Trashdbg - TrashDBG the world's worse debugger

Overview

trashdbg2

The world's worse debugger

Over the course of multiple OALABS Twitch streams we will build the world's worst debugger! The purpose of the streams is to learn more about the inner workings of debugging under Windows and gain a better general understanding of what our tools are doing when we are debugging malware.

References

Much of the code in this project is heavily copy-pasted from multiple sources on the Internet. We will try to maintain a list of original sources here, but we may occasionally miss sources while on stream. If we missed something let us know so we can add it!

No PRs

Because this project is meant to be a community effort on stream we won’t be accepting PRs. Aside from some maintenance/cleanup all coding will be done on-stream. If you have feature requests or suggestions leave your feedback as an Issue or come chat with us on Discord.

Join Us!

💖 Check out our schedule we stream Thursdays and Sundays at 1300 EST

Chat Support

You might also like...
Full featured multi arch/os debugger built on top of PyQt5 and frida

Full featured multi arch/os debugger built on top of PyQt5 and frida

Arghonaut is an interactive interpreter, visualizer, and debugger for Argh! and Aargh!

Arghonaut Arghonaut is an interactive interpreter, visualizer, and debugger for Argh! and Aargh!, which are Befunge-like esoteric programming language

A simple rubber duck debugger

Rubber Duck Debugger I found myself many times asking a question on StackOverflow or to one of my colleagues just for finding the solution simply by d

Visual Interaction with Code - A portable visual debugger for python

VIC Visual Interaction with Code A simple tool for debugging and interacting with running python code. This tool is designed to make it easy to inspec

Hdbg - Historical Debugger
Hdbg - Historical Debugger

hdbg - Historical Debugger This is in no way a finished product. Do not use this

The official code of LM-Debugger, an interactive tool for inspection and intervention in transformer-based language models.
The official code of LM-Debugger, an interactive tool for inspection and intervention in transformer-based language models.

LM-Debugger is an open-source interactive tool for inspection and intervention in transformer-based language models. This repository includes the code

apple's universal binaries BUT MUCH WORSE (PRACTICAL SHITPOST) (NOT PRODUCTION READY)

hyperuniversality investment opportunity: what if we could run multiple architectures in a single file, again apple universal binaries, but worse how

Much faster than SORT(Simple Online and Realtime Tracking), a little worse than SORT

QSORT QSORT(Quick + Simple Online and Realtime Tracking) is a simple online and realtime tracking algorithm for 2D multiple object tracking in video s

Asynchronous Client for the worlds fastest in-memory geo-database Tile38

This is an asynchonous Python client for Tile38 that allows for fast and easy interaction with the worlds fastest in-memory geodatabase Tile38.

Code Jam for creating a text-based adventure game engine and custom worlds

Text Based Adventure Jam Author: Devin McIntyre Our goal is two-fold: Create a text based adventure game engine that can parse a standard file format

Combine the power of FastAPI and Django to build a production-ready application capable of utilizing all of the best features of both worlds.
Combine the power of FastAPI and Django to build a production-ready application capable of utilizing all of the best features of both worlds.

FastAPI and Django Combo This projects aims to combine FastAPI and Django to build a Production ready application capable of utilizing all of the feat

A simple python script to pregenerate minecraft worlds.

mcloady mcloady is a lightweight python script used to pre-generate Minecraft terrain using MCRcon and carpet mod (optional). Inspired by Pre-Generati

Intercepting proxy + analysis toolkit for Second Life compatible virtual worlds
Intercepting proxy + analysis toolkit for Second Life compatible virtual worlds

Hippolyzer Hippolyzer is a revival of Linden Lab's PyOGP library targeting modern Python 3, with a focus on debugging issues in Second Life-compatible

Backend code to use MCPI's python API to make infinite worlds with custom generation

inf-mcpi Backend code to use MCPI's python API to make infinite worlds with custom generation Does not save player-placed blocks! Generation is still

Useful tools for Minecraft worlds such as remove unused chunks, find blocks or entities.

Useful tools for Minecraft worlds such as removing unused chunks and finding blocks, command blocks or entities.

pdb++, a drop-in replacement for pdb (the Python debugger)
pdb++, a drop-in replacement for pdb (the Python debugger)

pdb++, a drop-in replacement for pdb What is it? This module is an extension of the pdb module of the standard library. It is meant to be fully compat

Full-screen console debugger for Python
Full-screen console debugger for Python

PuDB: a console-based visual debugger for Python Its goal is to provide all the niceties of modern GUI-based debuggers in a more lightweight and keybo

An improbable web debugger through WebSockets
An improbable web debugger through WebSockets

wdb - Web Debugger Description wdb is a full featured web debugger based on a client-server architecture. The wdb server which is responsible of manag

Debugger capable of attaching to and injecting code into python processes.

DISCLAIMER: This is not an official google project, this is just something I wrote while at Google. Pyringe What this is Pyringe is a python debugger

Comments
  • Cannot get access to DLL info when handling LOAD_DLL_DEBUG_EVENT event

    Cannot get access to DLL info when handling LOAD_DLL_DEBUG_EVENT event

    When we attempt to handle a LOAD_DLL_DEBUG_EVENT event we find we don't have access to information about the DLL that was just loaded.

    https://github.com/OALabs/trashdbg/blob/90a2adc8872fd437141c7cb44b169ec69ba16041/trashdbg/trashdbg.py#L23

    We tried querying information about the DLL via GetModuleFileNameExW using pEvent.u.LoadDll.lpBaseOfDll but we were getting an invalid handle issue for the module handle.

    We also tried using EnumProcessModulesEx and CreateToolhelp32Snapshot to enumerate the modules and find the newly loaded module but it seems when the LOAD_DLL_DEBUG_EVENT event is raised the full information about the DLL has not been populated yet so both these methods cannot access the new DLL.

    opened by herrcore 3
  • why doesn't WriteProcessMemory change the memory permissions for us

    why doesn't WriteProcessMemory change the memory permissions for us

    https://github.com/OALabs/trashdbg/blob/438e07543f5490d1a0c26dfa74060c42d5ddb5d8/trashdbg/win32memory.py#L107

    According to the oldnewthing blog WriteProcessMemory should automatically change the memory permissions so we can write to it without us having to manually change them.

    This fails when we test it so we have to wrap write memory ourselves ... why??

    opened by herrcore 1
  • We clobber multiple exports from the same dll that share an address

    We clobber multiple exports from the same dll that share an address

    Some dll exports have the same address so we can't index them by address: https://github.com/OALabs/trashdbg/blob/438e07543f5490d1a0c26dfa74060c42d5ddb5d8/trashdbg/trashdbg.py#L109

    We need to index by name or something else that is unique!

    opened by herrcore 0
Owner
OALabs
OALabs
Full-screen console debugger for Python

PuDB: a console-based visual debugger for Python Its goal is to provide all the niceties of modern GUI-based debuggers in a more lightweight and keybo

Andreas Klöckner 2.6k Jan 1, 2023
An improbable web debugger through WebSockets

wdb - Web Debugger Description wdb is a full featured web debugger based on a client-server architecture. The wdb server which is responsible of manag

Kozea 1.6k Dec 9, 2022
Debugger capable of attaching to and injecting code into python processes.

DISCLAIMER: This is not an official google project, this is just something I wrote while at Google. Pyringe What this is Pyringe is a python debugger

Google 1.6k Dec 15, 2022
pdb++, a drop-in replacement for pdb (the Python debugger)

pdb++, a drop-in replacement for pdb What is it? This module is an extension of the pdb module of the standard library. It is meant to be fully compat

null 1k Jan 2, 2023
Graphical Python debugger which lets you easily view the values of all evaluated expressions

birdseye birdseye is a Python debugger which records the values of expressions in a function call and lets you easily view them after the function exi

Alex Hall 1.5k Dec 24, 2022
Voltron is an extensible debugger UI toolkit written in Python.

Voltron is an extensible debugger UI toolkit written in Python. It aims to improve the user experience of various debuggers (LLDB, GDB, VDB an

snare 5.9k Dec 30, 2022
PINCE is a front-end/reverse engineering tool for the GNU Project Debugger (GDB), focused on games.

PINCE is a front-end/reverse engineering tool for the GNU Project Debugger (GDB), focused on games. However, it can be used for any reverse-engi

Korcan Karaokçu 1.5k Jan 1, 2023
NoPdb: Non-interactive Python Debugger

NoPdb: Non-interactive Python Debugger Installation: pip install nopdb Docs: https://nopdb.readthedocs.io/ NoPdb is a programmatic (non-interactive) d

Ondřej Cífka 67 Oct 15, 2022
Tracing instruction in lldb debugger.Just a python-script for lldb.

lldb-trace Tracing instruction in lldb debugger. just a python-script for lldb. How to use it? Break at an address where you want to begin tracing. Im

null 156 Jan 1, 2023
Little helper to run Steam apps under Proton with a GDB debugger

protongdb A small little helper for running games with Proton and debugging with GDB Requirements At least Python 3.5 protontricks pip package and its

Joshie 21 Nov 27, 2022