2

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range conditional working.

Open to ideas.

2

I have one solution after mucking around for a while, I'm sure I can find something better, in the meantime however here you go.

Using the 'Memory Map' Tab you can create a memory breakpoint on code sections

Right click on a section->Memory Breakpoint->Execute->Restore

Then you can edit the breakpoint condition to be something like this (I am using a 64 bit process)

Editing memory execute breakpoints to log EIP/RIP

I just figured out how to reduce the range of this.

You can use Log Condition like this:

00007FF6D2F71000 < rip < 00007FF6D2F72000

which is symbolically

start_address < eip < end_address

or

start_address < rip < end_address

It works pretty well. I'll update if I find any better alternatives

EDIT:

https://x64dbg.readthedocs.io/en/latest/introduction/Expression-functions.html https://x64dbg.readthedocs.io/en/latest/introduction/Expressions.html

Read some of the docs for the cool stuff you can do

I managed to get it to log only call instructions, and print the address and instruction using

dis.iscall(rip) in Break Condition and

{rip}:{i:rip} in Log Expression

Thanks for asking this question, this is actually really useful stuff I never thought of before.

1
  • 1
    That's exactly what I wanted. Thanks for the help! – mudsy Nov 3 '17 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.