|
[Nanomite] x64/x86 debugger - GUI and Class
Hey all,
Nanomite is a graphical debugger I wrote in Cpp and supports x64, x86 and WOW64 debugging and also offers different features ( shown in Pictures below). It uses the windows debugging api, beaengine and dbghelp. No GUI framework has been used! The x64 version of the debugger can debug x64 and WOW64 and the x86 only x86. If you are debugging multiple processes ( child processes of the main application) you can select the process for each action over a drop down menu which appears when you click a button in the main gui. In the most windows the data is sorted by the Process ID. Currently no data modification is possible (like memory, opcodes, regs or something else) but its something that will come! Of course there is a lot of work to be done and the GUI is just ugly but maybe some of you want to help and commit code and YES its fully open source for all ;). Issues ( I already have a lot known ones) will be fixed as soon as I have time. Also I will write a manual for the GUI and the class ( see below ) to cover "how to use, how does it work and is it able to" questions. You can download the binarys from the git repro (Nanomite.exe, dbghelp.dll and NanomiteConfig.ini are needed if you want to test the Debugger): Quote:
also I want to offer you a class I wrote in Cpp. This class offers different features for debugging and supports x64, x86 and WOW64 debugging and is the core of Nanomite. If you want me to add some features or find bugs than reply here or write me an email / pm. If you need a sample how to use it than you can take a look at : Quote:
Greetz Zer0Flag The Author will be with us soon . |
Code:
beta 7Greetz Zer0Flag |
1 Attachment(s)
Hi Zer0Flag :
Did u try notepad !!! . it crash . check the dumped files Thanks for ur nice work . |
Thanks, it was a bug in the import parser. Is fixed and will be pushed with beta8 :)
~Zer0Flag |
Code:
beta 8 |
3 Attachment(s)
pls check it
|
Hi Zer0Flag
see the attachment in this page http://forum.exetools.com/showpost.php?p=83583&postcount=53 pls check F7 + F8 ,it not work in some steps thanks |
Thanks for your effort! I will take a look at it and try to fix it in the next beta :)
~0 |
Code:
Version 0.1 beta 9 |
wonderful
thanks |
Code:
Version 0.1 beta 10 |
Code:
beta 11 |
disassemble shows blank at all the time, rest thing are fine. string search shows useless string, ie. "This program must be run under Win32", also can't detect unicode strings, most pity is when double click on any srings can't follow in disassemble immediately.
|
What Version did you try - debug,release,win32,x64? Which target did you try to debug when the disassemble window stays empty?
~Zer0Flag |
debug english software are OK ,only debug Chinese software shows blank, assume language not compatible, how to reproduce this behaviour?
|
Hmm, could you send me this (chinese) fila via PM so I can take a look at it myself ?
|
Code:
Version 0.1 beta 12Regards Zer0Flag |
Some guys from exelab https://ssl.exelab.ru/f/index.php?action=vthread&forum=3&topic=20678#9 suspect EDI register is missing.
|
uch, Seems I forgot that one :-/ . Thanks for reporting! Will be fixed in the next version.
Regards Zer0Flag |
Code:
Version 0.1 beta 13 |
very good, now can debug chinese softwares.
|
Is there install available or have to download source from git and compile ourself?
|
there are binaries available in the debug\ and release\ folder on github.
|
You can use the files from "build" or build it yourself if you like.
Regards Zer0Flag |
hi Zer0Flag, thanks for great release.
I test it with some binary, however, some of them are ok, and some of them have problem and nanomite window show blank, here is screenshot http://i.imgur.com/u5t9WHc.png and here is binary -> http://www.uploadmb.com/dw.php?id=1375836485 virus total -> https://www.virustotal.com/en/file/be051b6498077ee0fbeca54417b41a98493ebde86b4f33754dc1512817025ab3/analysis/1375836673/ this binary is from lina151 rce toturial and why i can't upload file into attachment ? :confused: |
Quote:
|
Thanks for the feed back!
@shahril This is a known issue which is based on the disassembler. Sometimes it starts disassembling on the wrong offset ( neededoffset - 300 ) which is not always right. And then it doesn´t find the needed offset and stay empty. The disassembler will probably be reworked on the beta15. ~Zer0Flag |
@sharil
all binairies in lena151 tuts are 32 bits Work with ollydbg |
I did a little update of the disassembler engine and it fixed the problem which lead to the missing disassembly in this and some other cases.
Will be release with B14 on this Sunday (11.08.2013) http://i.imagebanana.com/img/nu9h6ohd/08082013193602.png ~Zer0Flag |
Code:
beta 14 |
Code:
###Version 0.1 beta 15 |
some useful suggestion for next version.
1. Current icons group is too ugly, maybe ture color icon is better for consider. 2. Can you add support font, size can change in each window, after change can save the changing, current size is too smaller, not good for viewing. 3. In disassemble window and in stack view window, when you use mouse to click and drag the scroll bar start scrolling, the scroll bar is not really at scrolling, only code are scrolling there, maybe is a bug? 4. Can you consider add support edit disassemble code immediately with keyboard shortcut key spacebar button or double click in that disassemble code, not use mouse right click and select edit instruction, after edit and can have undo feature with multi-times. also, when right click and select "edit instruction" can you consider quotes origianl byte or disassemble code, not blank input there. 5. When will you support jump line with red arrow in disassemble code like jnz, jle, jge, jnc, jmp and so on, gray color for not inactive jump, red color for active jump. If you use OllyDBG, you will know what I mean. 6. in disassemble window, when you use F8 start step over, you will see only offset are pink hyperlight colour there, but include OpCodes, Mnemonics, comments are not hyperlight lolour, may full line of pink colour is preferred, like when you click in disassemble code that line, full and long blue colour in that line are seleted, maybe you understand what is my meaning? 7. in CPU Registers window, OF,DF, TF,SF, ZF, AF, PF, ZF can��t change the 0 or 1 value for active jump or inactive jump immediately when use mouse double click in that value, consider for improvement for next version? 8. Can you consider add Information view window under disassemble window, and Data view window (hex dump), the same as OllyDBG, total five windows are list: (1) Disassemble window (2) CPU Register Window (3) Information Window (4) Data view window (5) Stack view window 9. Can you consider add search all strings for Ansi code and Unicode, and double click in that string can send to disassemble code immediately. 10. Something like push dword ptr fs:[00000000h], cmp eax, FFFFFFFEh test byte ptr [eax+04h], 66h I don��t know [00000000h] or FFFFFFFEh or eax+04h or 66h is IDA engine or OllyDBG engine or Bean Engine, can you consider use OllyDBG only? 11. load a exe most time are blank disassemble code there, but lillte time is fine, will you improve it for next version? 12. Can you consier add plugins API Socket? Maybe in the future, someone will develop some plugins to extend it feature more powerfully. 13. Can you consider add support theme, disassemble window background colour can edit and change, some like call, mov, test, xor, add and so on is already hyperlight colour, this is good, but support more will be better, or have a option to extend that people can add more by themselves. 14. breakpoint if possible can support like bp MessageBoxA/W in commandline box will be better. 15. Can you consider add bookmark feature, and consider add bookmark Window also, that user can save theirs�� booked mark there. 16. After more test, if I thought more furture need to be added, then I will suggest you again. 17. Thanks for develop this good and nice tool, hope it will become popular for Win x86 and Win x64 debugging and disassembler tool in the future and instead of OllyDBG. |
some useful suggestion for next version.
1. Current icons group is too ugly, maybe ture color icon is better for consider. 2. Can you add support font, size can change in each window, after change can save the changing, current size is too smaller, not good for viewing. 3. In disassemble window and in stack view window, when you use mouse to click and drag the scroll bar start scrolling, the scroll bar is not really at scrolling, only code are scrolling there, maybe is a bug? 4. Can you consider add support edit disassemble code immediately with keyboard shortcut key spacebar button or double click in that disassemble code, not use mouse right click and select edit instruction, after edit and can have undo feature with multi-times. also, when right click and select "edit instruction" can you consider quotes origianl byte or disassemble code, not blank input there. 5. When will you support jump line with red arrow in disassemble code like jnz, jle, jge, jnc, jmp and so on, gray color for not inactive jump, red color for active jump. If you use OllyDBG, you will know what I mean. 6. in disassemble window, when you use F8 start step over, you will see only offset are pink hyperlight colour there, but include OpCodes, Mnemonics, comments are not hyperlight lolour, may full line of pink colour is preferred, like when you click in disassemble code that line, full and long blue colour in that line are seleted, maybe you understand what is my meaning? 7. in CPU Registers window, OF,DF, TF,SF, ZF, AF, PF, ZF can��t change the 0 or 1 value for active jump or inactive jump immediately when use mouse double click in that value, consider for improvement for next version? 8. Can you consider add Information view window under disassemble window, and Data view window (hex dump), the same as OllyDBG, total five windows are list: (1) Disassemble window (2) CPU Register Window (3) Information Window (4) Data view window (5) Stack view window 9. Can you consider add search all strings for Ansi code and Unicode, and double click in that string can send to disassemble code immediately. 10. Something like push dword ptr fs:[00000000h], cmp eax, FFFFFFFEh test byte ptr [eax+04h], 66h I don��t know [00000000h] or FFFFFFFEh or eax+04h or 66h is IDA engine or OllyDBG engine or Bean Engine, can you consider use OllyDBG only? 11. load a exe most time are blank disassemble code there, but lillte time is fine, will you improve it for next version? 12. Can you consier add plugins API Socket? Maybe in the future, someone will develop some plugins to extend it feature more powerfully. 13. Can you consider add support theme, disassemble window background colour can edit and change, some like call, mov, test, xor, add and so on is already hyperlight colour, this is good, but support more will be better, or have a option to extend that people can add more by themselves. 14. breakpoint if possible can support like bp MessageBoxA/W in commandline box will be better. 15. Can you consider add bookmark feature, and consider add bookmark Window also, that user can save theirs�� booked mark there. 16. When you selete multi-line of MneMonics and copy it in disassemble window, it actually copied first line, not multi-line are copied, maybe a bug? 17. can you add support hex code search? Like shortcut key ��Ctrl + B�� in OllyDBG, If I want to search blank place to add some disassemble code and jump back, good for inline patching. 18. After more test, if I thought more furture need to be added, then I will suggest you again. 19. Thanks for develop this good and nice tool, hope it will become popular for Win x86 and Win x64 debugging and disassembler tool in the future and instead of OllyDBG. |
Hello, ZeroFlag. I just thought more, but due to can't edit old post, so I create with new suggestion here.
some useful suggestion for next version. 1. Current icons group is too ugly, maybe ture color icon is better for consider. 2. Can you add support font, size can change in each window, after change can save the changing, current size is too smaller, not good for viewing. 3. In disassemble window and in stack view window, when you use mouse to click and drag the scroll bar start scrolling, the scroll bar is not really at scrolling, only code are scrolling there, maybe is a bug? 4. Can you consider add support edit disassemble code immediately with keyboard shortcut key spacebar button or double click in that disassemble code, not use mouse right click and select edit instruction, after edit and can have undo feature with multi-times. also, when right click and select "edit instruction" can you consider quotes origianl byte or disassemble code, not blank input there. 5. When will you support jump line with red arrow in disassemble code like jnz, jle, jge, jnc, jmp and so on, gray color for not inactive jump, red color for active jump. If you use OllyDBG, you will know what I mean. 6. in disassemble window, when you use F8 start step over, you will see only offset are pink hyperlight colour there, but include OpCodes, Mnemonics, comments are not hyperlight lolour, may full line of pink colour is preferred, like when you click in disassemble code that line, full and long blue colour in that line are seleted, maybe you understand what is my meaning? 7. in CPU Registers window, OF,DF, TF,SF, ZF, AF, PF, ZF can��t change the 0 or 1 value for active jump or inactive jump immediately when use mouse double click in that value, consider for improvement for next version? 8. Can you consider add Information view window under disassemble window, and Data view window (hex dump), the same as OllyDBG, total five windows are list: (1) Disassemble window (2) CPU Register Window (3) Information Window (4) Data view window (5) Stack view window 9. Can you consider add search all strings for Ansi code and Unicode, and double click in that string can send to disassemble code immediately. 10. Something like push dword ptr fs:[00000000h], cmp eax, FFFFFFFEh test byte ptr [eax+04h], 66h I don��t know [00000000h] or FFFFFFFEh or eax+04h or 66h is IDA engine or OllyDBG engine or beaengine, can you consider use OllyDBG engine only? 11. load a exe most time are blank disassemble code there, but lillte time is fine, will you improve it for next version? 12. Can you consier add plugins API Socket? Maybe in the future, someone will develop some plugins to extend it feature more powerfully. 13. Can you consider add support theme, disassemble window background colour can edit and change, some like call, mov, test, xor, add and so on is already hyperlight colour, this is good, but support more will be better, or have a option to extend that people can add more by themselves. 14. breakpoint if possible can support like bp MessageBoxA/W in commandline box will be better. 15. Can you consider add bookmark feature, and consider add bookmark Window also, that user can save theirs�� booked mark there. 16. When you selete multi-line of MneMonics and copy it in disassemble window, it actually copied first line, not multi-line are copied, maybe is a bug? 17. can you add support hex code search? Like shortcut key ��Ctrl + B�� in OllyDBG, If I want to search blank place to add some disassemble code and jump back, good for inline patching. 18. in disassemble window, double click on comment must can edit and hit OK can save, for easy and quick debugging purpose. 19. Current version can��t debugging *.dll file, only *.exe file, will you consider add for support debugging *.dll file in the next version. 20. Recent file will be deleted afer exit Nanomite, I don��t know is a bug or not, maybe cause Win Vista / Win 7 UAC? can you consider add a option for it can save or delete all recent files choice by user? 21. After more test, if I thought more furture need to be added, then I will suggest to you again. 22. Thanks for develop this good and nice tool, hope it will become popular for Win x86 and Win x64 debugging and disassembler tool in the future and instead of OllyDBG. 23. For sometimes debugging some exe file comes blank disassemble code, I don��t know is it possible because Delphi 7 Programs or due to some strong packer like VMProtect, here I just attach some software for you to test it out. Download it: _http://pan.baidu.com/share/link?shareid=123269319&uk=386178158 |
thanks for nice stuff! Lets check if it is worth changing from windbg.
|
What is the latest version of this?
|
Quote:
|
Quote:
|
Quote:
i'll sens over some crash dumps sometime the next week, i suggest you do the same. |
Code:
beta 16 |
| All times are GMT +8. The time now is 00:43. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX