📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  Scriptable vs. Interactive debuggers

Topic created on: March 18, 2007 16:35 CDT by apridgen .

Stemming from drew's blog post:

http://www.openrce.org/blog/view/598/The_Greatness_of_PyDbg

What are the situations for using scriptable debuggers, and what are some advantages over using scriptable debuggers?  

For example: can the debugger be hidden, renamed etc.

I have only worked with interactive debuggers (e.g. WinDbg and Olly), and I can see some situations like in the case of malware analysis, where obvious advantages arise.  

Also, how would I know if I should use a scriptable debugger?  I guess experience would dictate.  

Simply getting familiar with the RE terrain, so thanks for any responses.  In understand this is a fairly loaded question, but again  I appreciate your responses.

Adam

  antonone     March 23, 2007 11:52.16 CDT
You can use scriptable debuggers (f.e. in a 'tracer' form) if you don't really know what (or where) are you searching for. You can only specify some base points or some rules you know that are happening, configure the tracer to log all relevant information, and then search the logs for some clues. You can also configure such a tracer to somehow alter the execution of the debugged program and extract some crucial information from it (like it is done in some unpackers).
The advantages or disadvantages depend on the type of work you're doing. There are different tools for different tasks, like in everything.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit