DebuggerJ++

Debugger / disassembler with GUI for malware analysis on 32- and 64-bit executables, in the style of OllyDbg / x64dbg. Designed to dissect viruses and malware for defensive purposes: creating antivirus/antimalware signatures, understanding behavior, and cleaning machines.

⚠️ Always analyze samples in an isolated virtual machine / sandbox, without network, with snapshots. Launching a binary under the debugger executes its code.

Features (v0.2)

• Open .exe / .dll / .sys and full PE parsing (32/64-bit, entrypoint, sections, imports, exports, entropy).
• CPU window: disassembly (Zydis) of the code, with highlighting of call/jmp/ret, jump destinations, visual flow guides for jmp/jz/jnz/etc. and the current instruction when you are paused. The Jump To context menu opens the jump destination.
• Breakpoints: software (0xCC), hardware (DR0–DR3, execute/write/read-write), exception-based and memory breakpoints via PAGE_GUARD (access, write or execute). Includes list, labels, enable/disable, register/hit conditions, log-only actions and event breakpoints (threads/DLLs). Memory breakpoints are configured while paused and work per page, just like the technique used by OllyDbg.
• Controls: Play (launch / continue), Pause, Step Into (F7), Step Over (F8), Step To Ret, Rewind (history navigation), Stop and session restart.
• Registers (x64: RAX..R15/RIP/EFLAGS; x86: EAX..EIP) when paused, with direct editing.
• Memory: hex dump + region map (VirtualQueryEx) with permissions, type and module; quick jump to RSP, read/write, assembly with Keystone and patching/NOP.
• Strings & search: extraction of ASCII/UTF-16 strings and pattern search hex with wildcards (48 8B ?? C3) or text, in file or in live memory.
• Modules & symbols: sections, PE imports/exports, TLS callbacks, x86 SEH chain, DLLs loaded at runtime, symbol resolution with DbgHelp and source/line when a PDB is available.
• Navigation and traces: code/data references, call stack, run trace, candidate functions, persistent xrefs/loops/bookmarks, annotations (comments/labels) and jumps to an address or module/DLL. Double-clicking a module opens its code in the CPU window.
• Analysis cache: strings, packer detections and annotations are saved in cache/ next to the debugger. They are reused when reopening a file and invalidated if its size, modification date or the minimum string length change.
• Sessions and reports: .dbgjsession sessions with annotations and breakpoints; export of a Markdown report with target, sections, detections, status and breakpoints.
• Packers: signature-based detection (embedded set + signatures/userdb.txt in PEiD style) and entropy / suspicious section heuristics.
• Assisted unpacking: OEP search, memory-aligned dump, resolution and experimental IAT reconstruction, and anti-anti-debug options for controlled analysis.
• Multi-agent AI panel: Anthropic/Claude, ChatGPT/OpenAI, DeepSeek, Gemini, Grok, Mistral, Groq, OpenRouter, Ollama and LM Studio. The chat can automatically include registers, stack and current disassembly.
• AI tools: when Allow debugger control (tools) is enabled, the agent can query or control the session: open/launch/restart, continue or pause, step, read memory and registers, disassemble, search, set breakpoints, navigate to DLLs, patch and perform the other operations exposed by the debugger.
• Code window: transforms a routine into explanatory C++ pseudocode using the disassembly, memory, symbols and modules. It is an interpretation for analysis, not a literal recovery of the source code.
• MCP: local server compatible with MCP tools so that an external agent can control DebuggerJ++. See mcp/README.md.
• Extensible plugins: JSON manifests and optional native x64 DLLs in plugins/ add actions to the UI and dynamic tools to MCP. DLLs are only loaded when the user expressly enables the option and they must be trusted. See docs/PLUGINS.md.
• Configurable interface: detachable panels, persistent visibility, tiling and custom layouts in OllyDbg/x64dbg style.

Build (Windows)

It only compiles on Windows with MSVC because it uses the Windows Debug API, DbgHelp, Direct3D 11, and WinHTTP.

1. Instala Visual Studio 2022 con Desktop development with C++, CMake 3.20+ y Git.

2. Doble clic a build.bat (o desde un x64 Native Tools Command Prompt):

   build.bat
   

   CMake will download only (FetchContent) Zydis, Dear ImGui, and nlohmann/json.

3. Run build\Release\DebuggerJ++.exe as Administrator (to be able to debug).

Quick usage

1. File → Open .exe. The CPU, sections, strings, and packer scan are populated.
2. Set a breakpoint at the EntryPoint (Breakpoints panel) and press Play (launch).
3. The process stops at the loader breakpoint; press Play again to reach your breakpoint. From there use Step Into / Step Over, inspect Registers and Memory, search for strings, and ask the AI agent about the ASM.
4. In Window → Code, use Use RIP and Interpret as C++ to get an explanation of the current routine.

AI agents and API keys

Configure the agents in Tools → Options → AI. On first launch it detects, if present, the ANTHROPIC_API_KEY and OPENAI_API_KEY variables; you can also paste a key into an agent's form. ChatGPT/OpenAI is offered as the ChatGPT (OpenAI) preset.

Credentials are stored only in ai_config.json next to the executable for the application's local use. Do not upload that file or .env files to the repository: they are already excluded by .gitignore.

To allow the agent to act, select a provider/model compatible with function calling and enable Allow debugger control (tools) in the AI window. The Code window limits the agent to query tools so it does not alter the process.

Architecture

See docs/ARQUITECTURA.md.

License

DebuggerJ++ is distributed under the GNU General Public License v3.0 or later (GPL-3.0-or-later). You can use it, study it, modify it, and redistribute it under those terms. Third-party dependencies retain their own notices and licenses.

Limitations and next improvements

It is a functional base for defensive analysis. Areas planned for a next version:

• Advanced conditions expressed as rules/expressions for breakpoints.
• Attaching to already running processes, child process tracking, and better thread control.
• More complete PDB symbols, source information, and robust stack walking when there are no frame pointers.
• Full session persistence, report export, and a control flow graph view.
• Additional validations for modification operations and improvements when rebuilding the IAT.