I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program. how to get the references from program itself? is it protected?
When x64dbg attaches to a process it will first stop at the 'Attach breakpoint'. The button to search for string references will search the module currently shown in the disassembly. To search in another module you simply have to go there.
One way to do this is to go to the
Symbols tab and double click the module you are interested in. This should take you to the code section of the module. From there you can press the button to search for string references.