IDA pro, x64Dbg, olldbg & windbg are used to Reverse Engineering purposes (as a Dissembler) and debugging.
What are the main differences between each?
It's quite hard to give an answer that is not opinion-based. Trying to stay factual:
OllyDbg and x64Dbg falls roughly under the same category. Their main strength is debugging without symbolic information (although they can also do debugging with symbolic information). OllyDbg (closed source) hasn't been maintained since a long time now and is limited to x86 32-bit. On the other hand x64Dbg is actively maintained,open source and can handle x86 and x64. Both supports plugins.
Windbg is mainly a symbolic debugger (although obviously it works without any symbols). Being maintained by Microsoft it is very powerful when symbols are available. It supports plugins (in C or C++), scripting (it has its own scripting language but it also supports officially JavaScript and a third-party python scripts loader) .NET debugging and can do Kernel debugging (in this aspect it is the de facto Kernel debugger on Windows systems). In its latest version it also supports TTD (Time Travel Debugging).
IDA main strength is that it's an interactive disassembler. You can "interrogate" the binary (more precisely, the database generated from the binary) in many ways from python scripts. It also supports debugging by itself or through other engines (gdb or windbg engines for example).
IDA
has more toolset (swiss army knife)than others? –
Meanwhile © 2022 - 2024 — McMap. All rights reserved.