I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program. how to get the references from program itself? is it protected?

enter image description here

  • 1
    If you wanted to conceal the name of the module you should also have looked at line four inside the disassembly :) ... btw: I think the debuggers use heuristics in order to show you cross-references. There are bound to be some false positives.
    – 0xC0000022L
    Commented Jun 15, 2018 at 7:31
  • Click right button, search for -----> all modules ---> strings references. Commented Apr 11, 2021 at 17:41

2 Answers 2


When x64dbg attaches to a process it will first stop at the 'Attach breakpoint'. The button to search for string references will search the module currently shown in the disassembly. To search in another module you simply have to go there.

One way to do this is to go to the Symbols tab and double click the module you are interested in. This should take you to the code section of the module. From there you can press the button to search for string references.

  • 1
    That was what I did but wasn't working (always going back to ntddl.dll or some other module), until I RMB on the module and selected "Follow Entry point in Disassembler" then I was able to search for strings in my target module.
    – KeyC0de
    Commented Oct 19, 2019 at 20:15

The way is:

Debug -> Run to user code

Then you will see the strings of the program itself. x64dbg/x32dbg as any other debugger, walks you trough all the process initialization code before entering your "main".

  • 1
    hm, i can only see Run To User code, however it still shows ntdll.dll when i go to string references.
    – T.Todua
    Commented Jun 14, 2018 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.