I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking for.

But, just out of curiosity, is it possible to find what initially writes to this memory space? It seems to be dynamically allocated as comparing the dumps of the memory space is not identical, and the offset from the start of the block changes each time.

I have tried to put a breakpoint on the memory space, but as it has already been written, I can't back track to see what wrote to it (or can I?).

Or am I completely off track?

  • Place a "Hardware - Write" Breakpoint on the address in the dump window. It will break whenever a instruction modifies the data at your address. – Michael Pittino Aug 20 '17 at 14:13

If you were under gdb, I would advise you to use a watchpoint (which can be specified by an arbitrary formula possibly including registers).

In the case of x64dbg, what you are looking for are called "Memory Breakpoint".

I would advise you to look for these "Memory breakpoints" in this very complete tutorial on x64dbg or directly from the official documentation.

As I am not an x64dbg user, I do not know if it allows complex formula (as it is in gdb now). But, I hope that this will be the case.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.