3

i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment? enter image description here

  • 1
    I don't know if I understood correctly but as you haven't marked mrexodia's answer as the correct one I was wondering if you mean on how to set the view to where the current thread execution is. You can do so by double clicking the RIP register. – Michael Pittino Jul 3 '18 at 17:22
  • @MichaelPittino this question was a while ago, but now i can't understand well, why i've marked that answer. I really want to know where the current application execution/thread is at this moment – T.Todua Dec 1 '18 at 10:52
  • In CPU view right click -> go to -> origin – Gero B. Aug 16 at 17:57
4

From your screenshot I understand that you want to break on. You can do this by breaking on the debug string event. Use the following setting:

setting

If you want to pause the execution, simply click the “pause” button. If you want to see the current instruction executes you can use the “Threads” tab and double click the EIP/RIP column of one you’re interested in.

| improve this answer | |
  • 1
    can you remind me where is the RIP column? – T.Todua Nov 18 '18 at 17:25
  • 1
    The column with the name RIP or EIP (depending on what architecture you’re debugging) – mrexodia Nov 18 '18 at 17:26
  • yes, i see the EIP . thanks! – T.Todua Nov 18 '18 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.