PAGES
← all tools
◆ Reverse Engineering

edb-debugger

1.5.0 open-source

edb-debugger is a cross platform AArch32/x86/x86-64 debugger for Linux, with ports underway for FreeBSD, OpenBSD, OSX, and Windows.

Summary

edb-debugger is an open-source debugger for reverse engineering x86, x86-64, and AArch32 binaries, distributed under GPL 2, so it costs nothing to use. It runs as a desktop application with a Qt-based GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands., and while ports for other Unix-like systems and Windows are in progress, Linux is the only officially supported platform. It's aimed at reverse engineers and binary analysts who need to step through and inspect native code rather than manage source. Its README describes it as inspired by OllyDbg, positioning it as a Linux-native counterpart to that Windows tool. The project traces back to 2011 and has drawn 45 contributors, with commits in the past year, though its last formal release was well over two years ago.

edb-debugger is a cross platform AArch32/x86/x86-64 debugger for Linux, with ports underway for FreeBSD, OpenBSD, OSX, and Windows.

How edb-debugger helps

What is this native binary actually doing when it hits this crash?

steps through the disassembly instruction by instruction, showing register and stack state at the point of failure so you can see the exact code path that led there

Where in the code does this program branch based on a value I control?

sets breakpoints on execution and lets you inspect registers and memory live, so you can trace which comparisons and jumps depend on your input

What is stored at this address right before the program misbehaves?

shows a live memory view keyed to the current instruction pointer, so you can watch values change as execution proceeds toward the fault

Which instruction is responsible for corrupting this register or pointer?

lets you set breakpoints and single-step through the surrounding code, comparing register contents before and after each instruction to isolate the culprit

Can I change a value mid-execution to see how the program reacts?

lets you edit registers and memory directly while the process is paused, then resume execution to observe the effect

all 32 features, with the evidence for each →

Languages

Not documented

Features

32 capabilities

Built from edb-debugger's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What edb-debugger offers you

  • Plugin API support3
  • Command-line interface1
  • Plugin system1
  • Scripting API1
All capabilities 32 capabilities
Cross-platform debugger shipped A debugger for Linux supporting AArch32, x86, and x86-64 architectures, inspired by OllyDbg. 10 releases · 1 other source · first seen Nov 2006

release 10 total

  • Adds OpenBSD platform support allowing the debugger to compile and attach 2010-10-10 · Oct 2010 · source · release history
  • Adds push and pop operations directly to the stack context menu 2006-12-16 · Dec 2006 · source · release history
  • Adds a tooltip in the disassembly view showing all instruction bytes when instruction length exceeds display capacity 2006-12-16 · Dec 2006 · source · release history
  • Enables automatic display of ASCII strings next to registers when analysis detects a pointer to an ASCII string 2006-12-16 · Dec 2006 · source · release history
  • step over now handles REP prefixed operations 2006-11-30 · Nov 2006 · source · release history
  • Added ability to choose bytes per word and words per row in displays via the context menu 2006-11-28 · Nov 2006 · source · release history

docs

  • Cross-platform AArch32/x86/x86-64 debugger for Linux inspired by OllyDbg, with a graphical interface for binary analysis.
Enhanced disassembly analysis shipped Uses a new engine to distinguish operand sizes, analyze jump sources, and identify potential function boundaries based on call reference counts. 7 releases · 1 other source · first seen Jul 2007

release 7 total

  • Adds ELF symbol file generation capability built into edb 2010-10-16 · Oct 2010 · source · release history
  • Added --no-fuzzy flag or config option to disable fuzzy logic in the analyzer for faster, higher-quality function discovery. 2009-07-03 · Jul 2009 · source · release history
  • Adds identification of jump sources to instruction analysis, attempting to find nearby relative jumps targeting the current instruction 2007-11-15 · Nov 2007 · source · release history
  • Adds an algorithm to enumerate potential functions by disassembling all addresses and using call reference counts (>=2) to identify code bounds. 2007-10-23 · Oct 2007 · source · release history
  • operand analysis now distinguishes byte ptr, word ptr, and dword ptr expression types. 2007-07-12 · Jul 2007 · source · release history
  • Replaces the previous disassembly engine with the new edisassm library. 2007-07-11 · Jul 2007 · source · release history

example

  • Generate a symbol map for an ELF binary directly using the new built-in command. ./edb --symbols <filename> 2010-10-16 · Oct 2010 · source
Conditional breakpoints shipped Allows execution to pause only when a specific expression evaluates to true during debugging sessions. 3 releases · 1 other source · first seen Apr 2007

release

  • Adds experimental run until return support to execute code until a function returns 2010-10-10 · Oct 2010 · source · release history
  • Adds preliminary support for hardware breakpoints using the DebuggerCore to get/set debug registers on Intel architectures. 2008-02-25 · Feb 2008 · source · release history
  • Added conditional breakpoints which can be set in the breakpoint manager plugin based on expressions 2007-04-06 · Apr 2007 · source · release history

example

  • Stop execution only when a specific expression evaluates to true. Open the breakpoint manager plugin, add a new breakpoint, and enter an expression in the condition field. 2007-04-06 · Apr 2007 · source
Plugin discovery and loading shipped Automatically detects plugins in the current working directory or configured path and identifies them by name for execution. 4 releases · first seen Mar 2007

release

  • session_handler moved from core code to a plugin interface 2009-02-10 · Feb 2009 · source · release history
  • Adds compile-time option to specify default directory strings 2007-03-15 · Mar 2007 · source · release history
  • edb will now look in the current working directory as well as the path specified in the options for plugins 2007-03-15 · Mar 2007 · source · release history
  • Adds preliminary method for code to find a plugin based on the plugins name 2007-03-15 · Mar 2007 · source · release history
Direct process attachment via CLI shipped Allows launching the debugger and attaching to a new process with specific arguments immediately using a command-line option. 3 releases · 1 other source · first seen Dec 2007

Also counts toward: Command-line interface

release

  • Added Find ASCII string in stack feature that searches for pointers to matching strings on the stack. 2009-01-22 · Jan 2009 · source · release history
  • Adds the --run command-line option to execute and attach to a program directly 2007-12-10 · Dec 2007 · source · release history
  • Supports passing arbitrary arguments to the target program when using --run 2007-12-10 · Dec 2007 · source · release history

example

  • Launch edb attached to a new process with specific arguments for immediate debugging. ./edb --run /bin/ls /etc /bin 2007-12-10 · Dec 2007 · source
Instruction pointer navigation shipped Allows direct modification of the instruction pointer (EIP) and navigation to target addresses for JMP/CALL instructions via context menu options. 2 releases · 2 other sources · first seen Jul 2008

release

  • Adds a Follow item to the CPU context menu that scrolls the view to evaluated JMP or CALL operand addresses 2008-07-13 · Jul 2008 · source · release history
  • Adds 'set EIP to selected instruction' option in CPU context menu. 2008-07-01 · Jul 2008 · source · release history

example

  • Navigate to a target address for a JMP/CALL instruction directly from the CPU disassembly view without manual entry. Right-click on a JMP or CALL instruction in the CPU view, select 'Follow' from the context menu. 2008-07-13 · Jul 2008 · source
  • Set the Instruction Pointer (EIP) to a specific instruction in the CPU context menu. Right-click an instruction in the CPU view > set EIP to selected instruction 2008-07-01 · Jul 2008 · source
Function analysis engine shipped Provides a centralized engine to analyze disassembly regions, identify functions based on call references and known symbols, and visualize their bounds. 3 releases · 1 other source · first seen Jan 2008

release

  • Adds graphical indication of function bounds based on analysis results 2008-07-03 · Jul 2008 · source · release history
  • Adds centralized analysis engine accessed via Ctrl+A to analyze the current region. 2008-07-01 · Jul 2008 · source · release history
  • Function finder plugin now assigns bonus points to functions that have known symbols. 2008-01-24 · Jan 2008 · source · release history

example

  • Analyze the currently selected region in the disassembly view to find functions using the new centralized engine. In the disassembly view, select a region and press Ctrl+A 2008-07-01 · Jul 2008 · source
Open files inspection shipped Provides a view to inspect currently loaded resources, including open files and sockets. 2 releases · 1 other source · first seen Apr 2007

release

  • Changed the binary info plugins to be based on looking at a region, not a file to enable analysis of data seen only at runtime. 2009-07-11 · Jul 2009 · source · release history
  • Began work on a new "Open Files" plugin which currently lists open files and will eventually show socket/pipe information 2007-04-23 · Apr 2007 · source · release history

example

  • Access the Open Files view via the GUI to inspect currently loaded resources. In the edb-debugger menu, select Plugins > Open Files 2007-04-23 · Apr 2007 · source
Plugin API framework shipped Exposes a strict PluginAPI structure and interface variables to decouple internal components, control plugin capabilities, and expose the m_API variable. 3 releases · first seen Dec 2008

Also counts toward: Plugin API support, Plugin system

release

  • Complete the new plugin system which decouples internal components and restores normal operation. 2008-12-10 · Dec 2008 · source · release history
  • Exposes m_API variable within plugins to access the copied interface code 2008-12-08 · Dec 2008 · source · release history
  • Adds PluginAPI structure passed to every plugin upon init for strict control over plugin capabilities 2008-12-08 · Dec 2008 · source · release history
Binary format support expansion shipped Adds groundwork and compilation support for 64-bit builds and multiple binary types beyond the existing ELF32 support. 3 releases · first seen Apr 2007

release

  • Adds x86-64 compilation support to DebuggerCore, laying groundwork for future arch-sensitive features. 2007-11-24 · Nov 2007 · source · release history
  • Initial framework introduced for supporting multiple binary types, retaining current ELF32 support. 2007-07-17 · Jul 2007 · source · release history
  • Progress added towards supporting 64-bit builds. 2007-04-15 · Apr 2007 · source · release history
Automatic release detection shipped Automatically checks a remote URL to detect if new releases are available. 2 releases · 1 other source · first seen Nov 2006

release

  • Adds Plugins -> CheckVersion -> Check On Start menu item to automatically check for new versions on startup 2007-11-06 · Nov 2007 · source · release history
  • New CheckVersion plugin reads http://www.codef00.com/projects/debugger-latest to detect new releases 2006-11-22 · Nov 2006 · source · release history

example

  • Enable or disable automatic version checking on debugger startup via the UI. In the menu, go to Plugins > CheckVersion > Check On Start 2007-11-06 · Nov 2007 · source
Display customization shipped Allows users to configure fonts for register, disassembly, and data views, as well as customize the appearance of these panes via GUI settings. 2 releases · 1 other source · first seen Apr 2007

release

  • register view and disassembly view fonts can now be configured from the Options dialog 2007-04-30 · Apr 2007 · source · release history
  • data view font defaults to the setting in the Options dialog 2007-04-30 · Apr 2007 · source · release history

example

  • Customize the appearance of register and disassembly panes via the GUI settings. Open Options dialog > set fonts for `register view` and `disassembly view` 2007-04-30 · Apr 2007 · source
UTF16 string analysis shipped Starts a framework for supporting UTF16 strings during analysis. 2 releases · first seen Dec 2008

release

  • Enables UTF-16 support in base string searching routines (limited to ASCII subset for now) 2009-06-20 · Jun 2009 · source · release history
  • Starts a framework for supporting UTF16 strings in analysis 2008-12-06 · Dec 2008 · source · release history
Direct context menu breakpoint management shipped Enables direct manipulation of breakpoints through the CPU view context menu without requiring toolbar navigation. 2 releases · first seen Jul 2007

release

  • Plugins can now add items to various context menus. 2009-01-22 · Jan 2009 · source · release history
  • Adds breakpoint management to the CPU view context menu, enabling direct manipulation of breakpoints without toolbar navigation. 2007-07-26 · Jul 2007 · source · release history
Immediate value following shipped Enables tracing of immediate values from the CPU view directly into dump or stack windows for context inspection. 1 release · 1 other source · first seen Jul 2008

release

  • Adds Follow Immediate in Dump and Follow Immediate in Stack CPU context menus that follow immediate values similar to the generic Follow menu. 2008-07-15 · Jul 2008 · source · release history

example

  • Use the new CPU context menu options to quickly trace immediate values in dump or stack windows. Right-click in the Dump/Stack window and select "Follow Immediate in Dump" / "Follow Immediate in Stack" 2008-07-15 · Jul 2008 · source
64-bit architecture support shipped Adds groundwork and partial disassembly capabilities for 64-bit code, including support for instruction and operand width template parameters. 2 releases · first seen Apr 2008

release

  • The edisassm component now partially disassembles 64-bit code 2008-05-06 · May 2008 · source · release history
  • Instruction and Operand now accept a template parameter (e.g., <32> or <64>) to select architecture width 2008-04-30 · Apr 2008 · source · release history
Argument handling improvements shipped Supports passing file paths with spaces and arbitrary arguments to the debugged application using quoted syntax. 1 release · 1 other source · first seen Oct 2007

release

example

  • Pass a file path with spaces as an argument to the debugged application using quoted syntax. edb --args "my app" "file with space.txt" 2007-10-09 · Oct 2007 · source
Logging convenience shipped Allows formatted debug messages to be logged directly in scripts or plugins via a variadic function without intermediate string buffers. 1 release · 1 other source · first seen Sep 2007

Also counts toward: Scripting API

release

  • Makes Debugger::log a variadic function, allowing formatted output directly without temporary variables 2007-09-10 · Sep 2007 · source · release history

example

  • Log formatted debug messages directly in custom edb-debugger scripts or plugins without intermediate string buffers. Debugger::log("User %s connected from %s", username, ip_addr) 2007-09-10 · Sep 2007 · source
Search filtering shipped Adds search filters to the strings and opcode search plugins to limit searches to specific regions. 2 releases · first seen Aug 2007

release

  • search filter added to the strings plugin for region selection 2007-08-08 · Aug 2007 · source · release history
  • search filter added to the opcode search plugin for region selection 2007-08-08 · Aug 2007 · source · release history
Heap and environment inspection shipped Enhances the heap viewer to display ASCII strings in data columns and adds filtering capabilities to the environment viewer for finding variables. 2 releases · first seen Aug 2007

release

  • Added ascii string display in the heap viewer plugin's data column when a heap block contains an ASCII string. 2007-08-06 · Aug 2007 · source · release history
  • Added a filter to the environment viewer plugin to quickly find variables. 2007-08-06 · Aug 2007 · source · release history
Breakpoint interaction safety shipped Prevents silent state corruption by prompting the user when modifying bytes that overlap with an active breakpoint and displaying breakpoint types in the dialog. 2 releases · first seen Jul 2007

release

  • Modifying bytes overlapping a breakpoint now prompts to continue (removing breakpoints) or abort, preventing silent state corruption. 2007-07-17 · Jul 2007 · source · release history
  • Breakpoint dialog now displays the breakpoint type. 2007-07-17 · Jul 2007 · source · release history
In-place code modification shipped Enables direct modification of disassembled instructions and bytes during a debugging session. 1 release · 1 other source · first seen May 2007

release

  • QDisassembly viewer now supports the new Edit bytes command to modify disassembled code directly. 2007-05-20 · May 2007 · source · release history

example

  • Modify instructions in place during a debugging session via the GUI. In the QDisassembly viewer pane, right-click the target instruction and select 'Edit bytes'. 2007-05-20 · May 2007 · source
XFCE terminal support shipped Support for the XFCE terminal environment. 1 release · first seen Mar 2024

release

Child process I/O redirection shipped Enables redirecting input and output of the debugged child process via pipes. 1 release · first seen Apr 2020

release

  • Introduced the ability to redirect I/O in and out of the child process via pipes 1.2.0 · Apr 2020 · source · release history
ROP gadget discovery shipped Provides a plugin to automatically identify and locate Return-Oriented Programming sequences within debugged binaries. 1 release · first seen Oct 2010

release

  • Adds New ROP gadget finder plugin for finding Return-Oriented Programming sequences 2010-10-10 · Oct 2010 · source · release history
Heap relationship visualization shipped Provides a graph view to visualize the relationships and structure between nodes in the heap memory. 1 release · first seen Oct 2009

release

  • Adds Heap Graphs visualization to show relationships between heap nodes 2009-10-17 · Oct 2009 · source · release history
Custom options dialog extension shipped Allows plugins to inject custom configuration tabs into the main options dialog through an API hook. 1 release · first seen Jul 2009

Also counts toward: Plugin API support

release

  • Plugins can now add custom tabs to the options dialog via a new API hook. 2009-07-03 · Jul 2009 · source · release history
Configurable process wait logic shipped Provides a safe mechanism for waiting on child processes with timeouts using Qt4 signal handling. 1 release · first seen Jun 2009

release

  • Implements waitpid with a timeout by safely catching SIGCHLD using Qt4 2009-06-20 · Jun 2009 · source · release history
Session persistence abstraction shipped Decouples the debugging session lifecycle from core code to allow plugins to manage state via a dedicated interface. 1 release · first seen Feb 2009

Also counts toward: Plugin API support

release

  • session_handler moved from core code to a plugin interface 2009-02-10 · Feb 2009 · source · release history
Segment register resolution shipped Adds support for resolving GS and FS segment bases in expressions to correctly display instruction analyzer values. 1 release · first seen Aug 2008

release

  • Adds support for resolving the base of GS and FS segments in expressions to allow the instruction analyzer to correctly display certain values 2008-08-25 · Aug 2008 · source · release history
Opcode search size expansion shipped Expands the OpcodeSearcher plugin to consider opcode sizes up to 8 bytes, previously limited to 4. 1 release · first seen Jun 2008

release

  • OpcodeSearcher now considers opcode sizes up to 8 bytes (previously limited to 4) 2008-06-18 · Jun 2008 · source · release history
Code padding visualization shipped Displays functions with no real effect or used as padding instructions in grey text within the disassembly view. 1 release · first seen Aug 2007

release

  • Displays functions with no real effect or used as padding (filling instructions) in grey text 2007-08-20 · Aug 2007 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for edb-debugger, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail edb-debugger puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

55 entries

  1. March 20241
  2. April 20201
  3. October 20102
  4. July 20101
  5. March 20101
  6. February 20101
  7. October 20091
  8. July 20092
  9. June 20091
  10. February 20091
  11. January 20091
  12. December 20083
  13. August 20081
  14. July 20084
  15. June 20081
  16. May 20081
  17. April 20081
  18. February 20081
  19. January 20081
  20. December 20071
  21. November 20073
  22. October 20072
  23. September 20072
  24. August 20074
  25. July 20075
  26. May 20071
  27. April 20074
  28. March 20071
  29. December 20061
  30. November 20065
    Show

    55 entries

    Project health

    Issue, contributor and maintainer activity in eteran/edb-debugger, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 4 +4 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 4.1 years first maintainer reply 3.1 days
    6. Open backlog 66 of 564 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 66
    3. Contributors / month 1
    4. Commits / month 3
    5. Stars 2,961
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →