How yahel150/elf-analysis-and-debugging-tool works
xdbg is a Linux x86-64 ELF inspection and debugging tool. Users invoke analysis, disassembly, local debugging, or remote debugging through the CLI. Analysis maps an ELF file before reporting its headers, segments, sections, symbols, and security properties; decoding disassembles its text section and explains instructions. Debugging controls a target process with breakpoints, stepping, register and memory inspection, source mapping, and an optional TUI. Remote debugging relays commands between a client and a worker hosting the debugger. Some module wiring is inferred only from documented capabilities and filenames; unsampled implementation details are not asserted.
Main entry points: debugger.c Debugger session · main.c Command dispatcher · decode.c Text disassembly · remote_worker.c Remote worker
Components 29
CLI and analysis
- Command dispatcher
main.c - ELF mapping and lookup
elf/elf_parser.c - Section reporting
elf/elf_sections.c - Segment reporting
elf/elf_segments.c - Symbol reporting
elf/elf_symbols.c - Security analysis
elf/elf_security.c
Instruction decoding
- Text disassembly
decoder/decode.c - Opcode decoding
decoder/opcode.c - REX parsing
decoder/rex.c - ModR/M parsing
decoder/modrm.c - Immediate parsing
decoder/immediate.c - Instruction explanation
decoder/pretty_print.c
Local debugging
- Debugger session
debugger/debugger.c - Breakpoint control
debugger/breakpoint.c - Process memory
debugger/memory.c - Register access
debugger/registers.c - Execution stepping
debugger/singlestep.c - Signal handling
debugger/signals.c - Live GOT view
debugger/live_got.c - Source mapping
dwarf/source_map.c - Terminal interface
tui/tui.c
Remote debugging
- Remote command entry
remote/remote.c - Remote worker
remote/remote_worker.c - Remote client
remote/remote_client.c - Worker IPC
remote/remote_ipc.c - Network transport
remote/remote_net.c
Other components
- User
- ELF input
- Debug target
Connections 31
- User → Command dispatcher: runs command
- Command dispatcher → ELF mapping and lookup: opens ELF
- ELF input → ELF mapping and lookup: mapped input
- Command dispatcher → Security analysis: analyzes security
- Command dispatcher → Section reporting: prints sections
- Command dispatcher → Segment reporting: prints segments
- Command dispatcher → Symbol reporting: prints symbols
- Command dispatcher → Text disassembly: decodes text
- Text disassembly → ELF mapping and lookup: reads ELF data
- Text disassembly → REX parsing: parses prefixes
- Text disassembly → Opcode decoding: decodes opcode
- Text disassembly → ModR/M parsing: parses operands
- Text disassembly → Immediate parsing: reads immediates
- Text disassembly → Instruction explanation: formats explanation
- Command dispatcher → Debugger session: starts debugger
- Debug target → Debugger session: debugged by
- Debugger session → Breakpoint control: manages breakpoints
- Debugger session → Process memory: reads and writes
- Debugger session → Register access: reads registers
- Debugger session → Execution stepping: controls stepping
- Debugger session → Signal handling: handles signals
- Debugger session → Live GOT view: inspects GOT
- Debugger session → Source mapping: resolves source
- Debugger session → Terminal interface: renders interface
- Command dispatcher → Remote command entry: starts remote mode
- Remote command entry → Remote worker: runs worker
- Remote command entry → Remote client: runs client
- Remote worker → Debugger session: launches backend
- Remote worker → Worker IPC: exchanges events
- Remote worker → Network transport: serves connection
- Remote client → Network transport: connects and sends