v1.1.0 - GUI

macdbg is now a native macOS debugger GUI, styled after x64dbg and WinDbg. It runs on the same LLDB engine as the old TUI, so it keeps the full feature set: stepping, breakpoints with conditions and command scripts, register and memory editing, the syscall and network tracer, the anti-anti-debug suite, fork and exec sandboxing, watches, comments, and a command palette over every lldb command.

The window shows disassembly, registers, memory, stack, and watches at once, with tabs for breakpoints, call stack, threads, modules, strings, patches, and the trace, plus an lldb console at the bottom.

Run it:

git clone https://github.com/MZHeader/macdbg
cd macdbg/GUI
./run.sh /path/to/your/binary

Or open GUI/macdbg.app.

The native window needs pywebview. Install it with pip install pywebview, or download a prebuilt offline bundle for your Python from the native-deps release and run GUI/get-native-deps.sh. Without pywebview the GUI opens in a browser window instead.

The old Textual TUI is kept as the v1.0.0 - TUI release.

Needs an Apple Silicon Mac with the Xcode Command Line Tools.

Native deps: pywebview and pyobjc (macOS arm64)

These are pywebview and pyobjc bundles for the macdbg GUI's native window, one per CPython version, built for macOS on Apple Silicon. Grab the one for your Python and the GUI opens a real native window with no pip install. They also work offline.

The easy way is the helper script. It finds the bundle that matches your Python, downloads it, and checks that it imports:

GUI/get-native-deps.sh

On an offline or air-gapped machine, download the pywebview-macos-arm64-cp<XY>.tar.gz that matches your Python version, copy it across, and point the same script at it:

GUI/get-native-deps.sh ./pywebview-macos-arm64-cp313.tar.gz

Either way, GUI/run.sh picks up the extracted bundle on its own. If it isn't there, the GUI opens in a browser window instead, or you can just run pip install pywebview.

There's a bundle for every Python from 3.9 to 3.14 (cp39 through cp314), all macOS arm64.

v1.0.0 - TUI

First release of macdbg, a Textual TUI for Apple's system LLDB.

Included in this release:

• Multi-pane view of the running process. Disasm, registers, stack, memory, breakpoints, threads, modules, trace, and a console at all times.
• Register auto-annotation. Each value gets resolved to a symbol, a printable string, a one-hop pointer chase, or a raw peek if the address falls in a loaded module.
• In-place editing of registers and memory rows via right-click. Direct SBValue and SBProcess writes with read-back verification.
• Breakpoint scripting UI. Right-click a bp row for a full-screen editor that saves back to the breakpoint's command list. Output from auto-continue scripts is captured through a pipe and printed in the console.
• Syscall and network tracer (Ctrl+T) with 60+ symbols across file, process, and network APIs. Caller-depth filter that catches indirect dispatch through GCD, objc_msgSend, libcurl, and CFNetwork. Scope cycles with Ctrl+Y.
• Anti-anti-debug menu (Ctrl+D) with PT_DENY_ATTACH symbol hook, direct-syscall ptrace scan, Mach exception port cloak, and hardware BP modes for user and tracer breakpoints. Verified end-to-end against a canary that runs all four checks.
• Command palette (Ctrl+P) that fuzzy-matches over every lldb command with lldb's own help text.
• ASLR disabled by default so addresses stay stable across runs.
• Textual vendored under ./vendor so the wrapper runs offline on a fresh clone.

Requires macOS with Xcode Command Line Tools and system Python at /usr/bin/python3.