0

Problem : How can I debug an ELF file in MS Windows? is it possible?

Scenario :

I have an ELF file compiled to work on hardware with VXWorks 5.5 OS and SH4 CPU. IDA68 is able to disassemble the file and correctly detects SH4 instructions although looks like IDA is unable to debug it with its debugger(the debugger icon is grey), and without the ability to debug the assembly it is almost impossible to understand.

Am I missing something here?

1

You cannot run ELF files on Windows because the system offers a completely different architecture and API for programs to use. For example, the system calls in windows are different from the system calls in Linux (those which your elf will try to call). Also, if Windows could understand and try to load the ELF, your file will try to link to system libraries which do not exist under windows (.so files instead of windows dlls).

Another reason that the files will not run under windows is that the binary format is different and Windows will not be able to understand how to run the ELF file.

There are ways in which you can run Linux software under windows but they require emulation (Virtual machines, Bash on Ubuntu on Windows etc.)

  • I already know that I can not run ELF files under Windows. I am looking forward to trace/debug it using IDA and since the vxworks is an open system which is used in embeded systems, it is far from mind if it has something other than POSIX compatible that windows can not resolve, I expect IDA to interpret the interupts and other exceptions to windows however a register watch is enough I believe! – Iman Mar 2 '17 at 22:28
  • The only way to trace or debug the program is to run it. The options suggested above may be what you're looking for (using remote connection to a debug server). – lightnet Mar 3 '17 at 8:15
  • I am writing down registers on a paper and update each manually by running instructions one by one in my mind. Do I have a vxworks in my mind? Ofcourse not! I just need a register watch which is what tracing mean in embeded systems I guess. – Iman Mar 3 '17 at 13:29
  • I think Bash on Windows run real Linux executables with Windows Subsystem for Linux. Another way can be decompiling with IDA and compiling with Subsystem for UNIX-based Applications (only server-class) in Windows again. It seem impossible, it is not widely used BSD or Linux executable. – de6f Mar 15 '17 at 15:52
1

ELF files can be debugged using IDA debugger if you have the same CPU and OS that were used to build them, installed locally or have them in a remote machine.

In case you don't, you're still able to debug the file but only if the compiler have debugging data in DWARF standard included in the file.

Another option that SVS suggest me, is to set up an emulator with OS and Arctitecture you need trace the file over there which is a good practical way I believe.

Not all ELF files have DWARF debugging data. Particularly, those that are not suppose to be reverse engineered.

  • 1
    "if the debugger is grey it means the ELF file which is being disassembled does not contain debugging data in DWARF format" <- wrong – Igor Skochinsky Mar 4 '17 at 11:00
  • how debuggers work – julian Mar 15 '17 at 0:38
  • @IgorSkochinsky edited, but I still think grey means no DWARF in my case. do you know any other reason that makes it grey(please just in my case)? Cause I need to debug the file very bad! – Iman Mar 15 '17 at 13:23
  • The button is grey if there is no debugger module available for the specific file format/processor combination. Lack of DWARF info does not prevent debugging in IDA. – Igor Skochinsky Mar 15 '17 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.