I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking for.

But, just out of curiosity, is it possible to find what initially writes to this memory space? It seems to be dynamically allocated as comparing the dumps of the memory space is not identical, and the offset from the start of the block changes each time.

I have tried to put a breakpoint on the memory space, but as it has already been written, I can't back track to see what wrote to it (or can I?).

Or am I completely off track?

  • 1
    Place a "Hardware - Write" Breakpoint on the address in the dump window. It will break whenever a instruction modifies the data at your address. Commented Aug 20, 2017 at 14:13
  • @MichaelPittino Yes, but how can we find out which instruction performs that access? How can we get to disassembly to see it?
    – KeyC0de
    Commented Oct 20, 2019 at 0:07

1 Answer 1


If you were under gdb, I would advise you to use a watchpoint (which can be specified by an arbitrary formula possibly including registers).

In the case of x64dbg, what you are looking for are called "Memory Breakpoint".

I would advise you to look for these "Memory breakpoints" in this very complete tutorial on x64dbg or directly from the official documentation.

As I am not an x64dbg user, I do not know if it allows complex formula (as it is in gdb now). But, I hope that this will be the case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.