I have a 64bit exe I'm debugging with x64dbg.
I'm searching for a specfic string value
myvalue that sits encrypted somewhere in the exe (so, searching for
myvalue at the beginning returns nothing).
When the value gets decrypted, I can search for it and get current memory address. I could place a breakpoint when that specific address gets written/read but that would serve no purpose as it gets decrypted and loaded only once.
Due to ASLR policy, this memory address is different every time I close and open the program.
My objective is to produce a patch for the exe so that
anothervalue, either right after
myvalue gets written or by identifying the piece of code that writes that value.
Disabling ASLR with
link /edit /dynamicbase:NO filename.exe did nothing: memory address is different everytime anyway. Disabling ASLR os-wide seems a bit overkill and dangerous.
I can't put breakpoints before it gets written because I don't know the address.
Ideally, there should be a menu on the "memory" page that says "who wrote here" and point me to the diassembler line that did so.
How can I do this?