Awesome GitHub RepositoriesLow-Level Debuggers

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

Ish is a Linux shell emulator for iOS that provides a local terminal environment for running shell commands and managing files. It functions as an instruction-level emulator that enables the execution of Linux binaries on mobile devices by simulating an Alpine Linux environment. The project distinguishes itself by combining user-mode Linux emulation with a virtual root filesystem. This allows the software to map Linux kernel system calls to host functions and execute scripts and toolsets directly on an iPhone or iPad. The emulator also provides low-level program debugging capabilities, inclu

rr is a deterministic record and replay framework and reverse debugger for Linux processes. It provides a deterministic execution environment that captures program execution, allowing bugs and crashes to be reproduced exactly through replay. The tool enables reverse program execution, allowing a developer to move the program counter backward through recorded history to trace a bug from its effect back to its source. It utilizes a recording mechanism that ensures a process run can be replayed with identical memory and register states. The framework covers low-level software analysis and nativ

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

Unicorn is a multi-architecture CPU emulation framework and library that utilizes just-in-time compilation to execute instructions across various processor architectures, including ARM, x86, and RISC-V. It functions as both a JIT compilation engine and an instrumentation tool, allowing for the execution of machine code without the need for physical hardware. The framework is distinguished by its hook-based execution instrumentation, which enables the interception of specific instructions and memory accesses to trigger custom callback functions. It provides a language-agnostic binding layer an

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

Blink is a JIT-based instruction emulator and x86-64 Linux emulator designed to run Linux binaries and ELF files across different host operating systems and architectures. It functions as a binary execution sandbox and system call simulator, providing a controlled environment for running programs. The project distinguishes itself with a terminal user interface for monitoring execution, managing breakpoints, and visualizing JIT compilation paths. It supports self-modifying code through a cache-invalidating memory model and provides execution environment isolation using restricted directory ove

mGBA is a high-accuracy Game Boy Advance emulator and hardware-level debugger designed to run handheld console ROMs on modern computers. It serves as a scriptable emulation environment that allows for the execution of portable hardware software and the simulation of associated peripherals. The project distinguishes itself through its focus on technical analysis, providing a suite of tools for retro game debugging and game logic inspection. It includes a host-client debug protocol that enables external debugger connectivity via TCP socket communication and an event-driven scripting engine for

palera1n is an iOS jailbreak tool that exploits a permanent hardware vulnerability in the bootrom of A8 through A11 Apple devices running iOS 15.0 or later, granting root access for system customization and third-party software installation. The tool also extends this jailbreak technique to Apple T2-equipped Macs running bridgeOS 5.0 or later, providing system-level access and modification capabilities on those devices. The tool offers two distinct jailbreak environments: a Rootless mode that provides system access without modifying the root filesystem, and a Full-root mode that grants unrest

libfuse is a library and kernel module combination that enables the development of custom Linux filesystems that run in userspace rather than in kernel space. It provides a bridge between the kernel's virtual filesystem layer and a userspace daemon, allowing filesystem operations to be forwarded and handled by a regular user process. The project offers two distinct APIs: a high-level callback-driven API where filesystem operations are implemented as simple functions that return results synchronously, and a low-level API that exposes raw kernel request structures directly for fine-grained contr

Bitwise is a computer architecture education kit and a comprehensive set of guides for building a custom CPU, operating system, and compiler from scratch. It serves as a CPU design tutorial and a practical framework for implementing a unique instruction set architecture. The project provides a custom instruction set architecture toolchain, including resources for creating a matching assembler and compiler. It further includes a hardware development guide for synthesizing computer components and peripheral controllers for deployment on programmable logic devices and FPGAs. The kit covers full

ProcMon-for-Linux ist ein eBPF-basiertes System-Observability-Tool und Prozessmonitor für Linux. Es fungiert als System-Call-Tracer und Aktivitätslogger, der Echtzeit-Kernel- und User-Space-Ereignisse erfasst, um das Betriebssystemverhalten zu analysieren. Das Projekt bietet ein Text-User-Interface zur Inspektion aufgezeichneter Trace-Dateien. Es trennt die hochperformante, Headless-Ereignisaufzeichnung vom Analyse-Interface, um Datenverlust bei hoher Systemlast zu verhindern. Das Tool bietet Funktionen für System-Call-Tracing und Aktivitätsüberwachung, einschließlich der Möglichkeit, Ereignisse nach Prozess-IDs oder spezifischen System-Call-Typen zu filtern. Es unterstützt Low-Level-Prozess-Debugging und die retrospektive Analyse von Systemaktivitäten.

EasyLogger ist eine leichtgewichtige C/C++-Logging-Bibliothek und ein asynchrones Framework für eingebettete Systeme, IoT-Geräte und Wearables. Es fungiert als ressourceneffizienter Logger und Flash-Speichermanager und bietet Tools für Low-Level-Debugging und die Aufzeichnung von Systemereignissen bei minimalem ROM- und RAM-Bedarf. Das Projekt zeichnet sich durch ein asynchrones Logging-Modell aus, das Nachrichten in einem separaten Thread puffert, wodurch Logging-Operationen die Echtzeit-Anwendungsausführung nicht blockieren. Es enthält einen spezialisierten Flash-Speichermanager, der zirkuläre Pufferung nutzt, um Logs in nicht-flüchtigem Speicher zu persistieren und so sicherzustellen, dass kritische Daten über Geräte-Reboots hinweg erhalten bleiben. Die Bibliothek deckt ein breites Spektrum an Beobachtbarkeitsfunktionen ab, einschließlich System-Assertions zur Zustandsvalidierung, Severity-Filterung zur Kompilier- und Laufzeit sowie die Generierung von rohen binären Hex-Dumps. Sie unterstützt die Anreicherung von Metadaten mit Zeitstempeln und Thread-IDs sowie eine portable Schnittstelle zur Weiterleitung von Logs an benutzerdefinierte Ziele wie serielle Schnittstellen oder Dateien. Das System stellt die Datenintegrität durch Schreibsynchronisation sicher und bietet Mechanismen für das manuelle Leeren von Puffern und das Abrufen gespeicherter Logs.

asm-dude ist eine Visual-Studio-Erweiterung für die Assembler-Programmierung und Low-Level-Entwicklung. Sie bietet Syntax-Highlighting, Code-Vervollständigung und Mnemonic-Referenzen sowohl für Quellcode- als auch für Disassembly-Fenster. Das Plugin enthält ein Mnemonic-Referenz-Tool, das Pop-up-Beschreibungen und Parametersignaturen für Assembler-Befehle anzeigt. Diese Referenzen werden über konfigurierbare Datendateien verwaltet, was benutzerdefinierte Befehlseinträge und Beschreibungen ermöglicht. Die Erweiterung integriert sich in den Editor, um kontextbezogene Tooltips und Keyword-Vervollständigung während des Tippens bereitzustellen. Sie nutzt zudem musterbasiertes Syntax-Highlighting und Code-Folding, um die Lesbarkeit von disassembliertem Maschinencode während des Debuggings zu verbessern.

Binsider is a collection of specialized toolsets for hexadecimal editing, ELF structural analysis, system call tracing, and execution performance profiling. It provides a suite of utilities designed for binary reverse engineering, encompassing both static structural analysis and dynamic runtime monitoring of compiled binaries. The project distinguishes itself by combining low-level binary manipulation, such as a hex editor for raw byte modification, with an ELF binary analysis tool for inspecting file structures and metadata. It also includes a Linux system call tracer for observing dynamic b

Seer is a graphical frontend for GDB that provides a visual interface for inspecting variables, managing breakpoints, and stepping through code. It functions as a low-level debugger visualizer with specialized tools for call stack inspection and register visualization. The project distinguishes itself by integrating low-level program analysis directly into the visual experience, featuring a synchronized assembly overlay that maps CPU registers and assembly instructions to source code lines. It also includes memory bug detection capabilities by randomizing the program starting address during t

This project is an educational operating system kernel designed to demonstrate the fundamental architectural principles of memory paging and process management. It is implemented as a minimal kernel that serves as a practical reference for building a functioning system from the ground up. The implementation features a preemptive multitasking kernel that switches execution contexts between threads to share a single CPU. It includes an x86 virtual memory manager that uses paging to map virtual addresses to physical memory and isolate processes. The system covers low-level hardware interfacing

Dieses Projekt ist eine webbasierte Bildungsumgebung zur Simulation von 8-Bit-Prozessorarchitektur und Assembly-Sprachausführung. Es fungiert als virtuelle Maschine, die symbolischen Assembly-Code in Maschinenbefehle übersetzt, was es Benutzern ermöglicht, den Fetch-Decode-Execute-Zyklus und dessen Auswirkungen auf den Systemzustand in Echtzeit zu beobachten. Der Simulator zeichnet sich durch ein reaktives Interface aus, das visuelle Register- und Speicheranzeigen direkt an den zugrunde liegenden Prozessorzustand bindet. Er enthält einen Zwei-Pass-Assembler, der symbolische Label-Auflösung und Speicheradress-Mapping verwaltet und eine strukturierte Möglichkeit bietet, Assembly-Programme zu organisieren und zu navigieren. Benutzer können die Taktfrequenz des virtuellen Prozessors steuern, was es ihnen ermöglicht, die Befehlsausführung für detaillierte Beobachtung und Debugging zu verlangsamen. Die Anwendung bietet eine umfassende Suite von Tools zur Überwachung interner Prozessor-Flags, Registerwerte und Speicherinhalte. Sie unterstützt flexible Datenformatierung für Speicher und Register, was es erlaubt, Werte entweder in hexadezimaler oder dezimaler Notation zu betrachten. Die Umgebung ist als browserbasierte Anwendung konzipiert, was das Studium von Low-Level-Computing-Konzepten und Embedded-System-Logik ohne externe Hardware erleichtert.