4

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:

  • I found no way to label locals in the debugger window.
  • There's Locals tab in the bottom panel. I can give names to locals there, but they don't propagate to the main window.
  • I can rename variables in the decompiler window, but again, they don't sync with the debugger window.

If x64dbg lacks this functionality, is there any plugin that achieves this?

  • Often reverse engineers do dynamic and static analysis side by side. You start off with Binja/IDA/radare2 and annotate information from the dynamic analysis. These tools can save this information and offer more functionality. – Nordwald Oct 26 '17 at 4:49
1

Two ways to label local variables in x64dbg:

  1. In x64dbg, follow in dump at address of local var (like this [ebp-4]). Right click at this address and select Add label, then name the label.

enter image description here

Now in the CPU window, local var is displayed like the following picture:

enter image description here

  1. Try the labeless plugin : https://github.com/a1ext/labeless/ to sync from IDA to x64dbg.

Regards;

3

Local variables labeling is not yet supported by x64dbg and as far as I know there's no plugin to achieve that.

However, you can still label a specific memory address. You can do this by selecting the address and press :, or right click it and select Label >> Label Current Address.

If you want this functionality you can ask for it on the x64dbg's Github repository or even implement it by yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.