Awesome GitHub RepositoriesLow-Level Debuggers

radare2 is a reverse engineering framework and binary analysis toolset. It functions as a multi-architecture disassembler, low-level binary debugger, and hexadecimal editor for inspecting executable structures and interpreting machine code when original source files are unavailable. The framework provides capabilities for decompiling machine instructions, performing symbolic analysis, and diffing binary files to identify structural changes across versions. It also includes a digital forensic analyzer and disk analyzer for browsing filesystem formats in userland. The toolset supports binary p

Ish is a Linux shell emulator for iOS that provides a local terminal environment for running shell commands and managing files. It functions as an instruction-level emulator that enables the execution of Linux binaries on mobile devices by simulating an Alpine Linux environment. The project distinguishes itself by combining user-mode Linux emulation with a virtual root filesystem. This allows the software to map Linux kernel system calls to host functions and execute scripts and toolsets directly on an iPhone or iPad. The emulator also provides low-level program debugging capabilities, inclu

rr is a deterministic record and replay framework and reverse debugger for Linux processes. It provides a deterministic execution environment that captures program execution, allowing bugs and crashes to be reproduced exactly through replay. The tool enables reverse program execution, allowing a developer to move the program counter backward through recorded history to trace a bug from its effect back to its source. It utilizes a recording mechanism that ensures a process run can be replayed with identical memory and register states. The framework covers low-level software analysis and nativ

pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and low-level program analysis. It extends the core functionality of the debugger to provide advanced memory inspection and automation tools. The project distinguishes itself with specialized capabilities for heap analysis across glibc, jemalloc, and musl, as well as a comprehensive kernel debugging toolkit for inspecting Linux kernel tasks and slab allocators. It includes an integrated ROP gadget searcher for constructing exploit chains and an LLM-powered debugging assistant that provi

Unicorn is a multi-architecture CPU emulation framework and library that utilizes just-in-time compilation to execute instructions across various processor architectures, including ARM, x86, and RISC-V. It functions as both a JIT compilation engine and an instrumentation tool, allowing for the execution of machine code without the need for physical hardware. The framework is distinguished by its hook-based execution instrumentation, which enables the interception of specific instructions and memory accesses to trigger custom callback functions. It provides a language-agnostic binding layer an

GEF is a Python-based extension for GDB that serves as a framework for binary analysis, exploit development, and low-level debugging. It functions as a dynamic analysis extension designed to assist in reverse engineering workflows and malware analysis by enhancing the debugger's ability to inspect process state and memory. The project is distinguished by its specialized heap analysis tools, which allow for the inspection of glibc heap arenas, bins, and chunks to detect memory corruption. It also provides a dedicated toolkit for exploit development, including cyclic pattern generation for offs

Blink is a JIT-based instruction emulator and x86-64 Linux emulator designed to run Linux binaries and ELF files across different host operating systems and architectures. It functions as a binary execution sandbox and system call simulator, providing a controlled environment for running programs. The project distinguishes itself with a terminal user interface for monitoring execution, managing breakpoints, and visualizing JIT compilation paths. It supports self-modifying code through a cache-invalidating memory model and provides execution environment isolation using restricted directory ove

mGBA is a high-accuracy Game Boy Advance emulator and hardware-level debugger designed to run handheld console ROMs on modern computers. It serves as a scriptable emulation environment that allows for the execution of portable hardware software and the simulation of associated peripherals. The project distinguishes itself through its focus on technical analysis, providing a suite of tools for retro game debugging and game logic inspection. It includes a host-client debug protocol that enables external debugger connectivity via TCP socket communication and an event-driven scripting engine for

palera1n is an iOS jailbreak tool that exploits a permanent hardware vulnerability in the bootrom of A8 through A11 Apple devices running iOS 15.0 or later, granting root access for system customization and third-party software installation. The tool also extends this jailbreak technique to Apple T2-equipped Macs running bridgeOS 5.0 or later, providing system-level access and modification capabilities on those devices. The tool offers two distinct jailbreak environments: a Rootless mode that provides system access without modifying the root filesystem, and a Full-root mode that grants unrest

libfuse is a library and kernel module combination that enables the development of custom Linux filesystems that run in userspace rather than in kernel space. It provides a bridge between the kernel's virtual filesystem layer and a userspace daemon, allowing filesystem operations to be forwarded and handled by a regular user process. The project offers two distinct APIs: a high-level callback-driven API where filesystem operations are implemented as simple functions that return results synchronously, and a low-level API that exposes raw kernel request structures directly for fine-grained contr

Bitwise is a computer architecture education kit and a comprehensive set of guides for building a custom CPU, operating system, and compiler from scratch. It serves as a CPU design tutorial and a practical framework for implementing a unique instruction set architecture. The project provides a custom instruction set architecture toolchain, including resources for creating a matching assembler and compiler. It further includes a hardware development guide for synthesizing computer components and peripheral controllers for deployment on programmable logic devices and FPGAs. The kit covers full

ProcMon-for-Linux este un instrument de observabilitate a sistemului bazat pe eBPF și un monitor de procese pentru Linux. Funcționează ca un tracer de apeluri de sistem și logger de activitate, capturând evenimente în timp real din kernel și user-space pentru a analiza comportamentul sistemului de operare. Proiectul dispune de o interfață text (TUI) pentru inspectarea fișierelor de trace înregistrate. Separă înregistrarea evenimentelor headless de înaltă performanță de interfața de analiză pentru a preveni pierderea datelor în timpul sarcinilor grele ale sistemului. Instrumentul oferă capabilități pentru urmărirea apelurilor de sistem și monitorizarea activității, inclusiv capacitatea de a filtra evenimentele după identificatori de proces sau tipuri specifice de apeluri de sistem. Suportă debugging-ul proceselor de nivel scăzut și analiza retrospectivă a activității sistemului.

EasyLogger este o bibliotecă de logging C/C++ ușoară și un framework asincron conceput pentru sisteme embedded, dispozitive IoT și wearables. Acesta funcționează ca un logger eficient din punct de vedere al resurselor și un manager de memorie flash, oferind instrumente pentru debugging de nivel scăzut și înregistrarea evenimentelor de sistem cu cerințe minime de ROM și RAM. Proiectul se distinge printr-un model de logging asincron care stochează mesajele într-un thread separat, prevenind blocarea execuției aplicației în timp real. Include un manager de memorie flash specializat care utilizează buffering circular pentru a persista log-urile în stocare non-volatilă, asigurând păstrarea datelor critice la repornirea dispozitivului. Biblioteca acoperă o gamă largă de capabilități de observabilitate, inclusiv aserțiuni de sistem pentru validarea stării, filtrarea severității la compilare și runtime, și generarea de dump-uri binare hexazecimale brute. Suportă îmbogățirea metadatelor cu timestamp-uri și identificatori de thread, alături de o interfață portabilă pentru direcționarea log-urilor către destinații personalizate, cum ar fi porturi seriale sau fișiere. Sistemul asigură integritatea datelor prin sincronizarea scrierii și oferă mecanisme pentru golirea manuală a buffer-ului și recuperarea log-urilor stocate.

asm-dude este o extensie Visual Studio concepută pentru dezvoltarea în limbaj de asamblare și programare low-level. Oferă evidențierea sintaxei, completarea codului și referințe mnemonice atât pentru ferestrele sursă, cât și pentru cele de dezasamblare. Plugin-ul dispune de un instrument de referință mnemonică care afișează descrieri pop-up și semnături de parametri pentru instrucțiunile de asamblare. Aceste referințe sunt gestionate prin fișiere de date configurabile, permițând intrări și descrieri personalizate ale instrucțiunilor. Extensia se integrează cu editorul pentru a oferi tooltips conștiente de context și completarea cuvintelor cheie în timpul tastării. De asemenea, utilizează evidențierea sintaxei bazată pe tipare și plierea codului pentru a îmbunătăți lizibilitatea codului mașină dezasamblat în timpul depanării.

Binsider is a collection of specialized toolsets for hexadecimal editing, ELF structural analysis, system call tracing, and execution performance profiling. It provides a suite of utilities designed for binary reverse engineering, encompassing both static structural analysis and dynamic runtime monitoring of compiled binaries. The project distinguishes itself by combining low-level binary manipulation, such as a hex editor for raw byte modification, with an ELF binary analysis tool for inspecting file structures and metadata. It also includes a Linux system call tracer for observing dynamic b

Seer is a graphical frontend for GDB that provides a visual interface for inspecting variables, managing breakpoints, and stepping through code. It functions as a low-level debugger visualizer with specialized tools for call stack inspection and register visualization. The project distinguishes itself by integrating low-level program analysis directly into the visual experience, featuring a synchronized assembly overlay that maps CPU registers and assembly instructions to source code lines. It also includes memory bug detection capabilities by randomizing the program starting address during t

This project is an educational operating system kernel designed to demonstrate the fundamental architectural principles of memory paging and process management. It is implemented as a minimal kernel that serves as a practical reference for building a functioning system from the ground up. The implementation features a preemptive multitasking kernel that switches execution contexts between threads to share a single CPU. It includes an x86 virtual memory manager that uses paging to map virtual addresses to physical memory and isolate processes. The system covers low-level hardware interfacing

This project is a web-based educational environment designed to simulate 8-bit processor architecture and assembly language execution. It functions as a virtual machine that translates symbolic assembly code into machine instructions, allowing users to observe the fetch-decode-execute cycle and its impact on system state in real time. The simulator distinguishes itself through a reactive interface that binds visual register and memory displays directly to the underlying processor state. It incorporates a two-pass assembler that manages symbolic label resolution and memory address mapping, pro