5

I've read some info here but looks like the site concerned itself only with vmware and moreover it has abandoned the idea. How can this concept be used with existing debugging environments like IDA and gdb.If it has already been implemented, I would like links about the same.

Improve this question
5
  • 2
    The link you have provided clearly explains what replay debugging is. Please clarify your question?
    – PSS
    Commented Jul 18, 2013 at 3:28
  • I want to know how it can be used as an aid in debugging. For example can it be integrated in existing debugging environment and to what benefit? If it was such popular idea then why the site dropped it ?can we ,for example make replay files and then share it with fellow analysts?
    – viv
    Commented Jul 18, 2013 at 3:33
  • The site provided a lot of info. The reason I asked it here was to create new knowledge. Moreover, the product is merely for vmware. What about integration with gdb and ida and how.Information from a single source cannot help me progress further.
    – viv
    Commented Jul 18, 2013 at 3:54
  • 1
    Great questions! You should edit your original question to include all that. Otherwise, it sounds to broad. Plus, you answered the original question with your link.
    – PSS
    Commented Jul 18, 2013 at 4:16
  • GDB includes a form of this since version 7 and allows also "reverse debugging". VMware on the other hand has abandoned it (despite complaints) with the move from version 7.x to 8.x. I'm not aware that IDA has such capabilities built-in. Perhaps with the GDB stub it could work?
    – 0xC0000022L ♦
    Commented Jul 18, 2013 at 13:47

2 Answers 2

Reset to default
2

Please excuse the shameless plug, but do check out UndoDB - http://undo-software.com/

It's functionally pretty similar to gdb 7's reversible debugging, but with radically improved performance. Recording slow-down is typically in the 2x-5x range, with memory usage typically around 10MB per second of recording.

Improve this answer
2

Mozilla rr

In addition to the closed source Undo mentioned at https://reverseengineering.stackexchange.com/a/2503/12321 , we now also have an amazing open source working implementation: https://github.com/mozilla/rr

I have given a minimal runnable example of it at: https://stackoverflow.com/questions/1206872/how-to-go-to-the-previous-line-in-gdb/46996380#46996380

As seen in that example, you first record, and then replay, and the replay makes every non-deterministic event (e.g. thread switch timings, random number generation) deterministic to match the previous run.

One huge advantage of that is that it allows you to step back in time, which is extremely often what you want to do when debugging applications, to go from crash back to the real cause that happened in the past.

QEMU reverse debugging

Besides the userland reverse debugging which uses hardware and Linux kernel features, simulators can also implement a reverse debugging of course since they control everything.

In particular, QEMU has had a reverse debugging mode which allows for this: It is not necessarily "replay based", but it achieves the same thing: you can step back in time. The cool thing about doing it in an emulator, is that you can also reverse step debug the Linux kernel itself if you are developing it on QEMU.

See also: https://stackoverflow.com/questions/29153178/is-it-possible-to-do-reverse-debugging-with-qemu/46499855#46499855

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.