├── IDBG
├── windbg-extension
│ ├── windbg-extension
│ │ ├── stdafx.h
│ │ ├── stdafx.cpp
│ │ ├── targetver.h
│ │ ├── windbg-extension.cpp
│ │ ├── windbg-extension.def
│ │ ├── windbg-extension.vcxproj.user
│ │ ├── idbg.h
│ │ ├── windbg-extension.vcxproj.filters
│ │ ├── idbg.cpp
│ │ └── windbg-extension.vcxproj
│ ├── Release
│ │ ├── windbg-extension.dll
│ │ ├── windbg-extension.exp
│ │ ├── windbg-extension.lib
│ │ ├── windbg-extension.pdb
│ │ ├── windbg-extension.iobj
│ │ └── windbg-extension.ipdb
│ └── windbg-extension.sln
└── idbg.py
└── README.md
/IDBG/windbg-extension/windbg-extension/stdafx.h:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/windbg-extension/stdafx.h
--------------------------------------------------------------------------------
/IDBG/windbg-extension/Release/windbg-extension.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/Release/windbg-extension.dll
--------------------------------------------------------------------------------
/IDBG/windbg-extension/Release/windbg-extension.exp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/Release/windbg-extension.exp
--------------------------------------------------------------------------------
/IDBG/windbg-extension/Release/windbg-extension.lib:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/Release/windbg-extension.lib
--------------------------------------------------------------------------------
/IDBG/windbg-extension/Release/windbg-extension.pdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/Release/windbg-extension.pdb
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension/stdafx.cpp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/windbg-extension/stdafx.cpp
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension/targetver.h:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/windbg-extension/targetver.h
--------------------------------------------------------------------------------
/IDBG/windbg-extension/Release/windbg-extension.iobj:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/Release/windbg-extension.iobj
--------------------------------------------------------------------------------
/IDBG/windbg-extension/Release/windbg-extension.ipdb:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/Release/windbg-extension.ipdb
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension/windbg-extension.cpp:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/almost-real/IDBG/HEAD/IDBG/windbg-extension/windbg-extension/windbg-extension.cpp
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension/windbg-extension.def:
--------------------------------------------------------------------------------
1 | LIBRARY
2 |
3 |
4 | EXPORTS
5 | unload_idbg
6 | sync_with
7 | WinDbgExtensionDllInit
8 | ExtensionApiVersion
9 |
10 |
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension/windbg-extension.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension/idbg.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 | #include "stdafx.h"
3 | #include
4 |
5 | /*
6 | note all of the functions in IDBG are base address independant
7 | for ex if you pass 0x5000 in addbp it will set a bp to module_base_address+0x5000
8 | */
9 | class IDBG
10 | {
11 | public:
12 | bool Init(PCSTR name_of_the_module);
13 | ~IDBG();
14 |
15 | bool GetEip(PCSTR name_of_the_register, DEBUG_VALUE *val);
16 | bool AddBreakPoint(ULONG64 address);
17 | bool RemoveBreakpoint(ULONG64 address);
18 |
19 |
20 | bool IsInUse();
21 | bool Is64BitProcess();
22 | bool Is32BitProcess();
23 |
24 |
25 | private:
26 | bool GetInterfaces();
27 | bool m_IsInUse = false;
28 |
29 | ULONG m_EIP_index = 0;
30 | ULONG64 m_baseaddr_of_module = 0;
31 | ULONG m_size_of_module = 0;
32 |
33 | IDebugControl4* gDebugControl4 = nullptr;
34 |
35 | IDebugSymbols* m_DebugSymbols = nullptr;
36 | IDebugControl* m_DebugControl = nullptr;
37 | IDebugRegisters* m_DebugRegisters = nullptr;
38 | IDebugClient* m_DebugClient = nullptr;
39 |
40 |
41 | std::vector m_Breakpoints;
42 | };
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio 15
4 | VisualStudioVersion = 15.0.27703.2026
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "windbg-extension", "windbg-extension\windbg-extension.vcxproj", "{D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|x64 = Debug|x64
11 | Debug|x86 = Debug|x86
12 | Release|x64 = Release|x64
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}.Debug|x64.ActiveCfg = Debug|x64
17 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}.Debug|x64.Build.0 = Debug|x64
18 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}.Debug|x86.ActiveCfg = Debug|Win32
19 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}.Debug|x86.Build.0 = Debug|Win32
20 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}.Release|x64.ActiveCfg = Release|x64
21 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}.Release|x64.Build.0 = Release|x64
22 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}.Release|x86.ActiveCfg = Release|Win32
23 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}.Release|x86.Build.0 = Release|Win32
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {68F2A909-3DDE-47E2-96DE-CED07227EF45}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | ## IDBG
2 | Allows to add breakpoints from IDA (from the graph/text view) to WinDbg easily.
3 |
4 | Since I found the debugger inside IDA confusing(probably because I couldn't use it properly) I decided to write a plugin that allowed me to add breakpoints from the IDA graph view to WinDbg.
5 |
6 | ## How to load:
7 | On IDA: File, Script File (or just ALT F7) then browse to idbg.py
8 | On WinDbg: !load path
9 | !sync_with module (module without the .dll at the end)
10 | ## How to unload:
11 | On WinDbg: !unload_idbg then !unload path
12 |
13 | On IDA:
14 | just click somewhere on the graph so OnViewCurpos gets called
15 | (path is the path of the WinDbg DLL extension)
16 |
17 |
18 | ## How to use:
19 | Load idbg on IDA and windbg-extension.dll on WinDbg then simply press the key j + left click wherever you want to add a breakpoint to add a breakpoint and doing the same will also remove it if there's already a breakpoint in that location.
20 | To change the key j to whatever key you want, you have to modify the parameter of the is_key_down function with the vkey code of the key you desire to use instead.
21 |
22 | Credits:
23 | https://github.com/geohot/qira/blob/master/ida/python/qira.py (took the hooks from there)
24 | dbgsdk samples from Microsoft and wdbgark https://github.com/swwwolf/wdbgark
25 |
26 | while using it I found a few bugs that I can't be bothered to fix at the moment since it's fine for me but I'll try to to fix them if it can be helpful for someone
27 |
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension/windbg-extension.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Header Files
20 |
21 |
22 | Header Files
23 |
24 |
25 | Header Files
26 |
27 |
28 |
29 |
30 | Source Files
31 |
32 |
33 | Source Files
34 |
35 |
36 | Source Files
37 |
38 |
39 |
40 |
41 | Source Files
42 |
43 |
44 |
--------------------------------------------------------------------------------
/IDBG/idbg.py:
--------------------------------------------------------------------------------
1 | import idaapi
2 | import time
3 | import mmap
4 | import struct
5 | import ctypes
6 |
7 | def WriteToBeginningOfMmap(shared_memory, bytes_to_write):
8 | shared_memory.seek(0)
9 | shared_memory.write(bytes_to_write)
10 |
11 |
12 | def is_key_down(v_key_code):
13 | return ctypes.windll.user32.GetAsyncKeyState(v_key_code) & 1<<31
14 |
15 |
16 | class MyIDAViewWrapper(idaapi.IDAViewWrapper):
17 | def __init__(self, viewName, bps_shared_mem):
18 | idaapi.IDAViewWrapper.__init__(self, viewName)
19 | self.bps_shared_memory = bps_shared_mem
20 | self.bp_list = []
21 | self.is_unloading = False
22 |
23 |
24 | def Unload(self):
25 | """self.is_unloading = True
26 | print("unloading... idbg")
27 | uk.unhook_and_unbind()
28 | WriteToBeginningOfMmap(self.bps_shared_memory, "\x00")
29 | self.bps_shared_memory.close()"""
30 |
31 |
32 | def OnViewCurpos(self):
33 | if(not(self.is_unloading) and self.bps_shared_memory[0] == 's'):
34 | self.Unload()
35 | return
36 |
37 | #change with whatever key you want to use see:https://docs.microsoft.com/en-us/windows/desktop/inputdev/virtual-key-codes
38 | if(is_key_down(0x4a)):
39 | #note: don't rebase if you have breakpoints that are already set (since bp_list won't be updated (todo)) (maybe could store them in base 0 so no need to rebase)
40 | self.HandleBp(idaapi.get_screen_ea()-idaapi.get_imagebase(), idaapi.get_screen_ea())
41 |
42 | def HandleBp(self, base0_addr, addr):
43 | if(addr in self.bp_list):
44 | self.RemoveBp(base0_addr, addr)
45 | else:
46 | self.AddBp(base0_addr, addr)
47 |
48 | def GetWindbgResponse(self, request_type):
49 | timeout = 0
50 | while(self.bps_shared_memory[0] == request_type and timeout < 10):
51 | time.sleep(0.05)
52 | timeout += 1
53 |
54 | if(self.bps_shared_memory[0] == 'f'):
55 | return False
56 | elif(self.bps_shared_memory[0] == 'c'):
57 | return True
58 |
59 | return False
60 |
61 |
62 | def AddBp(self, base0_addr, addr):
63 | if(is_key_down(0x4a) == 0):
64 | return
65 |
66 | WriteToBeginningOfMmap(self.bps_shared_memory, 'a' + struct.pack('Release(), (void)((_Unk) = NULL)) : (void)NULL)
7 |
8 | /*template void SafeRelease(T **ppT)
9 | {
10 | if (*ppT)
11 | {
12 | (*ppT)->Release();
13 | *ppT = NULL;
14 | }
15 | }*/
16 |
17 | bool IDBG::Is64BitProcess()
18 | {
19 | ULONG type;
20 | m_DebugControl->GetActualProcessorType(&type);
21 | return type == IMAGE_FILE_MACHINE_IA64;
22 | }
23 |
24 | bool IDBG::Is32BitProcess()
25 | {
26 | ULONG type;
27 | m_DebugControl->GetActualProcessorType(&type);
28 | return type == IMAGE_FILE_MACHINE_I386;
29 | }
30 |
31 | bool IDBG::IsInUse()
32 | {
33 | return m_IsInUse;
34 | }
35 |
36 | bool IDBG::GetInterfaces()
37 | {
38 | HRESULT hResult = S_FALSE;
39 | if (hResult = DebugCreate(__uuidof(IDebugClient), (void**)&m_DebugClient) != S_OK)
40 | {
41 | dprintf("Acuqiring IDebugClient* Failled\n\n");
42 | return false;
43 |
44 | }
45 |
46 | if (hResult = m_DebugClient->QueryInterface(__uuidof(IDebugControl), (void**)&m_DebugControl) != S_OK)
47 | {
48 |
49 | dprintf("Acuqiring IDebugControl* Failled\n\n");
50 | return false;
51 | }
52 |
53 | if (hResult = m_DebugClient->QueryInterface(__uuidof(IDebugRegisters), (void**)&m_DebugRegisters) != S_OK)
54 | {
55 |
56 | dprintf("Acuqiring IDebugRegisters* Failled\n\n");
57 | return false;
58 | }
59 |
60 | if (hResult = m_DebugClient->QueryInterface(__uuidof(IDebugSymbols), (void**)&m_DebugSymbols) != S_OK)
61 | {
62 | dprintf("Acuqiring IDebugSymbols* Failled\n\n");
63 | return false;
64 | }
65 |
66 | return true;
67 | }
68 |
69 | bool IDBG::AddBreakPoint(ULONG64 address_base0)
70 | {
71 | static int desiredid = 0;
72 |
73 | if (address_base0 > m_size_of_module)
74 | return false;
75 |
76 | ULONG64 address = address_base0 + m_baseaddr_of_module;
77 |
78 | IDebugBreakpoint *bp;
79 | if (m_DebugControl->AddBreakpoint(DEBUG_BREAKPOINT_CODE, desiredid, &bp) != S_OK) //c'est quoi DEBUG_BREAKPOINT_DATA??
80 | {
81 | dprintf("IDebugControl::AddBreakpoint failed %d ", GetLastError());
82 | return false;
83 | }
84 | bp->SetOffset(address);
85 | bp->SetFlags(DEBUG_BREAKPOINT_ENABLED);
86 | m_Breakpoints.push_back(bp);
87 |
88 | desiredid++;
89 | return true;
90 | }
91 |
92 | bool IDBG::RemoveBreakpoint(ULONG64 address_base0)
93 | {
94 | ULONG64 address = address_base0 + m_baseaddr_of_module;
95 |
96 | for (size_t i = 0; i < m_Breakpoints.size(); i++)
97 | {
98 | ULONG64 address_of_bp;
99 | m_Breakpoints[i]->GetOffset(&address_of_bp);
100 |
101 | if (address_of_bp == address)
102 | {
103 | if (m_DebugControl->RemoveBreakpoint(m_Breakpoints[i]) != S_OK)
104 | return false;
105 |
106 | m_Breakpoints.erase(m_Breakpoints.begin() + i);
107 | return true;
108 | }
109 | }
110 | return false;
111 | }
112 |
113 | /*
114 | Input:Takes in parameter the name of the module we are working with (passed as argument in !load )
115 | */
116 | bool IDBG::Init(PCSTR name_of_the_module)
117 | {
118 | if (!GetInterfaces())
119 | return false;
120 |
121 | ULONG index_of_module;
122 | if (m_DebugSymbols->GetModuleByModuleName(name_of_the_module, 0, &index_of_module, &m_baseaddr_of_module) != S_OK)
123 | return false;
124 |
125 | DEBUG_MODULE_PARAMETERS params;
126 | if (m_DebugSymbols->GetModuleParameters(1, NULL, index_of_module, ¶ms) != S_OK)
127 | return false;
128 |
129 | m_size_of_module = params.Size;
130 |
131 | m_IsInUse = true;
132 | return true;
133 | }
134 |
135 |
136 | bool IDBG::GetEip(PCSTR name_of_the_register, DEBUG_VALUE *val)
137 | {
138 | if (m_DebugRegisters->GetValue(m_EIP_index, val) == S_OK)
139 | {
140 | if (val->I32 >= m_baseaddr_of_module && val->I32 < m_baseaddr_of_module + m_size_of_module)
141 | {
142 | val->I32 -= m_baseaddr_of_module;
143 | return true;
144 | }
145 | }
146 | return false;
147 | }
148 |
149 | IDBG::~IDBG()
150 | {
151 | for (size_t i = 0; i < m_Breakpoints.size(); i++)
152 | {
153 | EXT_RELEASE(m_Breakpoints[i]);
154 | }
155 |
156 | EXT_RELEASE(m_DebugSymbols);
157 | EXT_RELEASE(m_DebugRegisters);
158 | EXT_RELEASE(m_DebugControl);
159 | EXT_RELEASE(m_DebugClient);
160 | }
161 |
162 |
163 |
164 |
165 |
--------------------------------------------------------------------------------
/IDBG/windbg-extension/windbg-extension/windbg-extension.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 15.0
23 | {D7E1ACD3-39C3-4FDC-8A9B-0429DD479D6E}
24 | Win32Proj
25 | windbgextension
26 | 10.0.17134.0
27 |
28 |
29 |
30 | DynamicLibrary
31 | true
32 | v141
33 | Unicode
34 |
35 |
36 | DynamicLibrary
37 | false
38 | v141
39 | true
40 | Unicode
41 |
42 |
43 | DynamicLibrary
44 | true
45 | v141
46 | Unicode
47 |
48 |
49 | DynamicLibrary
50 | false
51 | v141
52 | true
53 | Unicode
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 | true
75 |
76 |
77 | true
78 |
79 |
80 | false
81 |
82 |
83 | false
84 |
85 |
86 |
87 | Use
88 | Level3
89 | Disabled
90 | true
91 | WIN32;_DEBUG;WINDBGEXTENSION_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)
92 | true
93 |
94 |
95 | Windows
96 | true
97 | windbg-extension.def
98 |
99 |
100 |
101 |
102 | Use
103 | Level3
104 | Disabled
105 | true
106 | _DEBUG;WINDBGEXTENSION_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)
107 | true
108 |
109 |
110 | Windows
111 | true
112 | windbg-extension.def
113 |
114 |
115 |
116 |
117 | Use
118 | Level3
119 | MaxSpeed
120 | true
121 | true
122 | true
123 | WIN32;NDEBUG;WINDBGEXTENSION_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)
124 | true
125 |
126 |
127 | Windows
128 | true
129 | true
130 | true
131 | windbg-extension.def
132 |
133 |
134 |
135 |
136 | Use
137 | Level3
138 | MaxSpeed
139 | true
140 | true
141 | true
142 | NDEBUG;WINDBGEXTENSION_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)
143 | true
144 |
145 |
146 | Windows
147 | true
148 | true
149 | true
150 | windbg-extension.def
151 |
152 |
153 |
154 |
155 |
156 |
157 |
158 |
159 |
160 |
161 | Create
162 | Create
163 | Create
164 | Create
165 |
166 |
167 |
168 |
169 |
170 |
171 |
172 |
173 |
174 |
--------------------------------------------------------------------------------