Hacker News new | ask | show | jobs
by Meai 4342 days ago
That looks awesome, is there something like this for linux as well? Or what is the current way linux programmers debug x86?
4 comments

There's generally very little call for binary-level debuggers in linux. So everything is oriented towards source-level debuggng. Which makes sense since normally source code is available.

IMO gdb isn't very good for binary-level debugging, which is pretty much a euphemism for reverse-engineering anyway. It'd be nice to have something like that. I tinkered around with building such a thing years ago[0] but I wanted it to be cross-platform (I was using PPC at the time). But found libdisasm to be a bit limited as a disassembler suitable for such a thing.

[0]. http://www.scaramanga.co.uk/stuff/debugger/l33t-debugger.png

> So everything is oriented towards source-level debuggng. Which makes sense since normally source code is available.

Maybe it's just the way I use debuggers, but I don't find this to be a particularly compelling reason; I use instruction-level debugging quite often even when I have the source (debugging a program I wrote, when simpler methods fail), to [1] verify that the high-level language statements are doing the expected, [2] ensure that the compiler is generating the expected instructions, and [3] to observe where exactly the bug is.

> IMO gdb isn't very good for binary-level debugging

Having come from a Windows background, I'd say using gdb for that is an absolute nightmare - it appears to almost be designed to actively make it harder to do instruction-level debugging, despite the fact that the implementation of a debugger for source code is far more complex than one that doesn't. E.g. the "disassemble" command absolutely requires a symbol table, and will still complain if there's no "function" at some address, when all it really needs to do is start reading the bytes at the address it's given as a parameter - which could be the name of a symbol - and interpret them as instructions. Instead the somewhat unintuitive "workaround" is to use "x/i".

You don't always have the code, check out edb here: http://codef00.com/projects#debugger or here https://code.google.com/p/edb-debugger/
Check out radare2 (http://radare.org/), which is one of the best tools for binary reversing available on Linux.
radare2 is incredibly powerful but is a nightmare when it comes to usability though.
IDA Pro is available on Linux, but I think you were looking for a free option. Although the shareware version of IDA Pro works very well under WINE (the shareware version is an old release that is missing some features and is before they added Linux support)
IDA Pro running on Windows can connect to GDB server running on Linux, even to embedded platforms like ARM/MIPS.
Linux standard debugger is gdb.
You can use GDB on Windows too - MinGW have Windows versions of the usual set of tools(gcc, gdb, objdump, grep, etc.).

I highly recommend MinGW if you do any serious work on a Windows machine.

Perhaps worth noting that there is a difference between MinGW [1] and MinGW-w64 [2] - namely, the latter supports building 64-bit applications. In combination with msys2 [3], its pacman port [4], and mingw-builds [5] the toolchain has become very easy to install, and quite pleasant to use.

I had previously commented [6] on stability issues using mingw-w64. After some snooping using vmmap, Dependency Walker, and PE Explorer, I found that disabling the Windows Superfetch service dropped memory usage significantly. It turns out that this has been observed by cygwin devs [7]. I also disabled the Program Compatibility assistant, and my system now stays stable even after rebuilding LLVM and OpenBLAS multiple times.

[1] http://www.mingw.org/ [2] http://mingw-w64.sourceforge.net/ [3] http://msys2.github.io/ [4] http://sourceforge.net/p/msys2/wiki/MSYS2%20installation/ [5] http://sourceforge.net/projects/mingwbuilds/ [6] https://news.ycombinator.com/item?id=7740930 [7] https://cygwin.com/ml/cygwin/2011-12/msg00058.html

why not visual studio?
Two reasons:

1. Visual Studio is not free. Yes there is Visual C++ express but for a while it didn't have C99 support because in general it was only a C++ compiler. I believe C99 support was added with VS2013.

2. It's just really nice to use the same compiler on Linux, BSD and Windows. This is possible with GCC and LLVM but not Visual C++.

Microsoft tools are not bad (in fact I like SQL server over MySQL or Postgres) but because they aren't cross platform it's very difficult to adopt. them.

Unless they've recently and very quietly changed their policy, the Express versions also don't support plugins.
Since this is an article about an open source debugger, it's probably because Visual Studio is not free (except express), Free, or Open Source.
Can you recommend a good way to get GUI for gdb on Linux? I played a bit with xgdb, but it was very primitive in my experience. Thank you.
GDB or LLDB?