Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dwarf data from PE files is not read in #822

Open
besentv opened this issue Aug 8, 2022 · 3 comments
Open

Dwarf data from PE files is not read in #822

besentv opened this issue Aug 8, 2022 · 3 comments

Comments

@besentv
Copy link

besentv commented Aug 8, 2022

I tried to debug a program running in Wine with dwarf debug symbols, but edb doesn't seem to be able to read them from the Win-PE file format.

The highlighted row should show something along the lines of "<win32u.dll!FooBar+0>"
image

To reproduce, just compile Wine in MinGW mode (for symbols) https://wiki.winehq.org/Building_Wine, run a Windows program, and attach to it.

@10110111
Copy link
Contributor

10110111 commented Aug 8, 2022

AFAICT, EDB doesn't support PE symbols at all, only ELF support is implemented. And Wine DLLs is yet another thing to add support for (since DLLs are not native on Linux).

But, since you are analyzing a Windows program, you might be better off with a Windows debugger like OllyDbg or x64dbg run via Wine. I had used OllyDbg via Wine, and it did work.

@besentv
Copy link
Author

besentv commented Aug 8, 2022

The problem with either OllyDbg or x64dbg is, that you cannot debug the Unix side. Another issue is debugging programs with builtin DRM. They're usually very annoying on the PE side, as they like to kill off the whole program when they detect a debugger, but are pretty useless when you're debugging the Windows program as a Unix process, as they can't really see a debugger anymore. Many Wine/Proton developers usually use gdb to debug Wine, just because of these two facts. So having PE symbols would be very cool to have, as edb has a much better interface than gdb. :)

@eteran
Copy link
Owner

eteran commented Aug 16, 2022

Interesting. As @10110111 said, there is no built in PE support of any kind in EDB. I of course like the idea of being able to debug Windows binaries via wine... but we've definitely got some work to do to support it.

We'll see what we can do, but sadly can't make any promises yet.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants