Load an executable binary for debugging. Resolves symbols and prepares for execution. Optionally pass command-line arguments. This is the mandatory first step for debugging a new binary.

Args: params (BinaryPath): Path and arguments - path (str): Absolute path to the executable - args (Optional[str]): Command-line arguments (default: "")

Returns: str: Status message confirming the binary was loaded

Attach the debugger to an already-running process by PID. The process is paused on attach.

Args: params (AttachPid): Process ID - pid (int): Process ID to attach to

Returns: str: Status message confirming attachment

Detach from the debugged process. The process continues running independently.

Returns: str: Confirmation of detachment

Kill the debugged process immediately. Equivalent to force-terminating the debuggee.

Returns: str: Confirmation the process was killed

Start execution of the loaded program from the beginning. Stops at the first breakpoint hit.

Returns: str: Status with reason if stopped at breakpoint

Continue execution after a breakpoint or pause. Resumes from the current instruction pointer.

Returns: str: Status with stop reason if another breakpoint is hit

Pause (interrupt) the running program. Sends a SIGINT to break execution.

Returns: str: Confirmation of interruption

Kill and restart the debugged program. Reloads the binary, preserves breakpoints.

Returns: str: Status after restart

Execute one machine instruction, stepping into function calls. If the current instruction is a call, execution enters the called function.

Returns: str: JSON with address, function, file, line after stepping

Execute one machine instruction, treating calls as atomic. If the instruction is a call, the entire called function runs then stops.

Returns: str: JSON with address, function, file, line after stepping

Execute until the current function returns to its caller.

Returns: str: Location where execution stopped

Continue execution until a specific address is reached. Sets a temporary breakpoint at the given address and runs.

Args: params (ContinueToAddress): Target - address (str): Address in hex (e.g., '0x4000a0') or function name

Returns: str: Location details when stopped

Set a breakpoint at a function, address, or source location. Supports conditional breakpoints.

Args: params (BreakpointInput): Breakpoint location - location (str): E.g., 'main', '*0x400528', 'foo.c:42' - condition (Optional[str]): E.g., 'x == 5' (default: none)

Returns: str: Breakpoint number and details

Set a hardware-assisted breakpoint using CPU debug registers. Useful for ROM, flash, or self-modifying code regions.

Args: params (BreakpointInput): Location - location (str): Address or function name

Returns: str: Hardware breakpoint information

Set a watchpoint to monitor memory access. Three modes:

• 'write': stops when value changes (default)

• 'read': stops when value is read

• 'access': stops on both read and write

Args: params (WatchpointInput): Watchpoint configuration - expression (str): E.g., 'x', '*0x7fff0000', 'my_global' - watch_type (str): 'write', 'read', or 'access' (default: 'write')

Returns: str: Watchpoint details

Permanently remove a breakpoint or watchpoint by number. Use edb_list_breakpoints to find breakpoint numbers.

Args: params (BreakpointNumber): Breakpoint number - number (int): Breakpoint ID to remove

Returns: str: Confirmation

Re-activate a disabled breakpoint.

Args: params (BreakpointNumber): Breakpoint number - number (int): Breakpoint ID to enable

Returns: str: Confirmation

Disable a breakpoint without removing it. It can be re-enabled later.

Args: params (BreakpointNumber): Breakpoint number - number (int): Breakpoint ID to disable

Returns: str: Confirmation

List all breakpoints, watchpoints, and their status (number, type, enable/disable, address).

Returns: str: Formatted breakpoint table

Get all CPU register values as JSON. Includes general-purpose registers, instruction pointer, stack pointer, base pointer, flags, and SIMD registers.

Returns: str: JSON object with register names and hex values

Get the value of a specific CPU register.

Args: params (RegisterName): Register name - name (str): E.g., 'rax', 'rbx', 'rip', 'rsp', 'eflags'

Returns: str: Hex value of the register

Modify a CPU register value. Useful for patching execution flow or testing conditions.

Args: params (RegisterSetInput): Register modification - name (str): Register name (e.g., 'rax', 'rip') - value (str): New value in hex (e.g., '0x7fff00001000')

Returns: str: Confirmation

Get a human-readable register dump in markdown table format. Shows all general-purpose registers, instruction pointer, flags and their meanings.

Returns: str: Markdown-formatted register table

Read and display memory contents at an address as a hex dump. Shows hex bytes with ASCII representation.

Args: params (AddressInput): Memory parameters - address (str): Address (e.g., '0x7fff0000' or symbol name) - count (int): Bytes to read, 1-4096 (default: 128)

Returns: str: Formatted hex dump with address, hex bytes, and ASCII

Write a value to a memory address. Use for patching code or data.

Args: params (MemoryWriteInput): Memory write - address (str): Target address (e.g., '0x400000') - data (str): Data to write (e.g., '0x90' for NOP)

Returns: str: Confirmation

Write raw hex bytes to memory starting at an address. Useful for patching multiple bytes at once (e.g., NOP sled or shellcode).

Args: params (MemoryWriteBytesInput): Raw byte write - address (str): Target address (e.g., '0x400000') - hex_bytes (str): Hex bytes (e.g., '90 90 90' or '0x90 0x90 0x90')

Returns: str: Confirmation of byte count written

Search memory for a byte pattern. Finds all occurrences in the specified region.

Args: params (SearchMemoryInput): Search parameters - pattern (str): Hex bytes (e.g., '0x90 0x90') - address (Optional[str]): Start address (default: $pc) - length (Optional[str]): Region size in hex (default: 0x10000)

Returns: str: Addresses where the pattern was found

Search memory for byte patterns (case-insensitive). Searches memory for the given hex byte pattern within the specified range. Useful for finding instruction opcode patterns in code sections.

Args: params (SearchInstructionsInput): Pattern search - pattern (str): Hex byte pattern (e.g., '0x90 0x90') - range_start (Optional[str]): Start address of search range - range_end (Optional[str]): End address of search range

Returns: str: Addresses where pattern was found

Get the process memory map (like /proc/pid/maps). Shows address ranges, permissions, offset, and paths for all mapped regions.

Returns: str: Memory map listing

Get detailed section information for loaded modules. Shows section names, addresses, sizes, and file offsets.

Args: params (SectionInfoInput): Module filter - module (Optional[str]): Module name (empty = all)

Returns: str: Section information

Disassemble machine code at an address or function. Shows assembly instructions with addresses, offsets, and opcodes.

Args: params (DisassembleInput): Disassembly params - location (str): Address (e.g., '0x400000') or function (e.g., 'main') - count (int): Instructions to show, 1-200 (default: 10)

Returns: str: Formatted disassembly listing

Get the instruction at the current program counter (RIP/EIP). Shows what will execute next.

Returns: str: Current instruction text

Dump the current stack (stack pointer to higher addresses). Each entry is an 8-byte (64-bit) value.

Returns: str: Stack hex dump

Get detailed information about a specific stack frame level. Shows address, function, file, line for the given frame.

Args: params (StackFrameInput): Frame level - frame_level (int): Frame number, 0 = current (default: 0)

Returns: str: JSON frame information

Get the full call stack backtrace. Frame #0 is the current function. Each frame shows number, address, function name, and source location.

Returns: str: Formatted backtrace

Look up a symbol's address and type. Supports functions and variables.

Args: params (SymbolLookup): Symbol name - name (str): E.g., 'main', 'printf', 'errno'

Returns: str: Symbol address and type info

List all shared libraries / modules loaded by the process. Shows base address, text size, and path.

Returns: str: Module listing

List all threads in the debugged process with IDs, names, and states.

Returns: str: Thread listing

Get info about the currently active thread.

Returns: str: Current thread information

Switch the debugger context to a different thread. All subsequent commands apply to the selected thread.

Args: params (ThreadId): Thread ID - thread_id (int): Thread ID to switch to

Returns: str: Confirmation

Evaluate a C expression in the debug context. Supports variables, pointer dereferences, casts, arithmetic, and function calls. Examples: 'x + 5', '(int)0x7fff0000', 'argv[0]'

Args: params (EvaluateExpr): Expression - expression (str): C expression to evaluate

Returns: str: Expression result

Read a null-terminated string from a memory address. Interprets the memory as a C string (null-terminated).

Args: params (ReadStringInput): String parameters - address (str): Address (e.g., '0x400678') - max_length (int): Max string length, 1-4096 (default: 256)

Returns: str: String contents

Find printable ASCII strings in the current code region. Searches from current PC for printable character sequences.

Returns: str: Found strings with addresses

Read the value of a local or global variable in the current scope.

Args: params (VariableInput): Variable name - name (str): Variable name (e.g., 'i', 'argc', 'buffer')

Returns: str: Variable value

Modify a variable's value in the current scope. Useful for altering program behavior during debugging.

Args: params (VariableInput): Variable modification - name (str): Variable name (e.g., 'x', 'error_flag') - value (str): New value (e.g., '0', '42', '"hello"')

Returns: str: Confirmation

Get the arguments passed to the current function. Shows argument names and values.

Returns: str: Function argument names and values

Get all local variables in the current function scope. Shows names and values.

Returns: str: Local variable names and values

Get detailed info about a function: address, prototype, source location.

Args: params (FunctionInfo): Function name - name (str): E.g., 'main', 'malloc'

Returns: str: Function details

Find all code references to a given address or symbol. Searches functions and variables referencing the address.

Args: params (FindReferencesInput): Target address - address (str): Address to find references to

Returns: str: Reference locations

Display source code with line numbers. Current line is marked with '->'. Reads directly from the source file if available.

Args: params (SourceInput): Source location - file (str): Source file path - line (int): Starting line (default: 1) - count (int): Lines to show, 1-200 (default: 20)

Returns: str: Source code listing

Get the current debugger and process status. Shows whether a process is loaded, running or paused, PID, RIP, current instruction, register count.

Returns: str: JSON status object

Read memory at an address interpreted as a specific data type. Supports integers (8-64 bit signed/unsigned), float, double, pointer, and string. Essential for struct inspection, pointer chasing, and data analysis.

Args: params (ReadMemoryAsInput): Read parameters - address (str): Address or symbol name - data_type (str): Type: int8/16/32/64, uint8/16/32/64, float, double, pointer, string - count (int): Number of elements (default: 1, max: 256)

Returns: str: Value(s) interpreted as the requested type

Get the program entry point address. The entry point is the first code executed when the program starts (typically _start).

Returns: str: Entry point address in hex

Get the start address, end address, and size of a function. Useful for understanding function layout and selecting regions for patching.

Args: params (FunctionBoundsInput): Function name - name (str): Function name (e.g., 'main')

Returns: str: Start address, end address, and size

Convert a file offset from the binary on disk to the corresponding virtual address in the loaded process. Essential for patching binaries and understanding disk-to-memory mapping.

Args: params (FileOffsetInput): File offset - offset (int): Offset in bytes from start of file

Returns: str: Virtual address in hex

Convert a virtual address in the loaded process to the corresponding file offset in the binary on disk. Essential for applying patches back to the binary file.

Args: params (VirtualAddressInput): Virtual address - address (str): Virtual address in hex (e.g., '0x400000')

Returns: str: File offset in hex

Replace a range of instructions with NOP (0x90) bytes. This is the primary method for patching out conditional jumps or calls. Use edb_get_function_bounds to find the range for a function.

Args: params (NopRangeInput): Range to NOP - start_address (str): Start address (e.g., '0x400000') - end_address (str): End address, exclusive (e.g., '0x400005')

Returns: str: Confirmation of bytes written

Disassemble at an address and identify call/jump targets. Shows each instruction and resolves targets for call, jmp, jz, jnz. Essential for control flow analysis and understanding branch targets.

Args: params (AnalyzeCallsInput): Address - address (str): Address to analyze

Returns: str: Instructions with resolved call/jump targets

Find all code and data references to a string or address in the binary. Searches function names, variable names, and source files for the given string. Useful for tracing how a particular value or string is used in the program.

Args: params (StringRefInput): Search target - string_or_address (str): String content (e.g., 'password') or hex address

Returns: str: Matching functions, variables, and sources

Disassemble a range of memory from start to end address. Unlike edb_disassemble which uses a count of instructions, this tool disassembles an exact address range. Useful for full function analysis.

Args: params (DisassembleRangeInput): Range - start_address (str): Start address (e.g., '0x400000') - end_address (str): End address (e.g., '0x400100')

Returns: str: Disassembly listing

Set a trace point (logging breakpoint) that prints a message and continues without stopping execution. Useful for tracing function calls and variable changes without interrupting the program flow.

Args: params (ConditionalLogInput): Trace configuration - location (str): Breakpoint location (function, address, or file:line) - log_message (str): Message to print (use $reg for register values)

Returns: str: Trace point number and details

Fill a memory region with a repeating byte value. Useful for zeroing buffers, filling with NOPs (0x90), or any pattern. Uses edb_write_memory_bytes internally.

Args: params (FillMemoryInput): Fill parameters - address (str): Start address (e.g., '0x400000') - byte_value (str): Byte value (e.g., '0x90' or '90') - count (int): Number of bytes to fill

Returns: str: Confirmation of fill operation

Compare two memory regions byte-by-byte and show differences. Useful for detecting self-modifying code, comparing loaded vs original code, or analyzing binary patches.

Args: params (CompareMemoryInput): Comparison parameters - address1 (str): First address (e.g., '0x400000') - address2 (str): Second address (e.g., '0x400100') - count (int): Number of bytes to compare (max: 4096)

Returns: str: Differing regions with hex values

Add a text annotation to an address. Comments are stored in-memory and can be listed with edb_list_comments. Useful for documenting analysis findings during a reverse engineering session.

Args: params (CommentInput): Comment data - address (str): Address in hex (e.g., '0x400000') - comment (str): Annotation text

Returns: str: Confirmation

List all address annotations added via edb_add_comment. Returns a sorted list of addresses with their associated comments.

Returns: str: Comment listing

Remove an annotation previously added with edb_add_comment.

Args: params (AddressOnlyInput): Address - address (str): Address to remove comment from

Returns: str: Confirmation

Get detailed information about the loaded binary file. Shows ELF header, architecture, entry point, section layout, and more. Equivalent to EDB's BinaryInfo plugin.

Returns: str: Binary file metadata

List all functions in the binary, optionally filtered by name. Equivalent to EDB's FunctionFinder plugin. Shows function names, addresses, and prototypes.

Args: params (FunctionFilterInput): Filter - filter_str (str): Optional filter (e.g., 'main', 'printf')

Returns: str: Function listing

Search for ROP gadgets (instructions ending with 'ret') in memory. Equivalent to EDB's ROPTool plugin. Finds usable instruction sequences for ROP chain construction.

Args: params (RopSearchInput): Search parameters - address (str): Start address (default: $pc) - depth (int): Max instructions before ret, 1-10 (default: 2) - count (int): Max results, 1-1000 (default: 100)

Returns: str: ROP gadget addresses and bytes

Analyze a code region for call instructions, branch instructions, and strings. Equivalent to EDB's Analyzer plugin. Shows control flow information for the given address range.

Args: params (AnalyzeRegionInput): Region parameters - address (str): Start address - size (int): Region size in bytes (default: 256)

Returns: str: Analysis with call/branch/instruction counts

Analyze the heap memory region of the debugged process. Equivalent to EDB's HeapAnalyzer plugin. Shows heap regions, sizes, permissions, and strings found in heap memory.

Returns: str: Heap analysis including regions, sizes, and strings

Save a named bookmark pointing to an address for quick navigation. Equivalent to EDB's Bookmarks plugin. Useful for marking key locations during reverse engineering.

Args: params (BookmarkInput): Bookmark - name (str): Name (e.g., 'main_loop') - address (str): Address (e.g., '0x400000')

Returns: str: Confirmation

List all saved bookmarks with names and addresses.

Returns: str: Bookmark listing

Remove a bookmark by name.

Args: params (BookmarkNameInput): Bookmark name - name (str): Bookmark name to remove

Returns: str: Confirmation

Get comprehensive properties of the debugged process. Equivalent to EDB's ProcessProperties plugin. Shows PID, binary path, arguments, entry point, register state, and more.

Returns: str: Process properties

Dump a memory region to a binary file on disk. Equivalent to EDB's memory dump feature. Useful for extracting code regions, data sections, or heap contents for offline analysis.

Args: params (DumpMemoryToFileInput): Dump parameters - address (str): Start address - size (int): Number of bytes to dump (max: 1MB) - file_path (str): Full output file path

Returns: str: Confirmation with byte count

Assemble an assembly instruction and write it to memory. Equivalent to EDB's Assembler plugin. Uses keystone engine if available, otherwise falls back to common opcodes (nop, int3, ret).

Args: params (AssembleInput): Assembly parameters - address (str): Target address - instruction (str): Assembly text (e.g., 'nop', 'mov eax, 0', 'jmp rax')

Returns: str: Assembled bytes and confirmation

Get architecture information about the debugged process and binary. Equivalent to EDB's BinaryInfo plugin. Shows CPU architecture, binary type (PIE/non-PIE), instruction set features, and more.

Returns: str: Architecture details

Get detailed information about an instruction at a given address. Equivalent to EDB's InstructionInspector plugin. Shows instruction bytes, assembly, addressing modes, register operands, and more.

Args: params (InstructionDetailInput): Address - address (str): Address to inspect (default: $pc)

Returns: str: Detailed instruction info including bytes, opcode, operands

Dump complete debugger state: all registers, current instruction, stack, backtrace, memory map, and status. Equivalent to EDB's DumpState plugin. One-shot comprehensive process snapshot.

Returns: str: Full process state dump

Determine why the process stopped (breakpoint, signal, step, etc.). Equivalent to EDB's status bar showing stop reason. Checks GDB's program state and thread status.

Returns: str: Stop reason description

Get detailed information about a stack frame: address, function, arguments, locals, frame type, and more. Equivalent to EDB's call stack panel showing frame details.

Args: params (FrameInfoInput): Frame - frame_level (int): Frame level (0 = innermost, default: 0)

Returns: str: Frame information with args and locals

Set a catchpoint for exceptions, syscalls, signals, or process events. Equivalent to EDB's catchpoint feature. Stops execution when the specified event occurs.

Args: params (CatchpointInput): Catchpoint - event (str): Event: throw, catch, syscall, signal, assert, exec, fork, vfork, load, unload - condition (str): Optional condition or syscall name/number

Returns: str: Catchpoint confirmation

Configure how GDB handles signals (stop, print, pass to program). Equivalent to EDB's signal handling in DebuggerCore. When action is empty, queries current handling for the signal.

Args: params (SignalHandlingInput): Signal settings - signal (str): Signal name (e.g., SIGSEGV, SIGINT, SIGTRAP) - action (str): Action: stop, nostop, print, noprint, pass, nopass, ignore

Returns: str: Signal handling configuration

Generate a core dump of the current process for post-mortem analysis. Equivalent to EDB's save state feature. Saves full process memory and register state to a core file.

Args: params (CoreDumpInput): Output - file_path (str): Output file path (default: core)

Returns: str: Core dump confirmation with file size

Connect to a remote gdbserver for remote debugging. Equivalent to starting a new debugging session with remote target. Use extended mode for continuous connection.

Args: params (RemoteConnectInput): Connection - host (str): Remote hostname or IP - port (int): Remote port (1-65535) - extended (bool): Use extended-remote mode

Returns: str: Connection status

List all signals and how GDB handles them. Equivalent to EDB's signal configuration view. Shows which signals cause stop, print notification, and are passed to the program.

Args: params (ListSignalsInput): Filter - signal (str): Specific signal to query (default: all)

Returns: str: Signal list with handling info

Compare loaded memory sections with the original binary on disk. Detects modifications to code sections (self-modifying code, patches). Equivalent to EDB's memory comparison features.

Returns: str: Section comparison results

Generate a symbol map for a binary file using EDB's symbol generator. Equivalent to running edb --symbols <file>. Useful for creating symbol map files for stripped binaries.

Args: params (GenerateSymbolsInput): Input - path (str): Binary file path (default: loaded binary)

Returns: str: Symbol map

Step backward in the program execution (reverse debugging). Requires GDB recording to be active (target record-full). Steps the program backward one or more instructions.

Args: params (ReverseStepInput): Step count - count (int): Number of reverse steps (default: 1)

Returns: str: Reverse step result

Continue execution backward to the previous breakpoint or event. Requires GDB recording to be active (target record-full). Useful for rewinding to find where state changed.

Returns: str: Reverse continue result

Set the working directory for the debugger and debugged process. Equivalent to EDB's actionApplication_Working_Directory. Useful for programs that need to load files from a specific directory.

Args: params (WorkingDirectoryInput): Directory - directory (str): Working directory path

Returns: str: Confirmation

Configure GDB debugger settings. Equivalent to EDB's Configure Debugger dialog. Controls follow-fork-mode, ASLR, scheduler-locking, backtrace limits, and many other debugger behaviors.

Args: params (DebuggerConfigInput): Setting - setting (str): Setting name (e.g., 'follow-fork-mode', 'disable-randomization', 'scheduler-locking', 'backtrace limit', 'print elements') - value (str): Value to set (empty to query, use 'on'/'off' for booleans)

Returns: str: Configuration result

Display current debugger configuration settings. Uses GDB's show command to query various settings.

Args: params (ShowConfigInput): Query - setting (str): Setting name (e.g., 'architecture', 'follow-fork-mode')

Returns: str: Current configuration value

Export all breakpoints to a JSON file on disk. Equivalent to EDB's BreakpointManager export feature. Breakpoints can be reloaded later with edb_breakpoint_import.

Args: params (BreakpointFileInput): Output - file_path (str): Full path to JSON file

Returns: str: Export confirmation with count

Import breakpoints from a JSON file previously exported with edb_breakpoint_export. Equivalent to EDB's BreakpointManager import feature.

Args: params (BreakpointFileInput): Input - file_path (str): Full path to JSON file

Returns: str: Import confirmation with count

Navigate to and inspect an address across all views. Equivalent to EDB's viewInCpu() / viewInDump() / viewInStack() context menu actions. Shows disassembly, hex dump, register references, and code references for the given address.

Args: params (ViewAddressInput): Address - address (str): Address to view (e.g., '0x400000', 'main', '$rsp')

Returns: str: Combined view across all panels

Save the complete debugging session to a JSON file. Equivalent to EDB's SessionManager. Saves breakpoints, bookmarks, comments, binary path, and arguments for later restoration.

Args: params (SessionFileInput): Output - file_path (str): Full path to session file

Returns: str: Save confirmation

Load a debugging session from a JSON file. Equivalent to EDB's SessionManager. Restores breakpoints, bookmarks, comments, binary path, and arguments from a saved session.

Args: params (SessionFileInput): Input - file_path (str): Full path to session file

Returns: str: Load confirmation with details

Send a signal to the debugged process. Equivalent to EDB's signal delivery mechanism. Can be used to send SIGINT (2) to interrupt, SIGTERM (15) for graceful shutdown, etc.

Args: params (SignalSendInput): Signal - signum (int): Signal number (1-64), e.g., 2=SIGINT, 9=SIGKILL, 15=SIGTERM

Returns: str: Signal delivery result