Since the debugger works in user mode, it is of course vulnerable to a wide range of anti-debugging techniques. But it is actively developed and supported. Granted, it has its downsides as there are a number of annoying bugs. It supports both architectures (圆4 and x86), and there are tons of useful plugins. This is a modern debugger with a good user interface, a worthy successor of OllyDbg. The first debugger works in user mode, while the second one can debug kernel-mode code. The main candidates are 圆4dbg and WinDbg. You will need this every once in a while, especially if you want to look for zero-day vulnerabilities in OS kernels or reverse engineer malware in drivers. We must also be able to debug kernel-mode code. A modern debugger must support both Intel architectures (圆4 and x86), so this is the first prerequisite.

Neither the editorial team nor the author assumes any responsibility for possible harm that may arise from the use of these materials.ĭebugging an application is an essential part of studying it, so every reverse engineer needs a debugger at the ready.

This article is for information purposes only. However, an experienced reverse engineer must also be curious about what other crackers are using. It will be useful to anyone who has not yet collected their own toolset and is just starting to look into the subject.

Every reverse engineer, malware analyst or simply a researcher eventually collects a set of utility software that they use on a daily basis to analyze, unpack, and crack other software.

Pestudio tutorial