Log EIP while in a certain memory range?

Question

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range conditional working.

Open to ideas.

Answer 1

I have one solution after mucking around for a while, I'm sure I can find something better, in the meantime however here you go.

Using the 'Memory Map' Tab you can create a memory breakpoint on code sections

Right click on a section->Memory Breakpoint->Execute->Restore

Then you can edit the breakpoint condition to be something like this (I am using a 64 bit process)

I just figured out how to reduce the range of this.

You can use Log Condition like this:

00007FF6D2F71000 < rip < 00007FF6D2F72000

which is symbolically

start_address < eip < end_address

or

start_address < rip < end_address

It works pretty well. I'll update if I find any better alternatives

EDIT:

https://x64dbg.readthedocs.io/en/latest/introduction/Expression-functions.html https://x64dbg.readthedocs.io/en/latest/introduction/Expressions.html

Read some of the docs for the cool stuff you can do

I managed to get it to log only call instructions, and print the address and instruction using

dis.iscall(rip) in Break Condition and

{rip}:{i:rip} in Log Expression

Thanks for asking this question, this is actually really useful stuff I never thought of before.