The Debugger is a collection of plugins comprising Ghidra's Dynamic Analysis Framework. This includes a platform for connecting to and controlling debuggers. Ghidra is not a debugger in itself, but rather, it relies on existing 3rd-party debuggers, their APIs, wire protocols, and/or command-line interfaces. Such connectors are pluggable, allowing Ghidra to be extended and integrated with additional debuggers.
When Ghidra recognizes the platform of a target in a connected debugger, it can record that target into a local database and display the target state. Without recording, the UI will at least allow interaction through a generic model and/or the debugger's command-line interface. The recording, called a Trace in Ghidra, logs all the observations made by the framework or the user. The user can rewind this recording at any point and the UI will recall those observations, displaying the recorded machine state instead of the present machine state. These traces can also be saved, loaded, and analyzed after a target has terminated or been disconnected. Furthermore, they can be committed to a Ghidra Server for sharing and revision control; however, conflicting changes cannot be merged.
A system of mappings, which is usually populated automatically, tracks the relationship of imported Ghidra programs to modules recorded in a trace. By default, Ghidra will synchronize the cursor in the dynamic listing with that in the static listing, and encourage the user to import missing modules. In this way, existing static analysis is readily at hand during a dynamic analysis session, and the user can further populate program databases during a debugging session. However, target memories contain more spaces than program images, e.g., stack and heap space, and some of those spaces are modified at runtime, e.g., .bss or .data. This information, if observed, is dutifully recorded into the trace for immediate or offline analysis.
A variety of plugins allow the user to interact with the target directly, view and manipulate machine state, set breakpoints, view recordings, etc. See the table of contents for a comprehensive list of current plugins. Plugins generally fall into one of these categories:
This package is already enabled in the default "Debugger" tool. You may need to import the tool using the
menu from Ghidra's project window. You may also add the package to an existing tool using the menu from your tool window and selecting "Debugger."