1

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?

I've used trace over option, but basically it just traces all the insturctions but doesn't "step in" into a call statement.

Here I found a way to do this using windbg(notice the treeview of functions and return values), but is there any way I can do same using x64dbg? or maybe trace all the api calls of a module. thanks.

1

It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which will log the module name, address and the instruction after a space.

As far as I am concerned, there is unfortunately no support for string comparison in x64dbg, so you cannot write something like {modname@rip}==some_module_name in Log condition field. However, you may use the module entry point as a module identifier, like here: x64dbg_log_condition

After clicking OK button, only instructions in the specified module will appear in the log panel and you should see something like this:

x64dbg_log

The only problem that is still to solve is to find the module entry address. I've done it by logging every module name and entry point until I find the relevant one. If I find any better way to do that, I will update my answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.