The Fathom debugger,
without the window.
headless.exe and the full x64dbg-based engine of Fathom for x64 and x32 — no Qt GUI, 13 MB. Debug Windows programs from scripts, standard input, PowerShell templates or Python: on a server, in an analysis VM, in CI.
PS> .\x64\headless.exe -cf trace.txt [pluginload] ExtraCmds [pluginload] pybridge Debugging: C:\samples\target.exe INT3 breakpoint "entry breakpoint" at <target.OptionalHeader.AddressOfEntryPoint> Started trace recording to file: C:\work\trace.trace64 Trace finished after 2000 steps! Exported 2000 instructions to C:\work\trace.json Exported 2000 instructions to C:\work\trace.log
What's in the box
The same engine build as Fathom, with everything that works without a GUI.
x64 and x32 engine
headless.exe, x64dbg.dll / x32dbg.dll, TitanEngine, GleeBug — every x64dbg command, script and expression.
TraceExport
Record execution traces and export them to JSON, CSV, or Tenet / Frinet to explore them in IDA Pro.
Plugins
pybridge (Python), ExtraCmds, ScyllaHide, xAnalyzer, plus PE-sieve and the HvKdFusion / wineye scripts.
Templates
Twelve ready-made scripts — API logging, unpacking dumps, pattern search, traces — and a launcher with isolated settings.
Quick start
Windows 10 / 11. No installer: extract and run.
- Download
fathom-headless_1.0.0.zip. - Extract it into a folder you can write to, e.g.
C:\Tools\fathom-headless. - Run a template, or your own script:
cd C:\Tools\fathom-headless .\run-headless.ps1 -Template api-log -Target C:\Windows\System32\whoami.exe .\x64\headless.exe -cf C:\work\trace.txt
Use x64\headless.exe for 64-bit programs and x32\headless.exe for 32-bit ones. Numbers in commands are hexadecimal by default (.100 = 100).
Four ways to drive it
All of them run the same commands as the x64dbg command bar.
Script
headless.exe -cf script.txt runs a script at startup, then keeps reading commands from standard input.
Interactive
Type init, bp, run, StepOver, log... on standard input — locally or over SSH.
Templates
run-headless.ps1 -Template <name> -Target <exe> fills a template and collects the results in out\.
Python
Debugger.launch(r"C:\Tools\fathom-headless") with pybridge: breakpoints, memory, registers from Python.
// trace.txt init "C:\samples\target.exe" StartTraceRecording "C:\work\trace.trace64" TraceIntoConditional 0, .2000 StopTraceRecording TraceExport "C:\work\trace.trace64", "C:\work\trace.json" TraceExport "C:\work\trace.trace64", "C:\work\trace.log", tenet
Templates
%TARGET%, %MODULE%, %OUT% and %BITS% are filled in by the launcher.
| Template | Purpose |
|---|---|
api-log, hook-apis-extended | log API calls with their arguments, without pausing |
trace-export, run-trace | record a trace from the entry point and export JSON / CSV / Tenet |
hook-unpack, unpack-dump | follow runtime unpacking and dump the region flipped to executable |
dump-module, dump-at-delay | save the main module and a full minidump |
break-on-file | conditional breakpoint on a file open, then automatic actions |
antidebug | hide the debugger and log anti-debug probes |
find-pattern | search a hex or ASCII pattern over the whole memory map |
emulate-dump | emulate a .dmp and serve it to pybridge |
Good to know
A debugger writes into the memory of the process it debugs, which antivirus behaviour monitors can take for injection: for malware analysis, work in a VM with an exclusion for the package folder. Use it on programs you are allowed to analyse.