userland debugging; I use the WinDbg Preview version almost every day to debug userland programs. I rarely use it for kernel/driver debugging. Quite frankly I was surprised how easy it was to pickup given that I was mostly used to Solaris' mdb and the ubiquitous gdb on other *nixes.

nickysielicki 6y ago

Thanks for all the work on radare, xvilka! I've been using it for a few years at this point and I never thought it would be as good as it is today. I don't even bother with pirating IDA anymore.

weinzierl 6y ago

> They mentioned WinDbg and OllyDbg but both are quirks of the past (except WinDbg usage for kernel debugging), and there's a better tool for this - x32dbg/x64dbg[1]. There is also Immunity Debugger which is kind of the successor of OllyDbg. It's got some popularity in malware analysis and exploit development circles. ImmDgb is actively developed and freely available but is not open source.

cheerlessbog 6y ago

Can it read windows symbol files (pdb)? I understood they are complex and undocumented.

xvilka 6y ago
Yes, it can. We have our own parser [1]. It will be improved even more this summer. [1] https://github.com/radareorg/radare2/tree/master/libr/bin/pdb https://github.com/radareorg/radare2/tree/master/libr/bin/pd...