Debugging? In short, Enable to seek program counter backward. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts ① ② ③ ④ Step back, Step back, Step back, Step back….. Reverse Need to restore %edi and %rbp to previous value. And also stack state.
qira uses QEMU for recording. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts [stack_addr] <= %rbp %rbp <= %rsp %edi <= [str_addr] Records per operations This approach is not suitable for radare2...
then replay from it. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Initial State Save Initial program state by ptrace(2) Replay until desired point It looks nice for r2 architecture!
Session”. You can use dts (debug trace session) command. dts List all trace sessions dts+/- Add/Delete trace session dtst/f [file] Read/Save trace session dtsC <id> <comment> Add comment for given trace session More detail. Let’s type “dts?” in your own r2 debugger console.
Initial program state by “dts+”. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Trace Session Save current program state by “dts+” Current PC
or continue as usual. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Current PC Go forward by dso, dc or dcu…. Trace Session
by “dsb” (debug step back) command. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Current PC Currently, pc is at 40053f and you want to step back to 40053a. Trace Session
program state to previous Trace Session. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Trace Session Restore state Current PC
seeks program counter backward until hit the breakpoint. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Current PC Trace Session one step back(dsb) continue back(dcb)
replaying time. Then, replayer can use nearest one. (very long operations) ……. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Current PC Trace Session Save sessions at replaying time Trace Session Trace Session checkpoint 1 checkpoint 2 checkpoint 3
in memory from a previous trace session. (like diff snapshot) (very long operations) ……. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Current PC Trace Session (base) Each session has only diff pages Trace Session (diff1) Trace Session (diff2) base session has entire dump only changed parts from base only changed parts from diff1
can also do reverse debugging for ESIL mode. What is ESIL? Evaluable Strings Intermediate Language sub rsp, 0x648 1608,rsp,-=,$c,cf,=,$z,zf,=,$s,sf,=,$o,of,= Application: Code Emulation, Decompile, VM Emulation….
can also reverse debugging for ESIL mode. 0x00400536 ebp,4,esp,-=,esp,=[4] 0x00400537 esp,ebp,= 0x0040053a 0x0040053f call sym.imp.puts Current PC Trace Session one step back(aesb) Architecture independent Reverse Debugging! Save current ESIL state by “aets+”
events.(like syscall results, signal….) (very long operations) ……. 0x00400536 push rbp 0x00400537 mov rbp, rsp 0x0040053a mov edi, str.Hello_World 0x0040053f call sym.imp.puts Current PC Trace Session These events should be replayed! Non deterministic events Signal Syscall result Timer