When debugging tools are used, this would mean that we are in the code-tracing phase of our analysis. Debuggers are used to step in every instruction the program is supposed to do. In the process of debugging, actual interaction and changes in memory, disk, network, and devices can be identified:
- x86dbg: This is a Windows user-mode debugger. It is open source and can debug 32- and 64-bit programs. It is capable of accepting plugins written by users. The source code can be downloaded from https://github.com/x64dbg. The builds can be downloaded from https://x64dbg.com.
- IDA Pro: Paid versions of IDA Pro are capable of debugging using the same disassembly interface. It is very useful when you want to see a graphical view of decrypted code.
- OllyDebug: A popular Windows debugger, due to its portability and rich features. It can accommodate plugins...
