What are the key differences between IDA and x64dbg?

reverse-engineering windbg ida ollydbg
Buddhika Chaturanga picture Buddhika Chaturanga · Nov 16, 2017 · Viewed 9.4k times · Source

IDA pro ,x64Dbg, olldbg & windbg are used to Reverse Engineering purposes(as a Dissembler) and debugging.

  • What are the main differences among them? when to use each?

Answer

Neitsa picture Neitsa · Nov 16, 2017

It's quite hard to give an answer that is not opinion-based. Trying to stay factual:

  • OllyDbg and x64Dbg falls roughly under the same category. Their main strength is debugging without symbolic information (although they can also do debugging with symbolic information). OllyDbg (closed source) hasn't been maintained since a long time now and is limited to x86 32-bit. On the other hand x64Dbg is actively maintained,open source and can handle x86 and x64. Both supports plugins.

  • Windbg is mainly a symbolic debugger (although obviously it works without any symbols). Being maintained by Microsoft it is very powerful when symbols are available. It supports plugins (in C or C++), scripting (it has its own scripting language but it also supports officially JavaScript and a third-party python scripts loader) .NET debugging and can do Kernel debugging (in this aspect it is the de facto Kernel debugger on Windows systems). In its latest version it also supports TTD (Time Travel Debugging).

  • IDA main strength is that it's an interactive disassembler. You can "interrogate" the binary (more precisely, the database generated from the binary) in many ways from python scripts. It also supports debugging by itself or through other engines (gdb or windbg engines for example).

Related questions

How can I find the data structure that represents mine layout of Minesweeper in memory?

I'm trying to learn about reverse engineering, using Minesweeper as a sample application. I've found this MSDN article on a simple WinDbg command that reveals all the mines but it is old, is not explained in any detail and really …

Read More
List of all index & index columns in SQL Server DB

How do I get a list of all index & index columns in SQL Server 2005+? The closest I could get is: select s.name, t.name, i.name, c.name from sys.tables t inner join sys.schemas s on …

Read More
decompiling DEX into Java sourcecode

How can one decompile Android DEX (VM bytecode) files into corresponding Java sourcecode?

Read More