Cross-platform debugging and binary inspection framework written in D (BetterC).

alicedbg provides process debugging, binary format parsing, and disassembly under a unified API. It targets Windows, Linux, and FreeBSD on x86, x86-64, Armv7, and AArch64.

• Debugging -- spawn or attach to processes, set breakpoints, read/write memory, inspect threads and stack frames, handle exceptions via callbacks
• Object inspection -- parse 13 binary formats: ELF, PE, Mach-O, PDB, COFF, MS-COFF, AR, MZ, NE, LX, OMF, Minidump, DMP
• Disassembly -- multi-architecture disassembly via Capstone 4.0.2 (optional runtime dependency)
• Memory scanning -- pattern scanning over process memory
• Two API levels -- Easy API (high-level, multithreaded) and Multi API (direct, granular control)

Interactive debugger with a REPL shell.

$ alicedbg ./myapp
Process './easy-target' created
(adbg) go
*	Process 48239 stopped
	Reason  : ACCESS VIOLATION (11)
(adbg) 

Binary format dumper. Parses headers, sections, imports, exports, relocations, and debug info.

$ ./alicedump --headers /usr/bin/ls
filename                    : /usr/bin/ls
filesize                    : 142312
type                        : Executable and Linkable Format
id                          : elf

# Header
e_ident[0]                  : 0x7f	(\x7f)
e_ident[1]                  : 0x45	(E)
e_ident[2]                  : 0x4c	(L)
e_ident[3]                  : 0x46	(F)
e_ident[EI_CLASS]           : 2	(ELF64)
e_ident[EI_DATA]            : 1	(LSB)
e_ident[EI_VERSION]         : 1
e_ident[EI_OSABI]           : 0	(No ABI)
e_ident[EI_ABIVERSION]      : 0
e_ident[9]                  : 0
e_ident[10]                 : 0
e_ident[11]                 : 0
e_ident[12]                 : 0
e_ident[13]                 : 0
e_ident[14]                 : 0
e_ident[15]                 : 0
e_type                      : 3	(DYN)
e_machine                   : 62	(AMD x86-64)
e_version                   : 1
...

For an example using the Multi API, see examples/simple.d.

Requires DUB and a D compiler (DMD, LDC, or GDC).

dub build            # library
dub build :debugger  # alicedbg CLI
dub build :dumper    # alicedump CLI
dub test             # run tests

Build types:

dub build -b release         # optimized
dub build -b release-static  # statically linked
dub build -b trace           # verbose tracing

Disassembly requires Capstone 4.0.2 at runtime. Without it, all other functionality remains available.

Pre-1.0. APIs are unstable and change between releases.

Development happens on the marisa branch. The stable branch tracks the latest release.

Not currently accepting contributions, but feedback on features and bugs is welcome.

BSD-3-Clause-Clear