NinjaDBG

Everything you need to debug stealthily

From low-level ptrace control to high-level decompilation — all in one tool.

Anti-Detect Stealth

8 userland + 8 kernel-level techniques to hide from anti-debug checks. Mask TracerPid, hide 0xCC bytes, spoof parent names, intercept PTRACE_TRACEME, and more.

16 techniques

Native C Decompilation

Decompile functions in live processes or static binaries via Avast RetDec (native dlopen) or angr. Decompile at current RIP with one command.

RetDec + angr

Lua + Python Scripting

Automate debugging with full ndbg API in both Lua and Python. JSON-RPC subprocess bridge — no library dependencies, full isolation.

JSON-RPC

Pretty Printers

Interpret raw memory as language-specific types: C strings, std::string (SSO-aware), Rust String, Go string, CPython str, and structs.

NEW v1.1.4

CLI-only (GUI removed in v1.1.4)

Full-featured CLI REPL (the only interface; GUI was removed in v1.1.4) 30+ commands, batch mode, interactive TUI memory editor.

CLI-only

Binary Patching

Patch ELF/PE/Mach-O binaries in-place: NOP, JMP always/never, CALL→NOP, force-return-true, ASCII replace. Undo any patch. Save without overwriting source.

7 patch kinds

Cross-Platform

Debug Linux ELF (native ptrace), Windows PE (via Wine + gdbstub), and macOS Mach-O (via QEMU). Auto-detects target platform from magic bytes.

Linux + Win + Mac

Advanced Debugging

Conditional + temporary breakpoints, hardware watchpoints (DR0-DR3), step-over, step-out, syscall stepping, backtrace with symbol resolution.

Full feature set

Open Source (Apache-2.0)

Full source code available. Free for personal, academic, and commercial use. Fork it, modify it, contribute back. No restrictions.

NEW v1.1.4

16 anti-detect techniques

Hide from every common anti-debug check — at both userland and kernel level.

#	Technique	Defeats	Layer
1	Hardware Breakpoints (DR0-DR3)	INT3 byte scans of `.text`	Userland
2	`process_vm_readv/writev`	ptrace-event observation	Userland
3	Mask `/proc/self/status`	`TracerPid:` field read	Userland
4	Hide NinjaDBG mmaps	Address-space enumeration	Userland
5	Timing normalization	RDTSC / clock_gettime checks	Userland
6	Parent name masquerade	`/proc/ppid/comm` inspection	Userland
7	Hide from ps	`readdir(/proc)` enumeration	Userland
8	INT3 scan bypass	Self-`.text` scanning for `0xCC`	Userland
9	Hide PID from /proc	Kernel `proc_readdir()` hook	Kernel (LKM)
10	Mask `/proc/self/wchan`	wchan returning `ptrace_stop`	Kernel (LKM)
11	Mask `/proc/self/syscall`	Syscall field showing stopped nr	Kernel (LKM)
12	Mask `/proc/<pid>/comm`	comm field reading `ninjadb`	Kernel (LKM)
13	Suppress tracer SIGCHLD	Timing via extra SIGCHLD	Kernel (LKM)
14	Force PR_SET_DUMPABLE=1	`prctl(PR_GET_DUMPABLE)` returning 0	Kernel (LKM)
15	Intercept PTRACE_TRACEME	Target's self-TRACEME succeeding	Kernel (LKM)
16	Hide our mmap regions	Target enumerating `/proc/<pid>/maps`	Kernel (LKM)

Decompile to C source

Wrap RetDec natively or use angr — decompile live processes or static binaries.

ninjadb

(ninjadb) decomp set angr
(ninjadb) decomp file /tmp/test_factorial 0x401139
Decompiling function at 0x0000000000401139 in /tmp/test_factorial ...
Backend: angr Elapsed: 1896 ms
Function: sub_0x401139

---- function factorial at 0x401139 ----
int factorial(int a0)
{
 return (a0 <= 1 ? 1 : a0 * factorial(a0 - 1));
}
 

Verified working — angr func.normalize() fix applied in v1.1.4

Pretty Printers per language

Interpret raw memory as language-native types — no more hex dumps.

char*, structs

C++

std::string (SSO)

Rust

String, &str

string, slices

Python

PyUnicodeObject

pretty print examples

(ninjadb) pretty set cpp
(ninjadb) pretty cpp_string 0x7ffe1000
(std::string) 0x7ffe1000 = "Hello, world!" (len=13, SSO, data=0x7ffe1010)

(ninjadb) pretty rust_string 0x7ffe2000
(String) 0x7ffe2000 = "Hello, world!" (len=13, cap=13, ptr=0x55aabbccdd00)

(ninjadb) pretty struct 0x7ffe3000 i32,str,ptr,u64
struct at 0x7ffe3000:
 +0x0 i32 = 42 (0x2a)
 +0x8 ptr = 0x401234 -> "hello world"
 +0x10 ptr = 0x7ffe5678
 +0x18 u64 = 139832 (0x22238)
 

Why NinjaDBG?

What you get with NinjaDBG vs. traditional debuggers.

With NinjaDBG

16 anti-detect techniques (userland + kernel)

Native C decompilation (RetDec + angr)

Lua + Python scripting

Pretty printers for 5 languages

Binary patching (ELF/PE/Mach-O)

Cross-platform (Linux/Win/Mac)

Interactive TUI memory editor

Open Source (Apache-2.0)

Traditional debuggers (gdb, lldb)

No anti-detect — easily spotted by targets

No built-in decompilation

Scripting limited to Python (gdb) or Lua (lldb)

No language-aware pretty printers

No binary patching

Platform-locked (gdb=Linux, lldb=Mac)

No interactive memory editor

GPL license (gdb) — restrictive for commercial use

Everything you need to debug stealthily

Anti-Detect Stealth

Native C Decompilation

Lua + Python Scripting

Pretty Printers

CLI-only (GUI removed in v1.1.4)

Binary Patching

Cross-Platform

Advanced Debugging

Open Source (Apache-2.0)

16 anti-detect techniques

Decompile to C source

Pretty Printers per language

Why NinjaDBG?

With NinjaDBG

Traditional debuggers (gdb, lldb)

Get started in 30 seconds

Ready to debug stealthily?