Debugging Win32 Binaries in Ghidra via Wine | Hacker News Reader

Debugging Win32 Binaries in Ghidra via Wine

john-millikin.com

94 pointstodsacerdoti8 comments

Some impressive glue work to get this going.

I wonder if some of this the part about reading process info from /proc could be upstreamed into Ghidra?

The hack to get the Unix process ID from wine apps is also impressive, it feels like there should be an API for this, maybe wine could provide a mapping under /proc if launched with some parameter.

I can see this being useful for all sorts of things.

You may be interested in the discussion at <https://github.com/NationalSecurityAgency/ghidra/issues/4534>, especially the linked PR <https://github.com/NationalSecurityAgency/ghidra/pull/4546>.

Wouldn't it be easier to run WineGDB in gdb server mode using the --gdb option rather than building a windows version of gdbserver?

Hello, author here! Winedbg's built-in GDB server is more limited than gdbserver.exe -- importantly, the 'remote get' functionality isn't implemented.

  $ winedbg --gdb hello-win32.exe
  [...]
  Wine-gdb> info proc mappings
  Can't determine the current process's PID: you must name one.
  Wine-gdb> shell pidof hello-win32.exe
  1883212
  Wine-gdb> info proc mappings 1883212
  process 1883212
  warning: unable to open /proc file '/proc/1883212/maps'
  Wine-gdb> remote get /proc/1883212/maps /dev/stdout
  Remote I/O error: Function not implemented

Considering that gdbserver.exe is packaged for Ubuntu as gdb-mingw-w64-target, there's not many reasons to use Winedbg's GDB mode.

Interesting, yeah I did notice limitations in WineGDB before. I guess there's not much reason to use it unless there's something preventing you from running gdbserver.exe within wine.

Site is broken on Firefox mobile. Have to scroll left and right all the time to read a full line of text, screenshots are cut off by the menu to the right. Cannot zoom out, only in.

Friendly reminder:

“Please don’t complain about tangential annoyances—things like article or website formats, name collisions, or back-button breakage. They're too common to be interesting.”

https://news.ycombinator.com/newsguidelines.html

If you want to notify the author about the issue, they have listed their contact details in the article itself. (See the info-bar on the right-hand side.)

Similar issues here, I had success with an archive link though:

https://archive.ph/nok4g

Reply on news.ycombinator.com