### Prepare Build Environment (Shell)

Source: https://github.com/shinoleah/edbg/blob/main/README.md

Installs necessary tools like Go and Clang, and sets environment variables for cross-compilation on x86 Linux. Requires root privileges for package installation.

```shell
sudo apt-get update
sudo apt-get install golang-1.18
sudo apt-get install clang-14
export GOPROXY=https://goproxy.cn,direct
export GO111MODULE=on
```

--------------------------------

### Install and Run eDBG on Android Device

Source: https://github.com/shinoleah/edbg/blob/main/README_EN.md

This snippet demonstrates how to push the eDBG binary to an Android device, grant execute permissions, and start the debugger with target application details. It requires root access on the device.

```shell
adb push eDBG /data/local/tmp
adb shell
su
chmod +x /data/local/tmp/eDBG

./eDBG -p com.package.name -l libname.so -b 0x123456
```

--------------------------------

### Go: Create and Manage Target Process Instances

Source: https://context7.com/shinoleah/edbg/llms.txt

This Go code snippet demonstrates how to create, manage, and interact with target process instances. It covers starting, stopping, and continuing process execution, as well as retrieving process-specific information like PIDs, library search paths, and register contexts. It relies on the controller package.

```go
// Create process controller for target application
process, err := controller.CreateProcess("com.example.app")
if err != nil {
    fmt.Println("Failed to create process:", err)
    os.Exit(1)
}

// Update and retrieve current process IDs
process.UpdatePidList()
fmt.Printf("Found %d processes\n", len(process.PidList))

// Stop target process (sends SIGSTOP)
err = process.Stop()
if err != nil {
    fmt.Println("Failed to stop process:", err)
}

// Continue execution (sends SIGCONT)
err = process.Continue()
if err != nil {
    fmt.Println("Failed to continue:", err)
}

// Get library search paths from package and memory maps
searchPaths := process.GetLibSearchPaths()
for _, path := range searchPaths {
    fmt.Printf("Library path: %s\n", path)
}

// Parse absolute address to library+offset format
address, err := process.ParseAddress(0x6e9bfe1234)
if err == nil {
    fmt.Printf("Address: %s+0x%x\n", address.LibInfo.LibName, address.Offset)
}

// Print current register context
process.PrintContext()
```

--------------------------------

### Compile eDBG with Cross-Compilation Environment

Source: https://github.com/shinoleah/edbg/blob/main/README_EN.md

This section outlines the steps to set up a Linux environment for cross-compiling eDBG for ARM64. It includes installing necessary tools like Go and Clang, configuring environment variables, and downloading the NDK.

```shell
sudo apt-get update
sudo apt-get install golang-1.18
sudo apt-get install clang-14
export GOPROXY=https://goproxy.cn,direct
export GO111MODULE=on

# Download NDK and modify NDK_ROOT in build_arm.sh

git clone --recursive https://github.com/ShinoLeah/eDBG.git
./build_env.sh
./build_arm.sh
```

--------------------------------

### Install and Run eDBG CLI Debugger (Shell)

Source: https://github.com/shinoleah/edbg/blob/main/README.md

This snippet demonstrates the basic steps to install and run the eDBG debugger on an Android device using ADB and shell commands. It involves pushing the executable to the device, granting execution permissions, and then launching the debugger with target application and breakpoint information.

```shell
adb push eDBG /data/local/tmp
adb shell
su
chmod +x /data/local/tmp/eDBG
./eDBG -p com.pakcage.name -l libname.so -b 0x123456
```

--------------------------------

### Start eDBG Debugger Command-Line Options

Source: https://context7.com/shinoleah/edbg/llms.txt

These commands launch the eDBG debugger with various configurations. Options include specifying the target package and library, setting initial breakpoints (file offset, virtual address, multiple), filtering threads, loading sessions, hiding UI elements, preferring hardware breakpoints, and saving session configurations.

```bash
# Basic usage with initial breakpoint at file offset
./eDBG -p com.example.app -l libexample.so -b 0x12340

# Multiple breakpoints (comma-separated)
./eDBG -p com.example.app -l libexample.so -b 0x12340,0x45678,0x9abcd

# Virtual address breakpoints (IDA-style addressing)
./eDBG -p com.example.app -l libexample.so -vb 0x12340

# With thread name filtering
./eDBG -p com.example.app -l libexample.so -b 0x12340 -t "ThreadName1,ThreadName2"

# Load configuration from file
./eDBG -i session.edbg

# Hide register and disassembly windows
./eDBG -p com.example.app -l libexample.so -b 0x12340 -hide-register -hide-disassemble

# Prefer hardware breakpoints for stepping
./eDBG -p com.example.app -l libexample.so -b 0x12340 -prefer hardware

# Save session on exit
./eDBG -p com.example.app -l libexample.so -b 0x12340 -s -o session.edbg
```

--------------------------------

### Go: Manage Uprobe and Hardware Breakpoints

Source: https://context7.com/shinoleah/edbg/llms.txt

This Go snippet illustrates breakpoint management, including the creation of uprobes (software breakpoints) and hardware breakpoints, along with watchpoints. It supports temporary breakpoints for stepping and provides functionalities to start, stop, enable, disable, and delete breakpoints. It requires event listener and process context.

```go
// Create breakpoint manager with BTF support
btfFile := ""
if !utils.CheckConfig("CONFIG_DEBUG_INFO_BTF=y") {
    btfFile = utils.FindBTFAssets()
}
eventListener := event.CreateEventListener(process)
brkManager := module.CreateBreakPointManager(eventListener, btfFile, process)

// Create software breakpoint (uprobe)
address := controller.NewAddress(library, 0x1234)
err = brkManager.CreateBreakPoint(address, true)
if err != nil {
    fmt.Printf("Failed to set breakpoint: %v\n", err)
} else {
    fmt.Printf("Breakpoint at %s+0x%x\n", address.LibInfo.LibName, address.Offset)
}

// Create hardware breakpoint
err = brkManager.CreateHWBreakPoint(address, true, config.HW_BREAKPOINT_X)
if err != nil {
    fmt.Printf("Failed to set hardware breakpoint: %v\n", err)
}

// Create write watchpoint
watchAddr := controller.NewAddress(library, 0x5678)
err = brkManager.CreateHWBreakPoint(watchAddr, true, config.HW_BREAKPOINT_W)

// Set temporary breakpoint for stepping (auto-removed after trigger)
err = brkManager.SetTempBreak(address, process.WorkTid)

// Start breakpoint manager with initial breakpoints
initialBreaks := []*controller.Address{address1, address2}
err = brkManager.Start(initialBreaks)
if err != nil {
    fmt.Println("Failed to start breakpoint manager:", err)
    os.Exit(1)
}

// Enable/disable breakpoints
brkManager.ChangeBreakPoint(0, false) // Disable breakpoint ID 0
brkManager.ChangeBreakPoint(0, true)  // Enable breakpoint ID 0

// Delete breakpoint
brkManager.DeleteBreakPoint(1)

// Stop breakpoint manager
err = brkManager.Stop()
```

--------------------------------

### Disassemble Instructions (eDBG)

Source: https://context7.com/shinoleah/edbg/llms.txt

Disassemble instructions starting from the current program counter (PC) or a specified address. Supports custom instruction counts and alternative command names. No external dependencies are required beyond the eDBG environment.

```bash
(eDBG) list
>>  0x6e9bfe1234<libexample.so+0x1234>  stp x29, x30, [sp, #-0x20]!
    0x6e9bfe1238<libexample.so+0x1238>  mov x29, sp
    0x6e9bfe123c<libexample.so+0x123c>  str x0, [sp, #0x18]
    0x6e9bfe1240<libexample.so+0x1240>  ldr x0, [x0]
    0x6e9bfe1244<libexample.so+0x1244>  bl #0x5678
    0x6e9bfe1248<libexample.so+0x1248>  mov w0, wzr
    0x6e9bfe124c<libexample.so+0x124c>  ldp x29, x30, [sp], #0x20
    0x6e9bfe1250<libexample.so+0x1250>  ret
    0x6e9bfe1254<libexample.so+0x1254>  nop
    0x6e9bfe1258<libexample.so+0x1258>  nop

# Disassemble at specific address
(eDBG) list 0x6e9bfe1234

# Disassemble custom instruction count
(eDBG) list 0x6e9bfe1234 20

# Alternative command names
(eDBG) l 0x1234
(eDBG) disassemble 0x1234
```

--------------------------------

### Go: Create Library Information Structures

Source: https://context7.com/shinoleah/edbg/llms.txt

This Go code demonstrates the creation of library information structures, essential for addressing within a target process. It shows how to initialize a library object, resolve its path, and create address references using library offsets. This functionality is provided by the controller package.

```go
// Create library information for target shared library
library, err := controller.CreateLibrary(process, "libexample.so")
if err != nil {
    fmt.Println("Failed to locate library:", err)
    os.Exit(1)
}
fmt.Printf("Library path: %s\n", library.LibPath)
fmt.Printf("Library real path: %s\n", library.RealFilePath)

// Create address reference (library + file offset)
address := controller.NewAddress(library, 0x1234)

// Get absolute runtime address
absoluteAddr, err := process.GetAbsoluteAddress(address)
if err != nil {
    fmt.Println("Failed to resolve address:", err)
} else {
    fmt.Printf("Runtime address: 0x%x\n", absoluteAddr)
}
```

--------------------------------

### Clone and Build eDBG (Shell)

Source: https://github.com/shinoleah/edbg/blob/main/README.md

Clones the eDBG repository recursively to include submodules, prepares the build environment, and then compiles the project for ARM architecture. Assumes NDK is downloaded and configured.

```shell
git clone --recursive https://github.com/ShinoLeah/eDBG.git
./build_env.sh
./build_arm.sh
```

--------------------------------

### Go: Read and Write Target Process Memory

Source: https://context7.com/shinoleah/edbg/llms.txt

This Go code snippet shows how to read from and write to the memory of a target process using `process_vm_readv`/`writev` system calls. It includes robust reading for large memory regions, hexadecimal dumping, and attempting smart type detection for values. It also demonstrates reading the /proc/[pid]/maps file.

```go
// Read process memory
buffer := make([]byte, 256)
bytesRead, err := utils.ReadProcessMemory(pid, uintptr(0x6e9bfe0000), buffer)
if err != nil {
    fmt.Printf("Read failed: %v\n", err)
} else {
    fmt.Printf("Read %d bytes\n", bytesRead)
    fmt.Println(utils.HexDump(0x6e9bfe0000, buffer, bytesRead))
}

// Robust read for large memory regions (handles page boundaries)
largeBuffer, err := utils.ReadProcessMemoryRobust(pid, uintptr(0x6e9bfe0000), 16384)
if err != nil {
    fmt.Printf("Robust read failed: %v\n", err)
}

// Write process memory
data := []byte{0x48, 0x65, 0x6c, 0x6c, 0x6f} // "Hello"
bytesWritten, err := utils.WriteProcessMemory(pid, uintptr(0x6e9bfe0000), data)
if err != nil {
    fmt.Printf("Write failed: %v\n", err)
} else {
    fmt.Printf("Wrote %d bytes\n", bytesWritten)
}

// Try reading with smart type detection (pointer vs string)
success, formatted := utils.TryRead(pid, uintptr(0x6e9bfe0000))
if success {
    fmt.Printf("Value: %s\n", formatted) // Outputs "Hello World" or 0xDEADBEEF
}

// Read /proc/[pid]/maps
mapsContent, err := utils.ReadMapsByPid(pid)
if err == nil {
    fmt.Println(mapsContent)
}
```

--------------------------------

### eDBG Breakpoint Commands

Source: https://github.com/shinoleah/edbg/blob/main/README_EN.md

Illustrates various methods for setting breakpoints in eDBG, including by offset, memory address, library name with offset, and relative to the current instruction. These commands are crucial for pausing execution at specific points.

```shell
b 0x1234
b 0x6e9bfe214c
b library.so+0x1234
b $+1
```

--------------------------------

### eDBG Information and Management Commands

Source: https://github.com/shinoleah/edbg/blob/main/README_EN.md

Details commands for retrieving information about the debugging session and managing breakpoints. This includes listing breakpoints, showing registers, listing threads, and enabling/disabling/deleting breakpoints by their ID.

```shell
info b
info register
info thread
enable <id>
disable <id>
delete <id>
```

--------------------------------

### Unwind Call Stack (eDBG)

Source: https://context7.com/shinoleah/edbg/llms.txt

Generate call stack traces using two different algorithms: frame pointer (faster, requires specific compiler flags) and DWARF unwinding (more reliable but slower). These commands help in understanding the program's execution flow. Alternative commands are available.

```bash
# Backtrace using frame pointer (faster, requires -fno-omit-frame-pointer)
(eDBG) backtrace1
Backtrace (most recent call first):
#0  0x6e9bfe1234 in libexample.so + 0x1234
#1  0x6e9bfe5678 in libexample.so + 0x5678
#2  0x6e9bfe9abc in libexample.so + 0x9abc
#3  0x7ff8a3b1248 in libart.so + 0x12345
#4  0x7ff8a3c5678 in libart.so + 0x23456

# Backtrace using DWARF unwinding (more reliable, slower)
(eDBG) backtrace
Backtrace (most recent call first):
#0  0x6e9bfe1234 in libexample.so + 0x1234
#1  0x6e9bfe5678 in libexample.so + 0x5678
#2  0x6e9bfe9abc in libexample.so + 0x9abc
#3  0x7ff8a3b1248 in libart.so + 0x12345
#4  0x7ff8a3c5678 in libart.so + 0x23456

# Alternative commands
(eDBG) bt
(eDBG) bt1
(eDBG) bt2
```

--------------------------------

### eDBG Advanced Options and Commands (Shell)

Source: https://github.com/shinoleah/edbg/blob/main/README.md

This section covers advanced command-line options and debugging commands in eDBG. Options include thread filtering, configuration file usage, and disabling color output. Advanced commands include hardware breakpoints, watchpoints, finishing functions, writing memory, dumping memory, and displaying/undisplaying memory variables.

```shell
# Advanced Options:
# -t: Thread name filter
# -i filename: Use configuration file
# -s: Save progress to config file
# -o filename: Save progress to specified file
# -hide-register: Disable register output
# -hide-disassemble: Disable disassembly output
# -prefer: Specify breakpoint type (uprobe or hardware)
# -disable-color: Disable color output
# -disable-package-check: Disable package name check
# -show-vertual: Enable default virtual address display

# Advanced Commands:
# Hardware breakpoint
hbreak

# Write watchpoint
watch

# Read watchpoint
rwatch

# Finish function execution
finish / fi

# Run until address
until / u

# Write to memory
write <address> <hex_string>

# Dump memory to file
dump <address> <length> <filename>

# Display memory variables
display / disp <address>
display / disp <address> <length>
display / disp <address> <length> <variable_name>

# Undisplay memory variables
undisplay / undisp <id>

# Set symbol
set <address> <name>

# Thread commands
thread / t
thread / t + 0
thread / t - 0
thread / t all
thread / t +n <threadname>

# List/Disassemble code
list / l
list / l <address>
list / l <address> <length>
```

--------------------------------

### eDBG Breakpoint Commands (Shell)

Source: https://github.com/shinoleah/edbg/blob/main/README.md

This section outlines various methods for setting breakpoints using the eDBG CLI. It covers breakpoints based on offset, memory address, library name and offset, current position, and virtual offsets. It also includes commands to enable, disable, and delete breakpoints.

```shell
# Breakpoints by offset, memory address, library+offset, current offset
break / b 0x1234
break / b 0x6e9bfe214c
break / b libraryname.so+0x1234
break / b $ + 1

# Enable, disable, delete breakpoints
enable id
disable id
delete id

# Virtual offset breakpoint
vbreak / vb
```

--------------------------------

### Inspect Registers and Context (eDBG)

Source: https://context7.com/shinoleah/edbg/llms.txt

View and analyze the contents of all CPU registers and the current execution context. This command is essential for understanding the program's state at a given point. Alternative commands provide flexibility.

```bash
# Display all registers
(eDBG) info register
*X0     0x6E9BFE1000 ◂— "Hello World"
 X1     0x0
 X2     0x42
 X3     0x6E9BFE2000
*X4     0x7FF8A3B000 ◂— 0x48656C6C6F
 X5     0x0
[... registers X6-X28 ...]
 X29    0x7FF8A3AFF0
*LR     0x6E9BFE1248<libexample.so+0x1248>
*SP     0x7FF8A3AFF0
*PC     0x6E9BFE1234<libexample.so+0x1234>

# Alternative commands
(eDBG) info reg
(eDBG) info r
```

--------------------------------

### eDBG Information Display Commands (Shell)

Source: https://github.com/shinoleah/edbg/blob/main/README.md

This snippet lists commands for displaying various debugging information within eDBG. It includes commands to show breakpoint status, register contents, thread information, and file address/offset details. These commands are crucial for understanding the current state of the debugging session.

```shell
# List breakpoints
info b/break

# View register information
info register/reg/r

# List threads and filters
info thread/t

# Print file address and offset
info file/f
```

--------------------------------

### eDBG Memory Examination Commands

Source: https://github.com/shinoleah/edbg/blob/main/README_EN.md

Shows how to examine memory contents using the 'x' command in eDBG. It covers specifying an address, an address with a specific length, and an address with a data type. Addresses can include register names and expressions.

```shell
x 0x12345678
x 0x12345678 128
x X0 ptr/int/str
x SP+128 X1+0x58
```

--------------------------------

### eDBG Debugging Control Commands (Shell)

Source: https://github.com/shinoleah/edbg/blob/main/README.md

This snippet details the core commands for controlling the debugging process in eDBG. It includes commands for continuing execution, single-stepping (step into and step over), and quitting the debugger. These commands are essential for navigating through the execution flow of the target program.

```shell
# Continue execution to the next breakpoint
continue / c

# Single-step debugging
step / s
next / n

# Exit the debugger
quit / q
```

--------------------------------

### Convert ELF Addresses in Go

Source: https://context7.com/shinoleah/edbg/llms.txt

Converts between virtual addresses and file offsets for ELF files, essential for setting breakpoints. It provides functions to convert a virtual address to its corresponding file offset and vice versa, given the library path.

```go
// Convert IDA-style virtual address to file offset for uprobe
libPath := "/data/app/com.example.app/lib/arm64/libexample.so"
virtualAddr := uint64(0x12340)

fileOffset, err := utils.ConvertVirtualOffsetToFileOffset(libPath, virtualAddr)
if err != nil {
    fmt.Printf("Conversion failed: %v\n", err)
} else {
    fmt.Printf("Virtual 0x%x -> File offset 0x%x\n", virtualAddr, fileOffset)
    // Now use fileOffset for breakpoint
}

// Convert file offset back to virtual address for display
fileOffset := uint64(0x1230)
virtualAddr, err := utils.ConvertFileOffsetToVirtualOffset(libPath, fileOffset)
if err == nil {
    fmt.Printf("File offset 0x%x -> Virtual 0x%x\n", fileOffset, virtualAddr)
}
```

--------------------------------

### Manage ARM64 Register Context in Go

Source: https://context7.com/shinoleah/edbg/llms.txt

Manages ARM64 register context for stopped threads, allowing creation, access to individual and special registers, and assembly of the full register set for unwinding. It also integrates with process context for formatted output with symbol resolution.

```go
// Create process context
context := &controller.ProcessContext{
    Regs:   make([]uint64, 30), // X0-X29
    LR:     0x6e9bfe1248,
    PC:     0x6e9bfe1234,
    SP:     0x7ff8a3aff0,
    Pstate: 0x60000000,
}

// Access individual registers (W0-W30, X0-X31)
value := context.GetReg(0)  // X0
fmt.Printf("X0 = 0x%x\n", value)

// Access special registers
pc := context.GetPC()
sp := context.GetSP()
lr := context.GetLR()
pstate := context.GetPstate()

// Assemble full register set for unwinding
allRegs := controller.AssembleRegisters(context)
// Returns []uint64: [X0-X29, LR, SP, PC]

// Print formatted context with symbol resolution
process.Context = context
process.PrintContext()
```

--------------------------------

### View File and Library Information (eDBG)

Source: https://context7.com/shinoleah/edbg/llms.txt

Display memory mapping information for loaded libraries, including their base addresses, end addresses, and total size. This is essential for understanding how libraries are loaded into the process's memory space.

```bash
# Show library memory mapping information
(eDBG) info file
info file '/data/app/com.example.app/lib/arm64/libexample.so' :
--------------------------------------------------
  Base Address: 0x6e9bfe0000
  End Address : 0x6e9bff0000
  Total Size  : 0x10000
```

--------------------------------

### eDBG Memory and Stack Inspection Commands (Shell)

Source: https://github.com/shinoleah/edbg/blob/main/README.md

This section covers commands for inspecting the memory and call stack of the target program. The 'examine' command allows viewing memory content at specified addresses with customizable length and data types. The 'backtrace' command is used to view the call stack.

```shell
# Examine memory
examine / x <address>
examine / x <address> <length>
examine / x <address> <type> (e.g., ptr, str, int)
# Using registers as variables
examine / x SP+128 X1+0x58

# View call stack
backtrace / bt
backtrace1 / bt1
```

--------------------------------

### Disassemble ARM64 Instructions in Go

Source: https://context7.com/shinoleah/edbg/llms.txt

Disassembles ARM64 instructions and resolves addresses. It reads code from a target process, disassembles single instructions, and predicts the next Program Counter (PC) for stepping, handling branches by identifying conditional targets.

```go
// Read code from target process
codeBuf := make([]byte, 40) // 10 instructions * 4 bytes
_, err := utils.ReadProcessMemory(pid, uintptr(0x6e9bfe1234), codeBuf)

// Disassemble single instruction
instruction, err := utils.DisASM(codeBuf[0:4], 0x6e9bfe1234, process)
if err == nil {
    fmt.Println(instruction) // "stp x29, x30, [sp, #-0x20]!"
}

// Predict next PC for stepping (handles branches)
nextPC, err := utils.PredictNextPC(pid, context, true) // true = step into
if err == nil {
    if nextPC == 0xDEADBEEF {
        // Conditional branch - both paths need temporary breakpoints
        target, _ := utils.GetTarget(pid, context)
        fmt.Printf("Branch to 0x%x or fallthrough to 0x%x\n", target, context.PC+4)
    } else {
        fmt.Printf("Next PC: 0x%x\n", nextPC)
    }
}
```

--------------------------------

### Evaluate Expressions with Register References in Go

Source: https://context7.com/shinoleah/edbg/llms.txt

Parses user input expressions, supporting simple hex values, register names (e.g., X0, SP), and arithmetic expressions involving registers and constants. It also includes utilities for converting hex strings to byte slices and formatting memory dumps.

```go
// Parse simple hex values
value, err := utils.GetExprValue("0x1234", context)
// value = 0x1234

// Parse register names
value, err = utils.GetExprValue("X0", context)
// value = context.Regs[0]

value, err = utils.GetExprValue("SP", context)
// value = context.SP

// Parse arithmetic expressions
value, err = utils.GetExprValue("SP+128", context)
// value = context.SP + 128

value, err = utils.GetExprValue("X1+0x58", context)
// value = context.Regs[1] + 0x58

// Convert hexstring to bytes for memory writes
data, err := utils.HexStringToBytes("48656c6c6f")
// data = []byte{0x48, 0x65, 0x6c, 0x6c, 0x6f}

// Format memory dump
fmt.Println(utils.HexDump(0x6e9bfe0000, data, len(data)))
// Output:
// 0x6e9bfe0000:  48 65 6c 6c 6f  |Hello|
```

--------------------------------

### eDBG Breakpoint Management Commands

Source: https://context7.com/shinoleah/edbg/llms.txt

Commands for managing breakpoints within the eDBG interactive session. Supports setting software, hardware, and watchpoints at different address types (file offset, absolute, virtual). Includes commands to list, enable, disable, and delete breakpoints.

```eDBG
# Software breakpoint (uprobe) - file offset relative to initial library
(eDBG) break 0x1234
Breakpoint at libexample.so+0x1234

# Breakpoint using absolute memory address (process must be running)
(eDBG) b 0x6e9bfe214c

# Breakpoint in different library
(eDBG) b libother.so+0x5678
Breakpoint at libother.so+0x5678

# Relative to current instruction (+ instruction count, not bytes)
(eDBG) b $+1
Breakpoint at libexample.so+0x1238

# Virtual offset breakpoint (IDA-style address)
(eDBG) vbreak 0x1234
Breakpoint set at libexample.so+0x1230 (from virtual address 0x1234)

# Hardware breakpoint (maximum 4 active)
(eDBG) hbreak 0x1234
Breakpoint at 0x6e9bfe214c

# Write watchpoint (triggers on memory write)
(eDBG) watch 0x6e9bfe0000
Breakpoint at 0x6e9bfe0000

# Read watchpoint (triggers on memory read)
(eDBG) rwatch 0x6e9bfe0000
Breakpoint at 0x6e9bfe0000

# List all breakpoints
(eDBG) info break
[+] 0: libexample.so+0x1234
[-] 1: libexample.so+0x5678
[+] 2: 0x6e9bfe214c Hardware

# Enable/disable breakpoints by ID
(eDBG) disable 1
(eDBG) enable 1

# Delete breakpoint
(eDBG) delete 1
```

--------------------------------

### Perform DWARF Stack Unwinding in Go

Source: https://context7.com/shinoleah/edbg/llms.txt

Performs DWARF-based stack unwinding for backtrace generation. It prepares unwinding configuration, creates an unwind buffer with register state, reads stack memory, and processes memory maps to parse the stack.

```go
// Prepare unwinding configuration
opt := &utils.UnwindOption{
    Abi:       2,                    // ARM64
    RegMask:   (1 << 33) - 1,        // All 33 registers
    ShowPC:    true,
    StackSize: 8192,
    DynSize:   0,
}

// Create unwind buffer with register state
unwind_buf := &utils.UnwindBuf{
    Abi:       opt.Abi,
    Regs:      controller.AssembleRegisters(context),
    StackSize: 8192,
}

// Read stack memory
sp := context.SP
stack_data := make([]byte, opt.StackSize)
bytesRead, err := utils.ReadProcessMemory(pid, uintptr(sp), stack_data)
if err != nil {
    fmt.Printf("Failed to read stack: %v\n", err)
    return
}
unwind_buf.Data = stack_data[:bytesRead]
unwind_buf.DynSize = uint64(bytesRead)
opt.DynSize = uint64(bytesRead)

// Read process memory maps
maps_content, err := utils.ReadMapsByPid(pid)
if err != nil {
    fmt.Printf("Failed to read maps: %v\n", err)
    return
}

// Perform unwinding
stackTrace := utils.ParseStack(maps_content, opt, unwind_buf)
fmt.Println("Backtrace (most recent call first):")
fmt.Println(stackTrace)
// Output:
// #0  0x6e9bfe1234 in libexample.so + 0x1234
// #1  0x6e9bfe5678 in libexample.so + 0x5678
// #2  0x6e9bfe9abc in libexample.so + 0x9abc
```

--------------------------------

### Manage Debugging Sessions (eDBG)

Source: https://context7.com/shinoleah/edbg/llms.txt

Save and restore debugging sessions using a JSON configuration file. This allows for persistent debugging states, including breakpoints and thread filters. The session file specifies package name, library names, and breakpoint configurations.

```json
// Example session.edbg configuration file
{
  "ConfigVersion": 1,
  "packagename": "com.example.app",
  "libname": "libexample.so",
  "hidereg": false,
  "hidedis": false,
  "brk": [
    {
      "brklib": "libexample.so",
      "offset": 4660,
      "enable": true
    },
    {
      "brklib": "libother.so",
      "offset": 22136,
      "enable": false
    }
  ],
  "tname": [
    "WorkerThread",
    "NetworkThread"
  ]
}
```

```bash
# Load session
./eDBG -i session.edbg

# Save to input file on exit
./eDBG -i session.edbg -s

# Save to specific output file
./eDBG -i session.edbg -o output.edbg
```

--------------------------------

### Manage Symbols (eDBG)

Source: https://context7.com/shinoleah/edbg/llms.txt

Assign custom names to memory addresses for easier navigation and understanding of code. These symbols are then displayed in context, such as during register inspection. This command aids in reverse engineering and debugging complex codebases.

```bash
# Set symbol name for address
(eDBG) set 0x6e9bfe1234 main_loop
(eDBG) set libexample.so+0x5678 init_function

# View symbols in context output
(eDBG) info register
*PC     0x6E9BFE1234<libexample.so+0x1234> <main_loop>
```

--------------------------------

### Manage Debugging Threads (eDBG)

Source: https://context7.com/shinoleah/edbg/llms.txt

Filter debugging activity by thread ID or name. Commands allow listing all threads, adding/removing filters by index or name, clearing all filters, and viewing active filters. This is crucial for multi-threaded applications.

```bash
# List all threads
(eDBG) thread
Available threads:
[0] Thread 12345: main
[1] Thread 12346: Thread-2
[2] Thread 12347: WorkerThread
[3] Thread 12348: GC

# Add thread filter by index (from list above)
(eDBG) thread + 0

# Remove thread filter
(eDBG) thread - 0

# Add thread name filter
(eDBG) thread +n WorkerThread

# Clear all thread filters
(eDBG) thread all

# View active thread filters
(eDBG) info thread
Available threads:
[0] Thread 12345: main
[1] Thread 12346: Thread-2
[2] Thread 12347: WorkerThread
[3] Thread 12348: GC
Thread filters:
[0] ThreadID: 12345
[1] ThreadName: WorkerThread
```

--------------------------------

### eDBG Execution Control Commands

Source: https://context7.com/shinoleah/edbg/llms.txt

Commands to control the execution flow of the debugged process. Includes options to continue execution, step into functions, step over function calls, finish the current function, and execute until a specific address.

```eDBG
# Continue execution until next breakpoint
(eDBG) continue

# Step into (enter function calls)
(eDBG) step

# Step over (skip function calls)
(eDBG) next

# Execute until current function returns
(eDBG) finish

# Execute until specific address
(eDBG) until 0x1234
(eDBG) until libother.so+0x5678

# Repeat last command (just press Enter)
(eDBG)

```

--------------------------------

### eDBG Memory Examination and Modification Commands

Source: https://context7.com/shinoleah/edbg/llms.txt

Commands for inspecting and modifying process memory. Supports examining memory at specific addresses with different formats (hexdump, pointer, string, integer) and lengths. Includes writing to memory, dumping memory regions to a file, and setting up auto-display of memory on events.

```eDBG
# Examine memory at address (default 16 bytes, hexdump format)
(eDBG) examine 0x6e9bfe0000
0x6e9bfe0000:  48 65 6c 6c 6f 20 57 6f  72 6c 64 00 00 00 00 00  |Hello World.....|

# Examine with custom length
(eDBG) x 0x6e9bfe0000 128

# Examine using register values
(eDBG) x X0
(eDBG) x SP+128
(eDBG) x X1+0x58 64

# Display as pointer (8 bytes)
(eDBG) x X0 ptr
0x6e9bfe1000

# Display as string (until non-printable character)
(eDBG) x X0 str
Hello World

# Display as integer (4 bytes)
(eDBG) x SP int
42

# Write memory (hexstring format, address must be writable)
(eDBG) write 0x6e9bfe0000 48656c6c6f
5 bytes written.
0x6e9bfe0000:  48 65 6c 6c 6f

# Dump memory region to file
(eDBG) dump 0x6e9bfe0000 4096 memory.bin
Saved 4096 bytes to memory.bin

# Auto-display memory on each breakpoint/step
(eDBG) display 0x6e9bfe0000 64 myvar
(eDBG) display SP 128

# Remove auto-display
(eDBG) undisplay 0
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.