AwesomeREA.org

Tool

Dwarf

PyQt5 debugger built on Frida that attaches to or spawns processes on Android and iOS devices, the local machine or a remote Frida server. A session offers breakpoints, watchpoints, register context, backtraces and threads, a Capstone disassembly view for x86, x64, ARM and ARM64, a hex editor and panels for modules, memory ranges and memory search, while Java explorer, inspector and trace panels and an Objective-C inspector cover mobile app runtimes. User Frida scripts and Python plugins extend a session, and companion commands trace Java methods or native addresses (dwarf-trace), log syscalls from one module on arm64 (dwarf-strace) and scaffold scripting projects with Dwarf API typings (dwarf-creator).

Requirements & limits

  • Latest release at review: dwarf-debugger 1.1.3 on PyPI, uploaded 2022-04-09; the repository has no GitHub releases or tags. The reviewed master commit, from 2024-05-16 and the most recent at review, merges a small type fix after that release. The README still says a Dwarf 2.0 release is being worked on, and none has been published.
  • Installed with pip from PyPI or a master archive. setup.py accepts any Python 3 and declares Linux, Windows and macOS, depending on frida 12.8+, PyQt5 5.11.3+ (requirements.txt pins 5.13.*), Capstone 4.0.1+, requests and pyperclip. The bundled core.js agent is built from the core1 branch of the separate DwarfCore repository; the reviewed sources do not state which current Frida releases it works with.
  • The user supplies the apps, processes and devices to debug; the repository holds only Dwarf's own code, agent, icons and examples. Android sessions use adb and a device running frida-server: the device bar can download the latest frida-server from Frida's GitHub releases and install it with su on a rooted device, and flags devices where it finds no root access. iOS sessions use a USB-connected Frida device, local sessions spawn a given path or attach to a PID, and remote sessions use Frida's remote device.
  • GPL-3.0 (setup.py: GPLv3+). The README lists two known JavaTraceView display problems, and dwarf-strace handles only arm64 processes. The README pitches the tool to reverse engineers, crackers and security analysts; this entry covers debugging and tracing for analysis only. Nothing was installed or run, and the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
App · Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · iGio90/Dwarf · Revision fd859ae
  2. setup.py GitHub · iGio90/Dwarf · Revision fd859ae
  3. requirements.txt GitHub · iGio90/Dwarf · Revision fd859ae
  4. dwarf_debugger/dwarf.py GitHub · iGio90/Dwarf · Revision fd859ae
  5. dwarf_debugger/ui/app.py GitHub · iGio90/Dwarf · Revision fd859ae
  6. dwarf_debugger/ui/widgets/device_bar.py GitHub · iGio90/Dwarf · Revision fd859ae
  7. dwarf_debugger/lib/disassembler.py GitHub · iGio90/Dwarf · Revision fd859ae
  8. dwarf_debugger/strace.py GitHub · iGio90/Dwarf · Revision fd859ae
  9. PLUGINS.md GitHub · iGio90/Dwarf · Revision fd859ae
  10. LICENSE GitHub · iGio90/Dwarf · Revision fd859ae
  11. https://pypi.org/project/dwarf-debugger/1.1.3/

More in Native binaries

All 104 entries in Native binaries