Using Frida for Windows Reverse Engineering | Hacker News Reader

Using Frida for Windows Reverse Engineering

darungrim.com

67 pointstodsacerdoti11 comments

They mentioned WinDbg and OllyDbg but both are quirks of the past (except WinDbg usage for kernel debugging), and there's a better tool for this - x32dbg/x64dbg[1]. It's open-source, unlike WinDbg and actively developed, unlike OllyDbg. Moreover, recently we worked a lot on improving Windows support in radare2 [2] and Cutter[3]. Most of our fixes should land in the upcoming 4.5.0[4] release. This summer one of our GSoC students works on improving reversible debugging [5] feature as well. And of course, both integrated with Frida as well - see r2frida plugin[6].

[1] https://x64dbg.com/

[2] https://github.com/radareorg/radare2

[3] https://github.com/radareorg/cutter

[4] https://github.com/radareorg/radare2/milestone/51

[5] https://www.radare.org/gsoc/2020/ideas.html#title_10

[6] https://github.com/nowsecure/r2frida

Microsoft has recently modernized WinDbg[1]. Sadly, it's available only via the Microsoft Store[2].

[1] - https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

[2] - https://www.microsoft.com/en-us/p/windbg-preview/9pgjgd53tn8...

My reaction upon seeing that can be summed up in two words: WTF!?, yuck!

Even the latest version of Visual Studio, their flagship IDE, doesn't have that stupid ribbon UI, because they know their developers absolutely abhor it. To see it in WinDbg, whose userbase is even more traditional and "hardcore", is extremely shocking. With that ridiculous full-screen File menu (or page?), it looks like a part of Microsoft Office!

The vast majority of the interaction with the new windbg is using the same commands in the same tiling inner windows as before. The ribbon is usually hidden if you know the key commands to move around. It's only to help new and infrequent users find their way around.

It's only to help new and infrequent users find their way around.

Visual Studio is what most Windows developers use, including beginners, and it doesn't need --- or want --- a ribbon. It also doesn't have a full-screen File "menu", which is a repulsive visual assault and one of the other abominations that came from recent versions of Office.

The UI isn't even the worse of it. Old WinDbg was a pretty portable thing that you could just copy onto a machine wherever you wanted to debug something. New WinDbg is...

https://lifeinhex.com/running-windbgx-on-windows-7/

...no. Just... no.

(Yes, keep on downvoting me if you want, I don't care. I've had enough of this idiotic 'modern' shit creeping into everything.)

It is actually possible to download it if you have the URL without going through the store; see this thread:

https://twitter.com/M_Cedervall/status/1228338401876807682

I suspect a more formal solution will be available soon, but for now, there's this feedback post at GitHub where you can add your vote for supporting it:

https://github.com/microsoftfeedback/WinDbg-Feedback/issues/...

As the other poster noted, WinDbg is actually being actively developed. In fact, it even supports JavaScript.

https://github.com/Microsoft/WinDbg-Samples https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

As for suitability with userland debugging; I use the WinDbg Preview version almost every day to debug userland programs. I rarely use it for kernel/driver debugging.

Quite frankly I was surprised how easy it was to pickup given that I was mostly used to Solaris' mdb and the ubiquitous gdb on other *nixes.

Thanks for all the work on radare, xvilka! I've been using it for a few years at this point and I never thought it would be as good as it is today. I don't even bother with pirating IDA anymore.

> They mentioned WinDbg and OllyDbg but both are quirks of the past (except WinDbg usage for kernel debugging), and there's a better tool for this - x32dbg/x64dbg[1].

There is also Immunity Debugger which is kind of the successor of OllyDbg. It's got some popularity in malware analysis and exploit development circles. ImmDgb is actively developed and freely available but is not open source.

Can it read windows symbol files (pdb)? I understood they are complex and undocumented.

Yes, it can. We have our own parser [1]. It will be improved even more this summer.

[1] https://github.com/radareorg/radare2/tree/master/libr/bin/pd...

Reply on news.ycombinator.com