Overview

What is IDA Debugger?

The IDA Debugger is an integrated dynamic analysis feature built into IDA that lets you execute and inspect programs directly within the IDA environment. Rather than switching between a disassembler and an external debugging tool, IDA Debugger bridges static and dynamic analysis in a single workflow. You can set breakpoints, step through instructions, inspect registers and more, all without leaving IDA.

Where to find it

Debugger functionality is primarily accessed through the Debugger menu. On first use, select a debugger to populate the list of available actions. From there you configure process options (application path, hostname, port, password), manage breakpoints, and open debugger-specific windows such as Locals, Watches, Stack Trace, and the Tracing window.

You can also launch the debugger directly from the command line without creating a database in advance using the -r switch (see the Instant Debugger section below).

Debugger Modes

The IDA Debugger offers a few available modes, depending on your target and needs.

Local Debugging

Local debugging runs the target process on the same machine as IDA. This is the simplest setup and requires no additional configuration beyond selecting the right backend for your platform. IDA ships with local debugger backends for:

• Windows via the Win32 backend or the WinDbg backend (which also supports kernel-mode debugging and Time Travel Debugging)

• Linux via the Linux debugger backend

• macOS via the Intel/ARM macOS debugger backend

Remote Debugging

Remote debugging lets IDA control a process running on a separate machine. This is essential when the target environment cannot run IDA itself (such as an Android device, an embedded Linux board, or a remote Windows server).

The workflow is straightforward: you start a lightweight debugger server on the remote host and then connect to it from IDA using the Debugger → Process Options dialog, where you specify the hostname, port, and an optional password.

Instant Debugger (Command-Line)

The -r switch lets you start a debugging session directly from the command line, skipping the normal database creation step. The full format is:

ida -rdebname{params}:pass@hostname:port+pid

Specialized Debugger Modes

Beyond the standard local and remote modes, IDA offers several specialized debugger backends for specific use cases.

Android Native Debugger

Targets ARM32, AArch64, x86, and x86_64 Android processes. Both ARM and Thumb mode code are supported, and multithreaded applications can be debugged.

Dalvik Debugger

A dedicated plugin for debugging Android applications running on the Dalvik Virtual Machine, with full source-level debugging support. It integrates with the Android Debug Bridge (adb) and requires the package name and activity from AndroidManifest.xml to launch an application.

Remote iOS Debugger

Allows debugging iOS applications from IDA by acting as a client to Apple's debugserver, which must already be installed on the target device. It supports both traditional iOS debugging and the newer CoreDevice approach introduced in iOS 17.

Replayer Debugger

A pseudo-debugger for replaying previously recorded execution traces. Traces can be recorded at instruction level, function level, or basic block level using any of IDA's supported debugger backends. The key advantage of the replayer is the ability to step backwards through a trace — the Debugger → Step Back command — making it significantly easier to reconstruct what happened during a specific execution.