Reverse Engineeringdebuggerdisassemblerx86x86-64graphicalptracecapstone

edb-debugger

edb is a graphical cross-platform x86/x86-64 debugger and disassembler for ELF binaries. It supports debugging on Linux with additional ports in development for other operating systems.

Description

edb (Evan's Debugger) is a modular and modern graphical debugger and disassembler for binary ELF files. Inspired by Ollydbg, it functions on x86 and x86-64 architectures across multiple OSes, with Linux as the only officially supported platform currently. It leverages the ptrace API for process interaction and the Capstone disassembly library for analysis.

Use cases include generating symbol maps for libraries, attaching to running processes by PID, and launching programs directly in the debugger with arguments. This makes it valuable for reverse engineering, malware analysis, and binary exploitation on Kali Linux systems. Symbol maps can be stored in edb's configured directory for reference during debugging sessions.

The tool is installed via apt and includes separate plugin packages for extended functionality. It is licensed under GPLv2 and actively maintained with bug reports handled via GitHub.

How It Works

edb operates as a graphical frontend using the ptrace API to control and inspect processes. It integrates the Capstone disassembly library for generating disassembly output and supports symbol map generation for ELF binaries. Plugins extend core functionality, relying on Qt5 for the user interface and dependencies like libcapstone for disassembly.

Installation

bash
sudo apt install edb-debugger

Flags

--helpShow usage and exit.
--symbols <file>generate symbols map for file <file>
--attach <pid>attach the process of PID <pid> to debugger
--run <program> [args...]open <program> in debugger with optional [args...]
--versionshow version string and exit.
--dump-versionshow version and exit.

Examples

Will generate symbols for libc and save it in a text file. It's useful if you store this map files in the symbols directory configured in edb's preferences.
edb --symbols /lib/libc.so.6 > libc.so.6.map
Useful to generate maps for all libs you have in /lib.
for i in $(ls /lib); do edb --symbols $i > $(basename $i).map; done
Will open the ls program binary in debugger.
edb --run /bin/ls
Attach the process of PID 1720 to debugger.
edb --attach 1720
Show usage and exit.
edb --help
Show version string and exit.
edb --version
Show version and exit.
edb --dump-version
Open /bin/ls in debugger with argument -l.
edb --run /bin/ls -l
Updated 2026-04-16kali.org ↗