What are the key differences between IDA and x64dbg? [closed]
Asked Answered
M

1

8

IDA pro, x64Dbg, olldbg & windbg are used to Reverse Engineering purposes (as a Dissembler) and debugging.

What are the main differences between each?

Meanwhile answered 16/11, 2017 at 16:35 Comment(1)
Notable other professional dissassembler/debuggers are Binary Ninja (not free) and Ghidra (open source)Atomics
S
12

It's quite hard to give an answer that is not opinion-based. Trying to stay factual:

  • OllyDbg and x64Dbg falls roughly under the same category. Their main strength is debugging without symbolic information (although they can also do debugging with symbolic information). OllyDbg (closed source) hasn't been maintained since a long time now and is limited to x86 32-bit. On the other hand x64Dbg is actively maintained,open source and can handle x86 and x64. Both supports plugins.

  • Windbg is mainly a symbolic debugger (although obviously it works without any symbols). Being maintained by Microsoft it is very powerful when symbols are available. It supports plugins (in C or C++), scripting (it has its own scripting language but it also supports officially JavaScript and a third-party python scripts loader) .NET debugging and can do Kernel debugging (in this aspect it is the de facto Kernel debugger on Windows systems). In its latest version it also supports TTD (Time Travel Debugging).

  • IDA main strength is that it's an interactive disassembler. You can "interrogate" the binary (more precisely, the database generated from the binary) in many ways from python scripts. It also supports debugging by itself or through other engines (gdb or windbg engines for example).

Striction answered 16/11, 2017 at 17:58 Comment(2)
@Neista thank you for the quick reply.Professionally IDA has more toolset (swiss army knife)than others?Meanwhile
@BuddhikaChaturanga When it comes to static analysis, IDA is the de facto tool. It has a plentiful API (in python) with which you can do a lot of stuffs. When it comes to debugging, I'd say (which makes this comment opinion-based) IDA is less prominent than specific and full-fledged debuggers.Striction

© 2022 - 2024 — McMap. All rights reserved.