1

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the debugger stops executing. Is there are a tool to remove anti-debugging and do a dynamic analysis? Also, Ghidra was able to find the text string that I need to concentrate my RE on. However, that address does not match the x64dbg address at all.

Ghidra found the text string at address with 8 hex digits:

01A0FB74

x64dbg all address are 16 hex:

 10009000ffbb9123

How do I translate Ghidra address to x64dbg address so I can see the instructions? I am new to RE. I need some guidance.

3 Answers 3

1

I have experienced this in the past with different tools, too. What I have done is find something easy to locate in both tools, such as the DLL Main of a library or Entry Point of the PE file (or another string) etc. Then you can calculate the offset between the two tools. Depending on the program, it can change with each run of the debugger. What X64dbg is doing is creating a process and using the offsets where Windows is loading the PE file.

For example, if my static analysis tool (i.e. Ghidra) says the entry point of my PE file is at 0x1000 and x64dbg says the entry point is at 0x400000 then my offset is 0x3FF000, so I find something interesting in Ghidra then I can add 0x3FF000 and possibly find it in x64dbg. This doesn't always work because the PE file can specify that some sections are loaded at different addresses.


0

The PE header specifies how something is mapped into memory and contains relocation information that's fixed up by the loader so everything can find other sections/functions/etc.

In general if nothing fun is going on like packing/self-extracting, then all you need to is look at which memory section you're in Ghidra (the thing in program trees off to the left, probably .data or .rdata). At the top of that it'll say something like "ram:01A00000 - 01A10000".

PE allows sections to say "I need to be loaded into base address X". If this section does that, those numbers will likely be correct. Most sections don't do that and that's fine.

All you need to do is perform the same operation the loader would when fixing up relocations. You know the base address is 01A00000, you found what you're looking for at 01A0FB74 so the offset to this is 01A0FB74 - 01A00000 or FB74.

So now look in the memory map section of x64dbg. You'll see those same sections with the same names. You'll likely actually see several .data or .rdata sections, one for each PE module loaded (EXE is a module as is a DLL). Next to the section for the module you're looking at will be its base address in memory. Add FB74 (or whatever your offset actually is) to that and go there. That should be where you want to go.

0

x64dbg lets you jump to both file and RVA offsets, for example, here's what it looks like when we're debugging the GOG version of Diablo:

x64dbg debugging Diablo

The address in memory is 46BC30 where the executable was loaded. If you look in the memory map tab you'll see that the base of the executable is 400000, and this is also where the executable expects to be loaded, so no relocation has happened. In this case, the addresses will line up perfectly between Ghidra and x64dbg.

If we look at the bottom of the screen we can see a few other addresses:

.text:46BC30 diablo.exe:$6BC30 #6B030

The $xxxxx value is the Relative Virtual Address (RVA) and you can just do ImageBase + 6BC30 to find the address that Ghidra will use, and you can also use 6B030 to find this offset in the file. You can also search for these #xxxxx and $xxxxx addresses in x64dbg to jump straight to RVAs and file offsets:

x64dbg jumping to file offset

x64dbg jumping to RVA

You'll still need to find the ImageBase in the file to add to the RVA when searching in Ghidra, but you'll get better at this with time. The nice thing is that you'll know if you're guessing correctly because you'll see the same disassembly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.