5

I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program. how to get the references from program itself? is it protected?

enter image description here

  • 1
    If you wanted to conceal the name of the module you should also have looked at line four inside the disassembly :) ... btw: I think the debuggers use heuristics in order to show you cross-references. There are bound to be some false positives. – 0xC0000022L Jun 15 '18 at 7:31
  • @0xC0000022L haha, i've missed that:) was testing something with that prog. thanks for answer, I've arrived back with similar task. – T.Todua Nov 18 '18 at 16:49
6

When x64dbg attaches to a process it will first stop at the 'Attach breakpoint'. The button to search for string references will search the module currently shown in the disassembly. To search in another module you simply have to go there.

One way to do this is to go to the Symbols tab and double click the module you are interested in. This should take you to the code section of the module. From there you can press the button to search for string references.

| improve this answer | |
  • That was what I did but wasn't working (always going back to ntddl.dll or some other module), until I RMB on the module and selected "Follow Entry point in Disassembler" then I was able to search for strings in my target module. – Nikos Oct 19 '19 at 20:15
3

The way is:

Debug -> Run to user code

Then you will see the strings of the program itself. x64dbg/x32dbg as any other debugger, walks you trough all the process initialization code before entering your "main".

| improve this answer | |
  • 1
    hm, i can only see Run To User code, however it still shows ntdll.dll when i go to string references. – T.Todua Jun 14 '18 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.