Comparison of Mainstream Debugging Tools
GDB (GNU Debugger)
Features:
- Open-source and cross-platform (Linux/macOS/Windows WSL)
- Supports multiple architectures (x86/ARM/RISC-V)
- Command-line interactive debugging
Launch Methods:
# Debug an executable file
gdb ./program
# Debug a program with debug symbols
gdb -q ./program_with_debug_info
# Attach to a running process
gdb -p <PID>
x64dbg (Windows Only)
Features:
- Graphical user interface
- Designed specifically for x86/x64 architecture
- Supports plugin extensions
Typical Use Cases:
- Windows reverse engineering
- Dynamic analysis of DLLs
- API breakpoint debugging
IDA Free (Interactive Disassembler)
Features:
- Powerful disassembly capabilities
- Basic debugging functionality
- Cross-reference analysis
Limitations:
- Free version supports only 32-bit executables
- Debugging features are relatively basic
Breakpoint Techniques
Breakpoint Type Comparison
| Type | Implementation Principle | Speed | Limitations | Applicable Scenarios |
|---|---|---|---|---|
| Software Breakpoint | Replaces instruction with INT3 (0xCC) | Slower (requires memory modification) | Typically limited to hundreds (e.g., ~BP_NUM) | General-purpose debugging |
| Hardware Breakpoint | Uses CPU debug registers (DR0–DR7) | Fast (no memory modification needed) | Usually limited to 4 (CPU-dependent) | Monitoring specific memory accesses |
GDB Breakpoint Commands
Software Breakpoints:
# Set breakpoint at function entry
break main
# Set breakpoint at specific address
break *0x4005a0
# Set conditional breakpoint
break *0x4005a0 if eax == 0x10
Hardware Breakpoints:
# Set hardware execution breakpoint
hbreak *0x4005a0
# Set hardware write watchpoint (monitor memory writes)
watch -l *(int*)0x601028
# Set hardware read watchpoint
rwatch -l *(int*)0x601028
x64dbg Breakpoint Operations
- Setting Breakpoints: Click to the left of a line number in the graphical interface.
- Breakpoint Configuration (Right-click):
- Conditional expressions (e.g.,
eax==5) - Hit count limits
- Conditional expressions (e.g.,
- Special Breakpoint Types:
- Memory access breakpoints
- Hardware breakpoints
- Exception breakpoints
Single-Step Execution Control
GDB Single-Step Commands
Instruction-Level Stepping:
# Execute next machine instruction (step into function calls)
stepi
# Execute next machine instruction (step over function calls)
nexti
# Continue until current function returns
finish
# Continue execution until specified address
advance *0x4005b0
Source Code-Level Stepping:
# Execute next source line (step into functions)
step
# Execute next source line (step over functions)
next
# Continue until current function returns
finish
x64dbg Single-Step Operations
- F7: Step Into (equivalent to
stepi) - F8: Step Over (equivalent to
nexti) - F9: Continue
- Shift+F9: Run until return
Register Monitoring
GDB Register Inspection
Basic Inspection:
# View all general-purpose registers
info registers
# View specific register
info registers eax
info registers rip
# View floating-point registers
info registers fpu
# View all registers (including flags)
info all-registers
Hexadecimal Display:
# Display register value in hex
p/x $eax
# Show register value and corresponding assembly instruction
x/i $pc
Register Modification:
# Modify register value
set $eax = 0x1234
# Modify memory (may affect register state in subsequent instructions)
set {int}0x601028 = 42
Memory Inspection Techniques
GDB Memory Viewing
Basic Viewing Commands:
# View memory content (hex + ASCII)
x/20xb 0x601028 # 20 hex bytes + ASCII
# View in different formats
x/10wd 0x601028 # 10 words (4-byte) in decimal
x/8xg 0x601028 # 8 quadwords (8-byte) in hex
# View memory mappings
info proc mappings
Advanced Memory Inspection:
# Inspect stack memory
x/20xw $rsp
# Inspect code segment
x/10i $rip
# Monitor memory changes (watchpoints)
watch *(int*)0x601028
Memory Dump and Analysis
# Dump memory to file
dump memory mem.dump 0x601028 0x601050
# Load core dump file
gdb ./program core.1234
Comprehensive Debugging Example
Full Debugging Workflow for Assembly Programs
- Compile Program with Debug Symbols:
nasm -f elf64 -g program.asm -o program.o ld -o program program.o - Launch GDB:
gdb ./program - Set Breakpoints:
(gdb) break _start (gdb) break *0x4000f0 (gdb) watch -l *(int*)0x601028 - Run Program:
(gdb) run - Single-Step Debugging:
(gdb) stepi # Execute next instruction
(gdb) info registers # Check register states
(gdb) x/10xb $rsp # Inspect stack memory
- Modify Execution Flow:
(gdb) set $rip = 0x4000f5 # Modify instruction pointer
(gdb) jump *0x4000f5 # Jump to specified address
Handling Common Debugging Scenarios
Scenario 1: Crash Analysis
# View register state at crash
info registers
# Inspect code near crash address
x/10i $rip
# View call stack
bt
# Check memory access permissions
info proc mappings
Scenario 2: Algorithm Debugging
# Set breakpoint at loop start
break *0x4005a0
# Set conditional breakpoint (trigger when i == 5)
break *0x4005a0 if ecx == 5
# View array contents
x/10wd array_base
Scenario 3: Function Call Analysis
# Set breakpoint at function entry
break function_name
# View passed arguments
info args
# Step into function
stepi
# View local variables
info locals
Advanced Debugging Techniques
Reverse Debugging
# Record execution trace (requires rr tool)
rr record ./program
# Replay in reverse
rr replay
(gdb) reverse-stepi
(gdb) reverse-continue
Multi-threaded Debugging
# List all threads
info threads
# Switch to thread 2
thread 2
# Set thread-specific breakpoint
break file.c:123 thread 2
Remote Debugging
# On target machine: start gdbserver
gdbserver :1234 ./program
# On host machine: connect
gdb
(gdb) target remote target_ip:1234
By mastering these debugging techniques, you can efficiently locate and resolve various issues in assembly programs, including:
- Logical error analysis
- Memory access problems
- Performance bottleneck identification
- Crash root cause diagnosis
- Algorithm execution verification
