Expand description
udbg
Cross-platform library for binary debugging and memory hacking written in Rust.
- 👍 Cross-platform: udbg wraps the details of different interfaces on different platform, and provides uniform interfaces
- 👍 Multiple-target: you can control multiple debug target in most cases
- 👍 Non-invasive: you can only view the information of target, instead of attaching to it
- 👍 Various target types: In addition to process, target can be a
minidump
, aPE file
, even be the OS-Kernel space with extra extension.
API Overview
There are two main kinds of interfaces in udbg, target information and debugging interfaces.
Interfaces of target information, which abstracted as the UDbgTarget
trait, represents an observable debugging target, it is an active process
in most cases, also it can be a minidump
, a PE file
, even be the OS-Kernel space with extra extension.
UDbgTarget
contains these functions, memory operation
(read/write/enumeration), module
enumeration, thread
enumeration, handle/FDs
enumeration, etc. Based on these functions, we can implement some utililties over the different types of target, such as module dump, memory search, hook scanning, malicious code scanning, etc.
Debugging interfaces, which abstracted as the UDbgEngine
trait, mainly provides the ability of process control. There is a default implementation
, typically it wraps the Debugging Functions on Windows, and wraps the ptrace interfaces on Linux.
Most of above interfaces were designed to be dynamic objects, which is for script-binding friendly, and udbg provides lua bindings
defaultly.
Current status of target information interfaces
Platform/Target | Memory operation | Memory List | Thread | Module/Symbol | Handle/FD List |
---|---|---|---|---|---|
Windows Process | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
Linux Process | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
MacOs Process | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
Minidump | ✔️ (readonly) | ✔️ | ✔️ | ✔️ | 🚧 |
PE File | ✔️ (readonly) | ✔️ | - | - | - |
Current status of debugging interfaces
Platform/Target | Debug Symbol | Breakpoint | Watchpoint(HWBP) | Multiple Target |
---|---|---|---|---|
Windows(x86/x64) | ✔️ (pdb) | ✔️ | ✔️ | ✔️ |
Windows(aarch64) | ✔️ (pdb) | ✔️ | ✔️ | ✔️ |
Linux(x86_64) | ✔️ (elf) | ✔️ | ✔️ | ✔️ |
Linux(aarch64) | ✔️ (elf) | ✔️ | ✔️ | ✔️ |
Examples
- Cross-platform interfaces to get target information, see
src/test.rs
fn target
- Write a basic debugger, see
src/test.rs
fn test_debug
Modules
- Breakpoint types
- Constants for current environment
- ELF file helper
- Error types for udbg and utilities for system error code
- Utilities for dealing debugger event
- Traits for memory read/write.
MiniDumpTarget
implementation- OS-specific functionality
- Utilities for accessing symbols in pdb file
- PE file helper &&
PETarget
implementation - Re-exports commonly used types for udbg
- Utilities for type which has range, such as module, memory page, etc.
- Traits and types for CPU registers
- High-level types for user interface
- Extra string convert utilities
- Utilities for dealing symbols implements by udbg which is platform independently
- Traits && types for debugger target, such as memory page, module, thread, process, etc., and their iterators.
- Fragmented utilities