Building a Debugger Write a Native X64 Debugger From Scratch (Sy Brand) (Z-Library)

【One-Line Pitch】 A hands-on guide that turns debugger "magic" into engineering by walking you through building a native x64 Linux debugger in C++, from attaching to a process to unwinding stacks and evaluating expressions. Best for systems programmers, reverse engineers, and tool developers who want deep, practical insight into how debugging actually works. 【Book Arc】 - **Opening (~0%–13%)**: Sets up the project and mental model — directory structure, CMake, dependency management with vcpkg, and the compilation/architecture background (encoding, debug info, virtual memory, signals) needed before touching a live process. - **Early (~13%–32%)**: Gets you attached to a running program — process launch/attach via ptrace, error handling, resuming and waiting on signals, then pipes, procfs, and automated testing to make the debugger testable. - **Middle (~32%–55%)**: Core inspection and control — reading/writing x64 registers, validating them with assembly, software breakpoints, memory and disassembly, hardware breakpoints and watchpoints, and signal/syscall handling. - **Late (~55%–80%)**: Connects machine code back to source — ELF object files, DWARF debug information, line tables, source-level breakpoints and stepping, call frame information, and stack unwinding. - **Ending (~80%–100%)**: Advanced runtime features — shared libraries, multithreading, DWARF expressions, variables and types, expression evaluation, and a final advanced-topics chapter, plus appendix answers and a glossary. 【Key Takeaways】 - **A debugger is mostly an OS client** (Early): attaching, resuming, and waiting on signals all ride on ptrace and Linux process semantics, so the book teaches kernel behavior alongside tool code. - **Registers are the first real interface to a process** (Early/Middle): reading and writing general-purpose, floating-point/vector, and debug registers, with x64 assembly tests to confirm your understanding. - **Breakpoints come in two flavors with different trade-offs** (Middle): software breakpoints patch instructions and need site management, while hardware breakpoints/watchpoints use debug registers and watch memory access. - **Disassembly and memory inspection make state legible** (Middle): turning raw bytes into instructions and readable memory is what makes the debugger usable rather than just a process controller. - **Debug info is a bytecode problem, not a lookup table** (Late): ELF and DWARF — line tables, call frame information, DWARF expressions — must be parsed and interpreted to map machine code to source. - **Stack unwinding is the payoff of CFI** (Late): backtraces depend on correctly interpreting call frame information, which is why it gets its own chapter before unwinding. - **Real programs are shared and multithreaded** (Ending): shared library tracing and multithreading support are treated as advanced features layered on the core debugger. - **Expression evaluation ties variables, types, and DWARF together** (Ending): locating and visualizing variables and calling functions in the debugged process is the culmination of the debug-info work. 【Reading Tips】 - Treat Chapters 1–4 as setup you must actually do, not skim — the testing infrastructure (pipes, procfs, automated tests) pays off for every later feature. - Deep-read Chapters 5–9 if you care about breakpoints and registers; these are the most reusable mechanics for day-to-day debugging. - Expect Chapters 11–16 (ELF, DWARF, CFI, unwinding) to be the hardest stretch — slow down and keep the glossary and "Check Your Knowledge" answers handy. - Skim Chapter 22 on a first pass; return to it after the core debugger works. - Keep a working build and run the tests as you go; this is a build-along book, not a read-only one. 【Coverage Limits】 This guide is based on stratified excerpts covering the front matter, table of contents, and early-to-middle chapter structure; later chapters are summarized from their titles and brief mentions, so specific implementation details beyond the excerpts are not covered.