[Nanomite v 0.1 BETA] x64/x86 debugger - GUI and Class

Сейчас на форуме: Rio, vsv1, site-pro (+7 невидимых)

Посл.ответ	Сообщение
NikolayD Ранг: 189.9 (ветеран), 334thx Активность: 0.3↘0 Статус: Участник	Создано: 03 января 2013 05:10 · Личное сообщение · #1 Hey all, Nanomite is a graphical debugger I wrote in Cpp and supports x64, x86 and WOW64 debugging and also offers different features ( shown in Pictures below). It uses the windows debugging api, beaengine and dbghelp. No GUI framework has been used! The x64 version of the debugger can debug x64 and WOW64 and the x86 only x86. If you are debugging multiple processes ( child processes of the main application) you can select the process for each action over a drop down menu which appears when you click a button in the main gui. In the most windows the data is sorted by the Process ID. Currently no data modification is possible (like memory, opcodes, regs or something else) but its something that will come! Of course there is a lot of work to be done and the GUI is just ugly but maybe some of you want to help and commit code and YES its fully open source for all . Issues ( I already have a lot known ones) will be fixed as soon as I have time. Also I will write a manual for the GUI and the class ( see below ) to cover "how to use, how does it work and is it able to" questions. You can download the binarys from the git repro (Nanomite.exe, dbghelp.dll and NanomiteConfig.ini are needed if you want to test the Debugger): --> x86 <-- --> x64 <-- Class: also I want to offer you a class I wrote in Cpp. This class offers different features for debugging and supports x64, x86 and WOW64 debugging and is the core of Nanomite. If you want me to add some features or find bugs than reply here or write me an email / pm. If you need a sample how to use it than you can take a look at : --> Link <-- Please keep in mind that this is a free time project and I only work on it when I have time. If you want to contribute I would be happy about emails, pm´s and posts to this topic. Ideas, Feature requests and bug reports are welcome . Greetz Zer0Flag Бетка ) \| Сообщение посчитали полезным: nick8606, antipod, Hexxx, BAHEK, MasterSoft, Dream_, DenCoder

Dart Raiden Ранг: 81.6 (постоянный), 102thx Активность: 0.06↘0.02 Статус: Участник	Создано: 12 марта 2013 04:27 · Личное сообщение · #2 Уже beta7. Портировали на QT. https://github.com/zer0fl4g/Nanomite/tree/master/Build --> Полный ченджлог <--
BfoX Ранг: 397.0 (мудрец), 179thx Активность: 0.17↘0.1 Статус: Участник	Создано: 12 марта 2013 10:54 · Личное сообщение · #3 x32 https://github.com/zer0fl4g/Nanomite/tree/master/Build/Win32 x64 https://github.com/zer0fl4g/Nanomite/tree/master/Build/x64 ----- ...или ты работаешь хорошо, или ты работаешь много...
Replicant Ранг: 2.9 (гость), 2thx Активность: 0=0 Статус: Участник	Создано: 14 марта 2013 20:16 · Личное сообщение · #4 Задумка интересная. Надобность в хорошем x64-отладчике давно назрела. Плохо только то, что проект опенсорсный (как хорошо известно, разработка таких программ обычно движется со скоростью черепахи, и может прекратиться в любой момент). Через годик, я думаю, можно будет посмотреть. Если проект к тому времени будет жив. \| Сообщение посчитали полезным: ppc
r99 Ранг: 328.7 (мудрец), 73thx Активность: 0.17↘0.01 Статус: Участник	Создано: 14 марта 2013 20:23 · Личное сообщение · #5 это что под 7-ку и выше?
Jaa Ранг: 134.1 (ветеран), 246thx Активность: 0.22↘0.1 Статус: Участник realist	Создано: 23 апреля 2013 13:34 · Поправил: Jaa · Личное сообщение · #6 update Code: beta 10 fixed a bug which displayed a wrong function offset in callstack fixed a bug which didn´t break on module ep if "break on system ep" was selected fixed a bug which lead to a crash if a wow64 file has ordinal imports fixed a bug in the disassembly view which caused ungentle down scrolling fixed a bug in PEManager which double loaded debugged files fixed a bug which may lead to an error in disassembler fixed a crash on context menus if not debugging something improved HeapView added Message in DebugLog if breaking on MemoryBP added PEViewer added native check for Admin rights added warnings if API import fails added display of current PID/TID in mainwindow title added function view added and cleaned context menus Notes: - I´m happy to announce "En0mis" as a new Developer in this project! - function view - scans the memory of the loaded targets and scans for functions. --> Link <--
Dart Raiden Ранг: 81.6 (постоянный), 102thx Активность: 0.06↘0.02 Статус: Участник	Создано: 10 мая 2013 16:14 · Поправил: Dart Raiden · Личное сообщение · #7 beta 11 Code: - fixed a bug in options which didn't save the correct settings - fixed display of exceptions if no symbols have been found - fixed a bug which made register editor not working in x64 - fixed a bug which displayed wrong modules in window view - fixed a bug which didn't display exceptions if a breakpoint was set on this offset - fixed a bug in disassembler which may caused application crashes due to wrong memory protection - fixed a possible crash in context menus - fixed display of the offset in string view - fixed unvalid breakpoint offsets caused by alsr - improvements on AttachDlg - added cleanup on debugge termination - added process patching - added more context menus to DetailView - added display of mainthread in DetailView - added F5 Hotkey to reload some views - added possibility to save debug log to file - added possibility to copy data to clipboard - added possibility to break on new Processes, Threads or DLL loads - added dockable widgets to the mainview - added save of window sizes and positions on close --> Link <-- \| Сообщение посчитали полезным: kingmonstr
Dart Raiden Ранг: 81.6 (постоянный), 102thx Активность: 0.06↘0.02 Статус: Участник	Создано: 09 июня 2013 04:27 · Поправил: Dart Raiden · Личное сообщение · #8 beta 12 Code: - fixed scrollbar in trace view - fixed a possible crash in disassembler - fixed a memory leak in the window settings - fixed a memory leak in dll and process name receiving - fixed a memory leak in trace view - fixed display of ascii strings in ascii view - fixed a bug which could cause wrong run to user code if debugging more than one process - fixed a bug which lead to incorrect restarts on slow systems - fixed a bug which caused double calling of some functions in context menus - fixed a bug in hex view which may showed wrong data - fixed a bug in heap view which caused a crash when copying the whole line to clipboard - added PatchManager - added process privilege view - added commandline options - added possibility to set process priorities - added possibility to set memory protection - added display of current priority in detail view - context menu - added display of segment registers in reg view - added background worker to string view, hex view and functions view - removed processes we can't access from the attach dialog
Flint Ранг: 238.8 (наставник), 67thx Активность: 0.2↘0 Статус: Участник CyberHunter	Создано: 09 июня 2013 13:03 · Личное сообщение · #9 А где регистр edi ? ----- Nulla aetas ad discendum sera \| Сообщение посчитали полезным: Abraham
Artem_N Ранг: 17.7 (новичок), 13thx Активность: 0.01↘0 Статус: Участник	Создано: 09 июня 2013 13:58 · Личное сообщение · #10 Процитирую: "Regarding Nanomite it's abhorrent piece of software, buggy as hell, lots of options but nothing is working" И действительно: "fixed a memory leak"... Похоже, пишет какой-то школьник. Как можно таким пользоваться?!
Dart Raiden Ранг: 81.6 (постоянный), 102thx Активность: 0.06↘0.02 Статус: Участник	Создано: 11 июля 2013 10:00 · Поправил: Dart Raiden · Личное сообщение · #11 Flint пишет: А где регистр edi ? beta 13: - fixed some crashs related to the qt /MT build, see note for more details - fixed some bugs in the patch manager - fixed the symbol display in the trace view - fixed a bug which showed wrong trace data - added Exception Assistant - added colors to the state bar - added missing edi/rdi register - added option to break on tls callback - added possibility to show registers of a thread in detailview - added possibility to show TEB/TBI of a thread in detailview - added possibility to show PEB/PBI of a process in detailview - added possibility to set Nanomite as default just in time debugger - added possibility in PEEditor to show exports of a loaded module in disassembler - added updater (thanks to inisider for this contribution) - updated beaengine to rev. 174 - updated PE-Editor layout - updated DetailView layout - updated Options to include more options, easier config
hors Ранг: 136.0 (ветеран), 360thx Активность: 0.27↘0.14 Статус: Участник Qt Developer	Создано: 11 июля 2013 11:16 · Поправил: hors · Личное сообщение · #12 Artem_N пишет: Процитирую: "Regarding Nanomite it's abhorrent piece of software, buggy as hell, lots of options but nothing is working" И действительно: "fixed a memory leak"... Похоже, пишет какой-то школьник. Как можно таким пользоваться?! Напишите тогда свой отладчик. Лучше. Все Вам тогда спасибо скажут. У Вас должно получиться. Вы ведь не "школьник" и всё знаете. ----- http://ntinfo.biz \| Сообщение посчитали полезным: Jaa, Artem_N, antipod, SergX
BAHEK Ранг: 76.9 (постоянный), 116thx Активность: 0.06↘0 Статус: Участник	Создано: 11 августа 2013 08:45 · Личное сообщение · #13 beta 14 Code: + fixed a bug in the options not showing exception wich have been saved using the exception assistant + fixed a bug when stepping over a return + fixed a bug in breakpoint manager which deleted the wrong bp when removing a selected bp + fixed a bug in breakpoint manager which created unusable breakpoints + fixed a bug in breakpoint manager which may resolved ModuleName::APIName to wrong offset + fixed a bug in assembler which double loaded the gui + fixed a bug in hardware breakpoints which did not activate them in running processes + fixed a bug in hardware breakpoints which did not activate them on the current thread + fixed a bug where by detaching from a suspended process didn't resume the process + fixed a bug which did not handle hardware breakpoints for wow64 targets + fixed a bug which showed a wrong menu if child processes where present in the debugging session + fixed a bug which reloaded the disassembler to the wrong offset after adding a new patch + fixed a bug which caused wrong scrolling of disassembler and stack while the process is running + fixed paths in attach dialog with SystemRoot enviroment string + fixed handling of "call * ptr []" and "jmp * ptr []" + fixed some handle and memory leaks + added saving of input in goto dialog + added support of functions in goto dialog + added different hotkeys see hotkey list for all of them + added type column in attach dialog + added state update when doing a trace + added trace to selected disassembly line + added toggle breakpoint on selected disassembly line to context menu + added display of FPU, MMX and SSE register + updated to qt 4.8.5 + updated nasm to 2.10.09 + updated file open dialog to remove annoying messagebox for commandline + updated the internal pe handling + updated resize event of Disassembler and Stack + updated Stack scroll + updated PID dropdown to be only displayed if more then 1 process is running + updated disassembler logic ####Notes: - function in the goto dialog should look like this: "module::function" e.g KERNEL32::IsDebuggerPresent
Jaa Ранг: 134.1 (ветеран), 246thx Активность: 0.22↘0.1 Статус: Участник realist	Создано: 16 сентября 2013 01:24 · Личное сообщение · #14 update Version 0.1 beta 15 Code: + fixed a bug which lead to a memory leak when a invalid file was loaded + fixed a bug which caused a break when continue was used after a trace + fixed a bug which caused problems when scrolling up in disassembler view + fixed a bug which returned wrong offset when adding a breakpoint to a wow64 process + fixed a bug which did not clean up properly if using the "recent file" menu to debug new process + fixed a bug which did not clean up properly if a process terminates in a multiprocess session + fixed a bug which did not replace memory breakpoints correctly + fixed a bug which did not display the correct source code under certain conditions + fixed a bug which did not reload the gui when deleting a patch from patchmanager using hotkey + fixed a bug which did not disable trace_stop button when the debuggee terminates while tracing + fixed a bug which did not allow breakpoints on int3 instructions + fixed a bug which may corrupted the memory breakpoints when a new thread starts + fixed a bug which may calculated wrong tls callback offsets + added save file dialog to memory dump and patch manager + added the correct offsets for loaded module imports in the peeditor + added double click handler in trace view, bp manager and patch manager to send a offset to disassembler window + added possibility to set nanomite also as wow64 jit debugger + added possibility to use Up/Down arrows and PageUp/Down to navigate in disassembler + added possibility to create a full process dump + added possibility to open function view for selected modules + added possibility to restart debugger with admin rights + added support for saving patches in dlls + added support of multiple tls callbacks + added "on execution" and "on write" memory breakpoint types + updated function view algorithm + updated winapi messagebox to qt ####Notes: - The full process dump can be done in detail view -> process tab -> context menu - The function view can now be showed also in detail view -> modules tab -> context menu --> Link <--
Veliant Ранг: 301.4 (мудрец), 194thx Активность: 0.17↘0.01 Статус: Участник	Создано: 16 сентября 2013 09:30 · Поправил: Veliant · Личное сообщение · #15 Потестил, довольно неплохо. Из замечаний: -повесить бы переход по адресу на Ctrl+G т.к. лезть через контекстное меню по ПКМ далеко -в этом самом диалоге перехода по адресу неправильно работает подсказка ввода -добавить бы в контекстное меню установку HW бряков
Rio Ранг: 95.5 (постоянный), 36thx Активность: 0.08↘0.04 Статус: Участник	Создано: 16 сентября 2013 12:29 · Личное сообщение · #16 Может немного не в тему, но кто что может посоветовать для отладки x64 pe (кроме обсуждаемого)
Jaa Ранг: 134.1 (ветеран), 246thx Активность: 0.22↘0.1 Статус: Участник realist	Создано: 16 сентября 2013 12:51 · Поправил: Jaa · Личное сообщение · #17 Rio IDA Pro, x64_dbg, bugdbg
Dart Raiden Ранг: 81.6 (постоянный), 102thx Активность: 0.06↘0.02 Статус: Участник	Создано: 31 октября 2013 01:26 · Личное сообщение · #18 beta 16 - fixed a bug which can lead to a crash of the debugge when using step over while debugge was running - fixed a bug which can lead to a crash while using step over - fixed a bug which can lead to a crash when using more than one memory breakpoint - fixed a bug which can lead to a missing display of disassembly when breaking on a onexecute memory bp - fixed a bug which lead to a lost commandline when restarting as admin - fixed a bug which did not clean up correctly if restarting the file over the recent debugged file menu - added space shortcut in disassembly view to edit instruction - added error message if x86 build wants to load x64 binarys - added entropy check to display a warning if a (may) packed or crypted file will be started - added support for different breakpoint sizes - added resolving of drag n dropped .lnk files - added bookmarks - added comments - added HLT and UD2 software breakpoint types - added project files - added different performance improvements - updated dbghelp to version 6.3.9600 Notes: Code: - Supported breakpoint sizes are 1,2 and 4 bytes for software and hardware breakpoints - In the breakpoint manager you can now choose between int3, hlt and ud2 software breakpoints int3 = 0xCC hlt = 0xF4 ud2 = 0x0F0B - Project files allow to save and load bookmarks, comments, patches and breakpoints of the current project
Dart Raiden Ранг: 81.6 (постоянный), 102thx Активность: 0.06↘0.02 Статус: Участник	Создано: 01 января 2014 04:58 · Личное сообщение · #19 beta 17 - fixed a bug in the internal exception handler which could cause a termination on windows 8.1 - fixed a bug which made patching jumps impossible - added option for "DebugSetProcessKillOnExit" - added option to load symbols from ms servers - added execute to selected line - added possibility to toggle eflags directly from context menu in the register view - improved internal PE file handling - improved copy to clipboard context menu Notes: - You can now copy multi lines to the clipboard using the context menu

Для печати