10

Does GHIDRA have a debugger attached for dynamic analysis of application?

2
  • Take a look at GDB integration: github.com/Comsecuris/gdbghidra
    – mluis
    Commented Nov 21, 2019 at 0:25
  • ret-sync lets you use any debugger youre comfortable with and send the debugger information (like $sp, registers, etc) over to ghidra so you can look at the de compiled code Commented Feb 25, 2021 at 18:21

5 Answers 5

12

Edit: As the question is a little unclear there might be a misunderstanding. From my point of view there are 2 possible answers:

  1. GHIDRA does not offer a debugger for other binaries currently. (It is a planned feature)

  2. GHIDRA has a debug mode to debug GHIDRA itself. This debugger is even accessible from the network, as the exposed port is not only locally bound.

Hacker Fantastic on Twitter:

Ghidra opens up JDWP in debug mode listening on port 18001, you can use it to execute code remotely 🤦‍♂️.. to fix change line 150 of support/launch.sh from * to 127.0.0.1 https://static.hacker.house/releasez/expl0itz/jdwp-exploit.txt

3
  • 1
    I think the questioner meant a debugger for targeting AUTs
    – atdre
    Commented Mar 7, 2019 at 16:32
  • This is not the kind of debugger the question is referring to. The debugger in your answer is to debug Ghidra itself. The question wants to execute and instrument a target application.
    – David
    Commented Mar 7, 2019 at 21:28
  • Thanks for your feedback. I might have gotten the question wrong and updated my response. Commented Mar 8, 2019 at 6:21
5

From Ghidra 10.0, Ghidra debugger is included in the official release: https://htmlpreview.github.io/?https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0_build/Ghidra/Configurations/Public_Release/src/global/docs/ChangeHistory.html

From WikiLeaks' "Vault 7: CIA Hacking Tools Revealed", I see Ghidra has a plugin for interaction with OllyDbg ("the Ghidra Debugger") but this OllyDbg plugin has not been released in the Ghidra public release yet. https://wikileaks.org/ciav7p1/cms/page_51183656.html

4

As of December 17th (2020), it has. See the announcement in Twitter https://twitter.com/NSACyber/status/1339652646513291264 and the debugger branch of Ghidra in GitHub https://github.com/NationalSecurityAgency/ghidra/tree/debugger

2

Now yes!

From Ghidra 10.0 change history

New Features

  • Debugger. Introduced the Debugger, along with GDB and dbgeng.dll connectors for debugging user-mode applications on Linux and Windows, respectively. The UI includes threads, timeline, modules, memory, registers, watches, etc., for examining and controlling debug targets. See Help -> Contents -> What's New for more details. (GP-986)

Ghidra 10.0 Change History (June 2021)

1

Ghidra does not have a debugger to date, but can be synchronized with a debugger (eg., x64dbg), with [ret-sync][1]:

ret-sync stands for Reverse-Engineering Tools SYNChronization. It is a set of plugins that help to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg/OllyDbg2/x64dbg) with a disassembler (IDA/Ghidra/Binary Ninja). The underlying idea is simple: take the best from both worlds (static and dynamic analysis).

In particular:

Debuggers and dynamic analysis provide us with:

  • local view, with live dynamic context (registers, memory, etc.)
  • built-in specialized features/API (ex: WinDbg's !peb, !drvobj, !address, etc.)

Disassemblers and static analysis provide us with:

  • macro view over modules
  • code analysis, signatures, types, etc.
  • fancy graph view
  • decompilation
  • persistent storage of knowledge within IDBs/GPRs

Key features:

  • synchronize graph and decompilation views with debugger's state
  • no need to deal with ASLR, addresses are rebased on-the-fly
  • pass data (comment, command output) from debugger to disassembler
  • multiple IDBs/GPRs can be synced at the same time allowing to easily trace through multiple modules
  • disassembler and debugger can be on different hosts / VMs

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .