Crate udbg

udbg

Cross-platform library for binary debugging and memory hacking written in Rust.

• 👍 Cross-platform: udbg wraps the details of different interfaces on different platform, and provides uniform interfaces
• 👍 Multiple-target: you can control multiple debug target in most cases
• 👍 Non-invasive: you can only view the information of target, instead of attaching to it
• 👍 Various target types: In addition to process, target can be a minidump, a PE file, even be the OS-Kernel space with extra extension.

API Overview

There are two main kinds of interfaces in udbg, target information and debugging interfaces.

Interfaces of target information, which abstracted as the UDbgTarget trait, represents an observable debugging target, it is an active process in most cases, also it can be a minidump, a PE file, even be the OS-Kernel space with extra extension.

UDbgTarget contains these functions, memory operation (read/write/enumeration), module enumeration, thread enumeration, handle/FDs enumeration, etc. Based on these functions, we can implement some utililties over the different types of target, such as module dump, memory search, hook scanning, malicious code scanning, etc.

Debugging interfaces, which abstracted as the UDbgEngine trait, mainly provides the ability of process control. There is a default implementation, typically it wraps the Debugging Functions on Windows, and wraps the ptrace interfaces on Linux.

Most of above interfaces were designed to be dynamic objects, which is for script-binding friendly, and udbg provides lua bindings defaultly.

Current status of target information interfaces

Platform/Target	Memory operation	Memory List	Thread	Module/Symbol	Handle/FD List
Windows Process	✔️	✔️	✔️	✔️	✔️
Linux Process	✔️	✔️	✔️	✔️	✔️
MacOs Process	✔️	✔️	✔️	✔️	✔️
Minidump	✔️ (readonly)	✔️	✔️	✔️	🚧
PE File	✔️ (readonly)	✔️	-	-	-

Current status of debugging interfaces

Platform/Target	Debug Symbol	Breakpoint	Watchpoint(HWBP)	Multiple Target
Windows(x86/x64)	✔️ (pdb)	✔️	✔️	✔️
Windows(aarch64)	✔️ (pdb)	✔️	✔️	✔️
Linux(x86_64)	✔️ (elf)	✔️	✔️	✔️
Linux(aarch64)	✔️ (elf)	✔️	✔️	✔️

Examples

• Cross-platform interfaces to get target information, see src/test.rs fn target
• Write a basic debugger, see src/test.rs fn test_debug

Modules

• breakpoint
  Breakpoint types
• consts
  Constants for current environment
• elf
  ELF file helper
• error
  Error types for udbg and utilities for system error code
• event
  Utilities for dealing debugger event
• memory
  Traits for memory read/write.
• minidump
  MiniDumpTarget implementation
• os
  OS-specific functionality
• pdbfile
  Utilities for accessing symbols in pdb file
• pe
  PE file helper && PETarget implementation
• prelude
  Re-exports commonly used types for udbg
• range
  Utilities for type which has range, such as module, memory page, etc.
• register
  Traits and types for CPU registers
• shell
  High-level types for user interface
• string
  Extra string convert utilities
• symbol
  Utilities for dealing symbols implements by udbg which is platform independently
• target
  Traits && types for debugger target, such as memory page, module, thread, process, etc., and their iterators.
• util
  Fragmented utilities