I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program. how to get the references from program itself? is it protected?
2
-
1If you wanted to conceal the name of the module you should also have looked at line four inside the disassembly :) ... btw: I think the debuggers use heuristics in order to show you cross-references. There are bound to be some false positives.– 0xC0000022L ♦Commented Jun 15, 2018 at 7:31
-
Click right button, search for -----> all modules ---> strings references.– Benjamin Supaman PerezCommented Apr 11, 2021 at 17:41
Add a comment
|
2 Answers
When x64dbg attaches to a process it will first stop at the 'Attach breakpoint'. The button to search for string references will search the module currently shown in the disassembly. To search in another module you simply have to go there.
One way to do this is to go to the Symbols tab and double click the module you are interested in. This should take you to the code section of the module. From there you can press the button to search for string references.
-
1That was what I did but wasn't working (always going back to
ntddl.dllor some other module), until I RMB on the module and selected "Follow Entry point in Disassembler" then I was able to search for strings in my target module.– KeyC0deCommented Oct 19, 2019 at 20:15
The way is:
Debug -> Run to user code
Then you will see the strings of the program itself. x64dbg/x32dbg as any other debugger, walks you trough all the process initialization code before entering your "main".
-
1hm, i can only see
RunTo User code, however it still showsntdll.dllwhen i go to string references.– T.ToduaCommented Jun 14, 2018 at 9:19