Uncategorized

Windbg updated

Windbg, Microsoft’s Windows system debugger, has been released with new features, one of which is ability to write debugger scripts in JavaScript.

(WordPress renders the MSDN blog URL strangely, if you can’t click on that, click on the URL in Alex’s twtter.)

 

New Insider SDK and JavaScript Extensibility!

Standard
Uncategorized

Voltron integration for Binary Ninja

https://github.com/snare/binjatron
https://github.com/snare/voltron
http://ho.ax/

Binary Ninja plugin for Voltron integration.

Features:
* Synchronise the selected instruction in Binary Ninja with the instruction pointer in the debugger
* Mark breakpoints that are set in the debugger in Binary Ninja
* Set and delete breakpoints in the debugger from Binary Ninja

https://firmwaresecurity.com/2016/04/09/voltron/

https://firmwaresecurity.com/2016/06/05/binary-ninja/

 

Standard
Uncategorized

Microsoft removes Firewire from kernel debugger

The Windows kernel debugger needs to operate even when some device drivers fail, and for other reasons, the debugger can’t use the normal Windows drivers for remoting the debugger over serial, network, USB, Firewire (1394), so the debugger needs to write it’s own driver and do other hacks to remote itself. In the beginning, serial was the only requirement, but later faster cables were needed, like USB and 1394.

Well, it looks like Firewire is fading away, Microsoft has removed 1394 support from the mainstream release of the kernel debugger, only keeping it in the WDK build. Also, AFAIK, this is the first time the Windows debugger is being built separately like this.

KD 1394 Work-Around

 

Standard
Uncategorized

Microsoft MEX Windbg extension

Microsoft recently released a new Windows Windbg debugger extension called MEX. It has a variety of features, dozens of commands for many of Microsoft’s products. It appears to have been removed from the download site for a while, but it is up now, at least for the moment.

 

There’s a copy of the MEX help usage listed here:
https://github.com/REhints/WinDbg/tree/master/MEX

 

Standard
Uncategorized

MWR Labs’ Windbg python plugin

MWR Labs has a new blog post on using Python with Windbg, the Microsoft Windows system debugger.

https://labs.mwrinfosecurity.com/blog/heap-tracing-with-windbg-and-python/

https://github.com/sam-b/windbg-plugins
https://labs.mwrinfosecurity.com/

(I wish Microsoft would properly integrate Python to Windbg, instead of requiring third parties to do so.)

Standard
Uncategorized

Voltron

If you have not looked at Voltron, by Jim Fear, please check it out, it is quite powerful:

Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers (LLDB, GDB, VDB and WinDbg) by enabling the attachment of utility views that can retrieve and display data from the debugger host. By running these views in other TTYs, you can build a customised debugger user interface to suit your needs. Voltron does not aim to be everything to everyone. It’s not a wholesale replacement for your debugger’s CLI. Rather, it aims to complement your existing setup and allow you to extend your CLI debugger as much or as little as you like. If you just want a view of the register contents in a window alongside your debugger, you can do that. If you want to go all out and have something that looks more like OllyDbg, you can do that too.

https://github.com/snare/voltron

 

Standard
Uncategorized

RET-Sync: multi-debugger tool for IDA Dissassembler

ret-sync stands for Reverse-Engineering Tools synchronization. It’s a set of plugins that help to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA disassembler. The underlying idea is simple: take the best from both worlds (static and dynamic analysis).

From debuggers and dynamic analysis we got:

    local view, with live dynamic context (registers, memory, etc.)
    built-in specialized features/API (ex: Windbg’s !peb, !drvobj, !address, etc.)

From IDA and static analysis we got:

    macro view over modules
    code analysis, signatures, types, etc.
    fancy graph view
    persistent storage of knowledge within IDBs

Keys features:

    Pass data (comment, command output) from debugger to disassembler (IDA)
    Multiple IDBs can be synced at the same time allowing to easily trace through multiple modules
    No need to deal with ALSR, addresses are rebased on-the-fly
    IDBs and debugger can be on different hosts

ret-sync is a fork of qb-sync that I developed and maintained during my stay at Quarkslab.

https://github.com/bootleg/ret-sync
https://github.com/quarkslab/qb-sync

Standard