4

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a free version of IDA and anything that comes with Kali Linux. It is an ELF file that is stripped.

3

Perhaps you should try DDD. It's a GUI for GDB with lots of great features that simplify debugging for beginners & experts too. I have to warn you though, if your binary is stripped what matters most is the methodology. Most debuggers are extremely efficient if debug symbols are present (in case of an ELF, the DWARF is what you need to check). Without debug symbols all you can do is go through the code step by step, setting breakpoints at locations where the assembly code seems to be interesting.

You must know that reverse engineering is a challenge, not an easy task, and that there's no such thing as a magic tool. All the tools rely on algorithm which are not, unfortunately, flawless. Disassemblers can fail, decompilers can stumble upon patterns they can't turn into high-level code, and so on and so forth.

You have to develop a methodology which you'll have to adapt with experience. That's how you'll be able to forge good reversing skills. Meanwhile, the forum is open for questions, hopefully as precise & concise as the answers.

  • Thanks. This is a project our digital forensics teacher gave us and he obfuscated everything so the decompiling didn't help me. Is there anyway we could communicate so I could pitch you ideas etc besides stackexchange? I am looking for a mentor/guide for this project I do not need or want someone to give me answers I just want someone who I could bounce ideas off of. williamDOTkochATusmaDOTedu or could you point me to a good forum or google group or something where I could get help? – will Apr 29 '14 at 21:33
  • There's a chat on stackexchange but you need at least 20 reps to join ! – yaspr Apr 29 '14 at 21:41
  • want to vote up some of my stuff so I can get reputation points. I got banned from asking stackoverflow questions and I only asked 3 or 4 and even after fixing up my posts I was still blocked! – will Apr 29 '14 at 21:43
  • Well, there are rules & some people are tight ! I sent you an email. – yaspr Apr 29 '14 at 21:44
  • You can also try out radare.org Its a full reverse engineering suite equipped with a debugger, and its open source. – gandolf Aug 1 '14 at 4:56
2

gdb has a

text user interface 

can be activated with layout command in a running instance of gdb or with --tui command line switch while starting

will show registers and assembly

this would be the most cheapest option i guess:)

the following commands should provide an over view tui layout split ; layout regs ; layout asm ; layout src ;layout next; layout prev;

apart from the already mentioned DDD EDB with Qt framework can be checked out EDB (EVANS Debugger)

2

PEDA is a gdb plugin that can display the current process status:

  • stack content
  • register content
  • instructions near the program counter

The output is pretty and colored.

peda session screenshot

There are loads of other features such as finding ROP gadget, showing elf headers, showing the enabled mitigations (ASLR, DEP, RELRO, ...)

1

cgdb is a curses based gdb interface that may be worth looking at:

https://cgdb.github.io/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.