# LyDebugger **Repository Path**: lyshark/LyDebugger ## Basic Information - **Project Name**: LyDebugger - **Description**: A CLI version application layer dynamic disassembly debugger based on Windows debugging interface, lightweight and adaptable to debugging scenarios. - **Primary Language**: C++ - **License**: GPL-3.0 - **Default Branch**: main - **Homepage**: https://github.com/lyshark/LyDebugger - **GVP Project**: No ## Statistics - **Stars**: 0 - **Forks**: 0 - **Created**: 2026-07-12 - **Last Updated**: 2026-07-12 ## Categories & Tags **Categories**: Uncategorized **Tags**: debugger, demo, Windows ## README # LyDebugger Dynamic disassembly debugger Lydebugger is a lightweight 32/64 bit local debugger developed based on Windows Debug API and Capstone disassembly engine. It supports creating process debugging/attaching existing processes, fully implementing software breakpoints, memory breakpoints, hardware breakpoints, register/stack/memory viewing and modification, single step debugging, module thread enumeration, instruction disassembly and other core functions of reverse debugging. The code is implemented in pure C++native, without third-party GUI dependencies and command-line interaction. It is mainly used for teaching and demonstrating debugger principles. ### Create Debug Process Create a new target process through the `Debug` command and start debugging immediately. The debugger automatically captures the system initialization breakpoint when the target process starts, waiting for user input of debug commands. **Syntax** `LyDebugger32.exe Debug --path ` **Parameter Description** - `--path`: Specify the full path of the program to be debugged **Example** ```bash CMD> LyDebugger32.exe Debug --path e://win32.exe [+] Debug process created: e://win32.exe (PID: 20464, TID: 20468) [*] Entering debug loop, waiting for events... [*] Process created: PID = 20464, Entry address = 0x0040152C [*] DLL loaded: Base address = 0x77100000, Path = C:\Windows\SYSTEM32\ntdll.dll [*] DLL loaded: Base address = 0x75A60000, Path = C:\Windows\System32\KERNEL32.DLL [*] DLL loaded: Base address = 0x76400000, Path = C:\Windows\System32\KERNELBASE.dll [*] DLL loaded: Base address = 0x6E170000, Path = C:\Windows\SYSTEM32\apphelp.dll [*] Thread created: TID = 13388, Entry address = 0x771497D0 [*] Thread created: TID = 11296, Entry address = 0x771497D0 [*] Thread created: TID = 16628, Entry address = 0x771497D0 [*] DLL loaded: Base address = 0x67E90000, Path = C:\Windows\SYSTEM32\MSVCR120.dll [*] System initialization breakpoint captured, restoring context... [*] Process started, waiting for debug commands... [ 0x771AE9C6 ] # ``` ### Attach to Existing Process Attach to an already running process for debugging through the `Attach` command. The debugger will pause the target process and wait for user input of debug commands. **Syntax** `LyDebugger32.exe Attach --pid ` **Parameter Description** - `--pid`: Specify the process ID (PID) of the target process to attach **Example** ```bash CMD> LyDebugger32.exe Attach --pid 16372 [+] Attached to process (PID: 16372) [*] Entering debug loop, waiting for events... [*] Process created: PID = 16372, Entry address = 0x00000000 [*] DLL loaded: Base address = 0x77100000, Path = C:\Windows\SYSTEM32\ntdll.dll [*] Thread created: TID = 15908, Entry address = 0x771497D0 [*] Thread created: TID = 13132, Entry address = 0x771497D0 [*] Thread created: TID = 19452, Entry address = 0x771497D0 [*] Thread created: TID = 19948, Entry address = 0x771497D0 [*] Thread created: TID = 2912, Entry address = 0x771497D0 [*] DLL loaded: Base address = 0x75A60000, Path = C:\Windows\System32\KERNEL32.DLL [*] DLL loaded: Base address = 0x76400000, Path = C:\Windows\System32\KERNELBASE.dll [*] DLL loaded: Base address = 0x67F10000, Path = C:\Windows\SYSTEM32\MSVCR120.dll [*] Thread created: TID = 20472, Entry address = 0x771AAC10 [*] System initialization breakpoint captured, restoring context... [*] Process started, waiting for debug commands... [ 0x77173D20 ] # ``` ### Enumerate Modules Used to enumerate and display information about all loaded modules (DLLs and EXEs) in the target process, including module ID, base address, size, and module name. It works by calling the `EnumProcessModules` function to get a list of handles for all loaded modules in the target process, then calling `GetModuleBaseName` and `GetModuleInformation` for each module to get the module name, base address, and size information. **Syntax** `Modules` **Output Field Description** - `ID`: Module number - `Base Address`: Base address where the module is loaded - `Size`: Module size (bytes) - `Name`: Module file name **Example** ```bash [ 0x771AE9C6 ] # Modules +----+----------------+----------------+----------------+ | ID | Base Address | Size | Name | +----+----------------+----------------+----------------+ | 1 | 0x00400000 | 0x00006000 | win32.exe | | 2 | 0x77100000 | 0x0019D000 | ntdll.dll | | 3 | 0x75A60000 | 0x000E0000 | KERNEL32.DLL | | 4 | 0x76400000 | 0x00202000 | KERNELBASE.dll | | 5 | 0x74850000 | 0x0019A000 | USER32.dll | | 6 | 0x768E0000 | 0x00017000 | win32u.dll | | 7 | 0x76930000 | 0x00023000 | GDI32.dll | | 8 | 0x766D0000 | 0x00176000 | gdi32full.dll | | 9 | 0x747D0000 | 0x00080000 | msvcp_win.dll | | 10 | 0x75360000 | 0x00123000 | ucrtbase.dll | | 11 | 0x67E90000 | 0x000EE000 | MSVCR120.dll | +----+----------------+----------------+----------------+ [ 0x771AE9C6 ] # ``` ### Enumerate Threads (Threads) Used to enumerate and display information about all threads in the target process, including thread ID, TEB (Thread Environment Block) base address, and thread status. It works by calling `CreateToolhelp32Snapshot` to create a thread snapshot, then using `Thread32First` and `Thread32Next` to iterate through all threads and get each thread's ID and TEB base address. **Syntax** `Threads` **Output Field Description** - `ID`: Thread number - `Thread ID`: Thread identifier (TID) - `TEB Base`: Base address of the Thread Environment Block - `Status`: Thread status (Active means active, Exited means exited) **Example** ```bash [ 0x771AE9C6 ] # Threads +----+----------------+----------------+----------------+ | ID | Thread ID | TEB Base | Status | +----+----------------+----------------+----------------+ | 1 | 20320 | 0x00000053 | Active | | 2 | 12900 | 0x00000053 | Active | | 3 | 17752 | 0x00000053 | Active | | 4 | 16064 | 0x00000053 | Active | +----+----------------+----------------+----------------+ ``` ### View Registers (Register) Used to display all register information of the current thread, including general-purpose registers, segment registers, control registers, debug registers, FPU registers, and SSE registers. It works by calling the `GetThreadContext` function to get the context structure (CONTEXT) of the current thread, which contains the values of all registers. Depending on different ContextFlags flags, general-purpose registers, segment registers, control registers, debug registers, FPU registers, and SSE registers can be obtained. **Syntax** `Register` **Output Description** - `[General Purpose Registers]`: Shows values of EAX, EBX, ECX, EDX, ESI, EDI, ESP, EBP - `[Segment Registers]`: Shows values of CS, SS, DS, ES, FS, GS - `[Control Registers]`: Shows values of EIP (Instruction Pointer) and EFLAGS (Flags Register) - `[Debug Registers]`: Shows values of DR0-DR7, used for hardware breakpoints - `[Floating Point (FPU) Registers]`: Shows FPU control word, status word, and tag word - `[SSE Registers (XMM0-XMM7)]`: Shows values of 128-bit SSE registers **Example** ```bash [ 0x771AE9C6 ] # Register [General Purpose Registers] +----------------+----------------+----------------+----------------+ | EAX = 0x00000000 | EBX = 0x00000010 | ECX = 0x66EC0000 | EDX = 0x00000000 | +----------------+----------------+----------------+----------------+ | ESI = 0x006C2040 | EDI = 0x00315000 | ESP = 0x0019FA24 | EBP = 0x0019FA50 | +----------------+----------------+----------------+----------------+ [Segment Registers] +----------------+----------------+----------------+----------------+ | CS = 0x0023 | SS = 0x002B | DS = 0x002B | ES = 0x002B | +----------------+----------------+----------------+----------------+ | FS = 0x0053 | GS = 0x002B | | | +----------------+----------------+----------------+----------------+ [Control Registers] +----------------+----------------+ | EIP = 0x771AE9C6 | EFLAGS = 0x00000244 | +----------------+----------------+ [Debug Registers] +----------------+----------------+----------------+----------------+ | DR0 = 0x00000000 | DR1 = 0x00000000 | DR2 = 0x00000000 | DR3 = 0x00000000 | +----------------+----------------+----------------+----------------+ | DR6 = 0x00000000 | DR7 = 0x00000000 | | | +----------------+----------------+----------------+----------------+ [Floating Point (FPU) Registers] +----------------+----------------+----------------+ | Control Word(CW)=0x027F | Status Word(SW)=0x0000 | Tag Word(TW)=0xFFFF | +----------------+----------------+----------------+ [SSE Registers (XMM0-XMM7)] +----------------------------------------+----------------------------------------+ | XMM0 = 0x00000000000000000000000000000000 | XMM1 = 0x00000000000000000000000000000000 | +----------------------------------------+----------------------------------------+ | XMM2 = 0x00000000000000000000000000000000 | XMM3 = 0x00000000000000000000000000000000 | +----------------------------------------+----------------------------------------+ | XMM4 = 0x00000000000000000000000000000000 | XMM5 = 0x00000000000000000000000000000000 | +----------------------------------------+----------------------------------------+ | XMM6 = 0x00000000000000000000000000000000 | XMM7 = 0x00000000000000000000000000000000 | +----------------------------------------+----------------------------------------+ ``` ### Modify Register (SetRegister) Used to modify the value of a specified register. It works by calling the `GetThreadContext` function to get the context structure of the current thread, modifying the value of the specified register, then calling the `SetThreadContext` function to set the modified context back to the thread. Supports modifying general-purpose registers, instruction pointer, and debug registers (DR0-DR3, DR6-DR7). **Syntax** `SetRegister --reg --value ` **Parameter Description** - `--reg`: Specify the name of the register to modify (supported: eax, ebx, ecx, edx, esi, edi, esp, ebp, eip, dr0, dr1, dr2, dr3, dr6, dr7) - `--value`: Specify the new value for the register, can be decimal or hexadecimal (prefixed with 0x) **Supported Registers for Modification** | Register | Full Name | Description | |--------|------|------| | EAX | Accumulator | Accumulator, used for arithmetic operations and function return values | | EBX | Base | Base register, commonly used for storing data pointers | | ECX | Counter | Counter register, commonly used for loop counting | | EDX | Data | Data register, commonly used for multiplication and division operations | | ESP | Stack Pointer | Stack pointer, points to the current top of the stack | | EBP | Base Pointer | Base pointer, points to the current stack frame base | | ESI | Source Index | Source index register, commonly used for string operations | | EDI | Destination Index | Destination index register, commonly used for string operations | | EIP | Instruction Pointer | Instruction pointer, points to the next instruction to be executed | | DR0 | Debug Register 0 | Debug register 0, used for hardware breakpoint address | | DR1 | Debug Register 1 | Debug register 1, used for hardware breakpoint address | | DR2 | Debug Register 2 | Debug register 2, used for hardware breakpoint address | | DR3 | Debug Register 3 | Debug register 3, used for hardware breakpoint address | | DR6 | Debug Status Register | Debug status register, records breakpoint trigger status | | DR7 | Debug Control Register | Debug control register, controls hardware breakpoint enablement and type | **Example** ```bash [ 0x771AE9C6 ] # SetRegister --reg eax --value 10 [+] Register eax has been modified to 0x0000000A [ 0x771AE9C6 ] # Register [General Purpose Registers] +----------------+----------------+----------------+----------------+ | EAX = 0x0000000A | EBX = 0x00000010 | ECX = 0x66EC0000 | EDX = 0x00000000 | +----------------+----------------+----------------+----------------+ | ESI = 0x006C2040 | EDI = 0x00315000 | ESP = 0x0019FA24 | EBP = 0x0019FA50 | +----------------+----------------+----------------+----------------+ ``` ### View Memory (Memory) Used to view the memory content at a specified address in the target process, displayed in both hexadecimal and ASCII formats. It works by calling the `ReadProcessMemory` function to read memory data of the specified length from the target process's virtual address space, then displaying it in both hexadecimal and ASCII formats. **Syntax** `Memory --address
[--size ]` **Parameter Description** - `--address`: Specify the memory address to view, supports hexadecimal (prefixed with 0x) or decimal - `--size`: Optional parameter, specify the memory length to view (bytes), default value is 0x40 (64 bytes) **Output Field Description** - `Address`: Memory address - `Hex Data`: Hexadecimal representation of 16 bytes per line, with the first 8 and last 8 separated by a space - `ASCII`: ASCII character representation of memory data, non-printable characters shown as `.` **Example** ```bash [ 0x771AE9C6 ] # Memory --address 0x771AE9C6 --size 40 Memory data (0x771AE9C6, Length: 0x28): +----------------+-------------------------------------------------+----------------+ | Address | Hex Data | ASCII | +----------------+-------------------------------------------------+----------------+ | 0x771AE9C6 | CC EB 07 33 C0 40 C3 8B 65 E8 C7 45 FC FE FF FF | ...3.@..e..E.... | | 0x771AE9D6 | FF E8 E1 72 FD FF C3 64 A1 30 00 00 00 33 C9 89 | ...r...d.0...3.. | | 0x771AE9E6 | 0D 34 16 22 77 89 0D 38 | .4."w..8 | +----------------+-------------------------------------------------+----------------+ [ 0x771AE9C6 ] # ``` ### View Stack (Stack) Used to view the stack content of the current thread, displayed downward from the current ESP (stack pointer) address. It works by first getting the ESP (stack pointer) value of the current thread through `GetThreadContext`, then using ESP as the starting address to call `ReadProcessMemory` to read the specified number of stack memory data from the target process, with each stack entry being 4 bytes (DWORD). **Syntax** `Stack [--count ]` **Parameter Description** - `--count`: Optional parameter, specify the number of stack entries to display, each entry is 4 bytes (one DWORD), default value is 20 **Output Field Description** - `Address`: Stack memory address - `Content`: 32-bit value (DWORD) at that address **Example** ```bash [ 0x771AE9C6 ] # Stack --count 10 Stack information (ESP = 0x0019FA24): +----------------+----------------+ | Address | Content | +----------------+----------------+ | 0x0019FA24 | 0xD724CDBC | | 0x0019FA28 | 0x00315000 | | 0x0019FA2C | 0x006C2040 | | 0x0019FA30 | 0x00000010 | | 0x0019FA34 | 0x00000001 | | 0x0019FA38 | 0x0019FA24 | | 0x0019FA3C | 0x0019FA4C | | 0x0019FA40 | 0x0019FC9C | | 0x0019FA44 | 0x77179C70 | | 0x0019FA48 | 0xA01DB81C | +----------------+----------------+ ``` ### Modify Memory (SetMemory) Used to modify the value at a specified memory address in the target process, modifying 4 bytes (one DWORD) at a time. It works by calling the `WriteProcessMemory` function to write 4 bytes (one DWORD) of data to the target process's virtual address space. Note: Modifying memory may cause the target process to crash or behave abnormally, use with caution. **Syntax** `SetMemory --address
--value ` **Parameter Description** - `--address`: Specify the memory address to modify, supports hexadecimal (prefixed with 0x) or decimal - `--value`: Specify the new value to write, supports hexadecimal (prefixed with 0x) or decimal **Example** ```bash [ 0x771AE9C6 ] # SetMemory --address 0x0019FA28 --value 10 [+] Memory 0x0019FA28 has been modified to 0x0000000A [ 0x771AE9C6 ] # Stack --count 10 Stack information (ESP = 0x0019FA24): +----------------+----------------+ | Address | Content | +----------------+----------------+ | 0x0019FA24 | 0xD724CDBC | | 0x0019FA28 | 0x0000000A | | 0x0019FA2C | 0x006C2040 | | 0x0019FA30 | 0x00000010 | | 0x0019FA34 | 0x00000001 | | 0x0019FA38 | 0x0019FA24 | | 0x0019FA3C | 0x0019FA4C | | 0x0019FA40 | 0x0019FC9C | | 0x0019FA44 | 0x77179C70 | | 0x0019FA48 | 0xA01DB81C | +----------------+----------------+ ``` ### Software Breakpoint (SetBreakPoint / DelBreakPoint / ShowBreakPoint) Software breakpoints are implemented by writing `0xCC` (INT3 instruction) at the specified memory address. When the CPU executes this instruction, it triggers a breakpoint exception. Write `0xCC` (INT3 instruction) at the target address and save the original byte; when the breakpoint triggers, restore the original byte and execute; after execution, rewrite `0xCC` to keep the breakpoint active (unless it's a temporary breakpoint). This is the most commonly used and simplest type of breakpoint. **Command List** | Command | Syntax | Description | |------|------|------| | `SetBreakPoint` | `SetBreakPoint --address
[--thread ] [--temp]` | Set software breakpoint | | `DelBreakPoint` | `DelBreakPoint --address
` | Delete software breakpoint | | `ShowBreakPoint` | `ShowBreakPoint` | Show all set software breakpoints | **Parameter Description** - `--address`: Specify the breakpoint address, supports hexadecimal (prefixed with 0x) or decimal - `--thread`: Optional parameter, specify that the breakpoint only takes effect for a specific thread, thread ID 0 means all threads - `--temp`: Optional parameter, set a temporary breakpoint that is automatically deleted after triggering once **ShowBreakPoint Output Field Description** - `ID`: Breakpoint number - `Address`: Breakpoint address - `Code`: Original byte (instruction byte before being overwritten by `0xCC`) - `Temporary`: Whether it is a temporary breakpoint (True means yes, False means no) - `Thread`: Bound thread ID (0 means all threads) **Example** ```bash [ 0x771AE9C6 ] # SetBreakPoint --address 0x771AE9C6 [+] Software breakpoint set: 771AE9C6 (Thread: 0) [ 0x771AE9C6 ] # ShowBreakPoint +----+----------------+--------+----------+--------+ | ID | Address | Code | Temporary| Thread | +----+----------------+--------+----------+--------+ | 1 | 0x771AE9C6 | 0xCC | False | 0 | +----+----------------+--------+----------+--------+ [ 0x771AE9C6 ] # [ 0x771AE9C6 ] # DelBreakPoint --address 0x771AE9C6 [-] Software breakpoint cleared: 771AE9C6 ``` ### Memory Breakpoint (SetMemBreakPoint / DelMemBreakPoint / ShowMemBreakPoint) Memory breakpoints are implemented by modifying the protection attributes of memory pages. When the target memory page is accessed (read, write, or execute), an access violation exception is triggered. Memory breakpoints are page-based (usually 4KB), suitable for monitoring access to specific memory regions. Use `VirtualProtectEx` to modify the protection attribute of the target memory page (e.g., set to inaccessible), save the original protection attribute; when an access violation exception is triggered, restore the original protection attribute; memory breakpoints are automatically deleted after triggering. **Command List** | Command | Syntax | Description | |------|------|------| | `SetMemBreakPoint` | `SetMemBreakPoint --address
--flag ` | Set memory breakpoint | | `DelMemBreakPoint` | `DelMemBreakPoint --address
` | Delete memory breakpoint | | `ShowMemBreakPoint` | `ShowMemBreakPoint` | Show all set memory breakpoints | **Parameter Description** - `--address`: Specify the memory address to monitor, the breakpoint will automatically align to the start address of the memory page - `--flag`: Specify the access type to monitor, optional values: - `r`: Read access breakpoint (set page as inaccessible) - `w`: Write access breakpoint (set page as read-only) - `e`: Execute access breakpoint (set page as read-write) **Example** ```bash [ 0x771AE9C6 ] # SetMemBreakPoint --address 0x771AE9C6 --flag w [+] Memory breakpoint set: 0x771AE000 (Type: w) [ 0x771AE9C6 ] # [ 0x771AE9C6 ] # SetMemBreakPoint --address 0x771AE9C6 --flag r [-] Memory page 0x771AE000 already has a breakpoint ``` ### Hardware Breakpoint (SetHbreakPoint / DelHbreakPoint / ShowHbreakPoint) Hardware breakpoints are implemented using the CPU's debug registers (DR0-DR3), enabling breakpoints by setting the DR7 control register. Hardware breakpoints do not modify the target program's memory, suitable for scenarios where memory cannot be modified (e.g., code is protected or verified). Write the breakpoint address to DR0-DR3 debug registers, set the breakpoint type (read, write, execute) and length through DR7; when a hardware breakpoint triggers, the CPU generates a single-step exception. **Command List** | Command | Syntax | Description | |------|------|------| | `SetHbreakPoint` | `SetHbreakPoint --address
--len <1\|2\|4> --flag ` | Set hardware breakpoint | | `DelHbreakPoint` | `DelHbreakPoint [--dr <0-3>]` | Delete hardware breakpoint (deletes all by default) | | `ShowHbreakPoint` | `ShowHbreakPoint` | Show all set hardware breakpoints | **Parameter Description** - `--address`: Specify the breakpoint address, read/write breakpoint addresses are automatically aligned according to length - `--len`: Specify the monitoring length of the breakpoint, optional values: 1, 2, 4 bytes - `--flag`: Specify the access type to monitor, optional values: - `r`: Read access breakpoint - `w`: Write access breakpoint - `e`: Execute access breakpoint - `--dr`: Specify the debug register number (0-3) to delete, if not specified, delete all hardware breakpoints **Limitations** - Maximum 4 hardware breakpoints supported (DR0-DR3) - Read/write breakpoint addresses must be aligned according to length (1 byte no alignment, 2 bytes even address alignment, 4 bytes 4-byte alignment) - Hardware breakpoints are automatically deleted after triggering **ShowHbreakPoint Output Field Description** - `DR`: Debug register number (0-3) - `Address`: Breakpoint address - `Type`: Breakpoint type (r/w/e) - `Length`: Monitoring length (bytes) - `Enabled`: Whether enabled **Example** ```bash [ 0x771AE9C6 ] # SetHbreakPoint --address 0x7781819C --len 4 --flag w [+] Hardware breakpoint set: DR0: 0x7781819C (Type: w, Length: 4 bytes) [ 0x771AE9C6 ] # SetHbreakPoint --address 0x778181AA --len 4 --flag r [+] Hardware breakpoint set: DR1: 0x778181A8 (Type: r, Length: 4 bytes) [ 0x771AE9C6 ] # SetHbreakPoint --address 0x778181CC --len 4 --flag e [+] Hardware breakpoint set: DR2: 0x778181CC (Type: e, Length: 4 bytes) [ 0x771AE9C6 ] # [ 0x771AE9C6 ] # ShowHbreakPoint +----+----------------+--------+--------+----------+ | DR | Address | Type | Length | Enabled | +----+----------------+--------+--------+----------+ | 0 | 0x7781819C | w | 4 | True | | 1 | 0x778181A8 | r | 4 | True | | 2 | 0x778181CC | e | 4 | True | +----+----------------+--------+--------+----------+ ``` ### Step Over (StepOut) Used to execute the current instruction and skip function calls. If the current instruction is a `call`, `jmp`, or other jump instruction, the debugger sets a temporary breakpoint at the target address; otherwise, it sets the TF (Trap Flag) flag to implement single-step execution. Disassemble the current instruction, if it is a `call`, `jmp`, or other jump instruction, set a temporary breakpoint at the target address (current address + instruction length); if it is a normal instruction, set the TF flag bit of EFLAGS, and the CPU generates a single-step exception after executing one instruction. **Syntax** `StepOut` **Example** ```bash [ 0x771AE9C6 ] # StepOut [-] Unknown software breakpoint exception: 0x80000003 [+] Single-step execution completed: 0x771AE9D0 [ 0x771AE9D0 ] # StepIn [+] Single-step execution completed: 0x771AE9D7 ``` ### Step Into (StepIn) Used to execute the next instruction regardless of instruction type. Implemented by setting the TF (Trap Flag) flag bit of EFLAGS, the CPU generates a single-step exception after executing one instruction. Set the TF flag bit (bit 8) of EFLAGS, the CPU automatically generates an `EXCEPTION_SINGLE_STEP` exception after executing the next instruction, and the debugger pauses execution after catching this exception. **Syntax** `StepIn` **Difference from StepOut** - `StepIn`: Always executes one instruction step by step, if it is a `call` instruction, it enters the called function - `StepOut`: Intelligently judges, skips if it is a jump instruction, otherwise executes step by step **Example** ```bash [ 0x771AE9D0 ] # StepIn [+] Single-step execution completed: 0x771AE9D7 ``` ### Continue Execution (Run) Used to resume normal execution of the target program until the next breakpoint is encountered or the program ends. Restore all software breakpoints (rewrite `0xCC`), then call `ContinueDebugEvent` to resume target program execution. **Syntax** `Run` **Example** ```bash [ 0x771AE9D7 ] # Run [*] DLL loaded: Base address = 0x76610000, Path = C:\Windows\System32\RPCRT4.dll [*] DLL loaded: Base address = 0x74700000, Path = C:\Windows\System32\SspiCli.dll [*] DLL loaded: Base address = 0x746F0000, Path = C:\Windows\System32\CRYPTBASE.dll ``` ### Disassembly (Dissasembler) Used to disassemble code at a specified address in the target process, displaying machine code and corresponding assembly instructions. Temporarily remove software breakpoints (restore original bytes), read memory data from the target process, use the Capstone disassembly engine to disassemble, and finally restore software breakpoints. **Syntax** `Dissasembler [--address
] [--size ]` **Parameter Description** - `--address`: Optional parameter, specify the starting address for disassembly, defaults to the current EIP value - `--size`: Optional parameter, specify the number of instructions to disassemble, default value is 10 **Output Field Description** - `Address`: Instruction address - `Machine Code`: Hexadecimal representation of the instruction - `Assembly Instruction`: Corresponding x86 assembly instruction **Example** ```bash [ 0x771AE9D0 ] # Dissasembler --size 15 Disassembly (Start address: 0x771AE9D0): +----------------+---------------------------------+------------------------------+ | Address | Machine Code | Assembly Instruction | +----------------+---------------------------------+------------------------------+ | 0x771AE9D0 | C7 45 FC FE FF FF FF | mov dword ptr [ebp - 4], 0xfffffffe | | 0x771AE9D7 | E8 E1 72 FD FF | call 0x77185cbd | | 0x771AE9DC | C3 | ret | | 0x771AE9DD | 64 A1 30 00 00 00 | mov eax, dword ptr fs:[0x30] | | 0x771AE9E3 | 33 C9 | xor ecx, ecx | | 0x771AE9E5 | 89 0D 34 16 22 77 | mov dword ptr [0x77221634], ecx | | 0x771AE9EB | 89 0D 38 16 22 77 | mov dword ptr [0x77221638], ecx | | 0x771AE9F1 | 88 08 | mov byte ptr [eax], cl | | 0x771AE9F3 | 38 48 02 | cmp byte ptr [eax + 2], cl | | 0x771AE9F6 | 74 05 | je 0x771ae9fd | | 0x771AE9F8 | E8 9E FF FF FF | call 0x771ae99b | | 0x771AE9FD | 33 C0 | xor eax, eax | | 0x771AE9FF | C3 | ret | | 0x771AEA00 | 8B FF | mov edi, edi | | 0x771AEA02 | 55 | push ebp | +----------------+---------------------------------+------------------------------+ [ 0x771AE9D0 ] # [ 0x771AE9D0 ] # StepOut [+] Single-step execution completed: 0x771AE9D7 [ 0x771AE9D7 ] # Dissasembler --size 15 Disassembly (Start address: 0x771AE9D7): +----------------+---------------------------------+------------------------------+ | Address | Machine Code | Assembly Instruction | +----------------+---------------------------------+------------------------------+ | 0x771AE9D7 | E8 E1 72 FD FF | call 0x77185cbd | | 0x771AE9DC | C3 | ret | | 0x771AE9DD | 64 A1 30 00 00 00 | mov eax, dword ptr fs:[0x30] | | 0x771AE9E3 | 33 C9 | xor ecx, ecx | | 0x771AE9E5 | 89 0D 34 16 22 77 | mov dword ptr [0x77221634], ecx | | 0x771AE9EB | 89 0D 38 16 22 77 | mov dword ptr [0x77221638], ecx | | 0x771AE9F1 | 88 08 | mov byte ptr [eax], cl | | 0x771AE9F3 | 38 48 02 | cmp byte ptr [eax + 2], cl | | 0x771AE9F6 | 74 05 | je 0x771ae9fd | | 0x771AE9F8 | E8 9E FF FF FF | call 0x771ae99b | | 0x771AE9FD | 33 C0 | xor eax, eax | | 0x771AE9FF | C3 | ret | | 0x771AEA00 | 8B FF | mov edi, edi | | 0x771AEA02 | 55 | push ebp | | 0x771AEA03 | 8B EC | mov ebp, esp | +----------------+---------------------------------+------------------------------+ [ 0x771AE9D7 ] # ```