PEBrowse Professional Interactive (v 7.32) is a debugger for Microsoft Windows 2000 and Windows XP.  (The program has not been tested on Windows 2003 Server and Vista, but it should work on those platforms.)

PEBrowse Professional Interactive builds upon the framework presented by PEBrowse Professional to create a very powerful, versatile, and customizable Win32 user mode debugger/disassembler.  PEBrowse Interactive is not a source code debugger, but operates at the Intel x86 instruction level and therefore at the lowest level where your program executes.  The debugger fully supports Microsoft .NET managed processes and seamlessly allows interop or mixed-mode debugging.  It can be set as the startup debugger using the system registry Image File Execution Options key - useful for debugging ASP.NET applications.

There is a large array of breakpoint opportunities, including:

    * process initialization
    * module load
    * thread startup
    * module exports

       

    * debug symbols
    * JITted (Just-In-Time) methods
    * user specified addresses

       

    * memory breakpoints
    * conditional breakpoints
    * one-time breakpoints

When a breakpoint fires or an exception in the process occurs, the interface provides easy access to full process context, including:

    * loaded modules
    * valid memory ranges
    * debug log messages
    * register values (including debug, floating-point, and segment registers)
    * stack addresses
    * disassembly at the breakpoint or exception address

       

    * virtually unlimited numbers of disassembly and memory displays
    * additional process information, including
          o thread information
          o kernel, USER32, GDI32 objects
          o critical sections
          o process environment
          o startup parameters

       

    * heap display
    * execution path summary
    * subroutine discovery
    * intermediate language disassembly (for .NET managed modules)

There are all of the usual debugging features, such as single-stepping, stepping into/over call statements, executing until a selected instruction, as well as running to the next branch instruction.  You can even add breakpoints on a specific IL statement in a .NET managed method.

Memory DWORD displays automatically indicate if the value is a valid memory address in the context of the debugged process and these values whenever possible resolve to symbolic names or important process regions, e.g., thread stacks, process heaps, and module sections.  The color-coded disassembly displays also attempt to use symbolic information as well as offering various highlighting options designed to allow easy analysis of the code.  There is even convenient access to a scratchpad, a calculator, and tables for hex-to-ASCII values, common Win32 error codes, and Windows message codes.  There are many more options available on each window by accessing the context-sensitive menu items (popups are present also).

Screenshot:



down:

http://www.smidgeonsoft.prohosting.com/pebrowse-pro-interactive-debugger.html

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)