https://github.com/keowu/koidbg

A debugger for Windows ARM64 (AARCH64), user-friendly for reverse engineers, malware analysts, malware developers, game hacking, operating system studies, and more.
https://github.com/keowu/koidbg

arm64 debugger engineering malware-analysis reverse windows

Last synced: about 1 year ago
JSON representation

A debugger for Windows ARM64 (AARCH64), user-friendly for reverse engineers, malware analysts, malware developers, game hacking, operating system studies, and more.

• Host: GitHub
• URL: https://github.com/keowu/koidbg
• Owner: keowu
• License: gpl-3.0
• Created: 2024-12-08T01:07:31.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2025-05-03T23:07:12.000Z (about 1 year ago)
• Last Synced: 2025-05-03T23:26:03.533Z (about 1 year ago)
• Topics: arm64, debugger, engineering, malware-analysis, reverse, windows
• Language: C++
• Homepage: https://keowu.re/posts/Writing-a-Windows-ARM64-Debugger-for-Reverse-Engineering-KoiDbg/
• Size: 16.1 MB
• Stars: 2
• Watchers: 0
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# KoiDbg - Windows ARM64 Debugger for Reverse Engineering

A debugger for Windows ARM64 (AARCH64), user-friendly for reverse engineers, malware analysts, malware developers, game hacking, operating system studies, and more.

#### Demo Video

https://github.com/user-attachments/assets/ef55c64f-4ae1-463c-b356-1d4c7bf4c6d6

#### Papper and Research Information

To fully understand how KoiDbg works, read our published article. It is available in English and Portuguese:

- [Writing a Windows ARM64 Debugger for Reverse Engineering - KoiDbg](https://keowu.re/posts/Writing-a-Windows-ARM64-Debugger-for-Reverse-Engineering-KoiDbg/)

- [Escrevendo um Debugger para Windows ARM64 com foco em Engenharia Reversa - KoiDbg](https://keowu.re/posts/Escrevendo-um-Debugger-para-Windows-ARM64-com-foco-em-Engenharia-Reversa-KoiDbg/)

#### Screenshots

Disassembler View:

![Disassembler View](imgs/repo/DisassemblerView.png)

Hardware & Software Interrupt:

![Hardware & Software Interrupt](imgs/repo/HardwareSoftwareInterrupt.png)

Call Stack:

![Call Stack](imgs/repo/CallStack.png)

Memory View:

![Memory View](imgs/repo/MemoryView.png)

Modules View:

![Modules View](imgs/repo/ModulesView.png)

Threads View:

![Threads View](imgs/repo/ThreadsView.png)

Handles View:

![Handles View](imgs/repo/HandlesView.png)

ProcessCallbacks View:

![ProcessCallbacks View](imgs/repo/ProcessCallbacksView.png)

PDB Inspector:

![PDB Inspector](imgs/repo/PDBInspector.png)

Hex View - Memory View:

![Hex View - Memory View](imgs/repo/HexViewMemoryView.png)

Console View:

![Console View](imgs/repo/ConsoleView.png)

Local Stack Symbols:

![Local Stack Symbols](imgs/repo/LocalStackSymbols.png)

**And much more!**

#### License

This project/research is licensed under the GNU General Public License v3.0.