What's the fastest way to set a breakpoint when a value I know gets written in memory, if the memory address is different each time due to ASLR?

Question

I have a 64bit exe I'm debugging with x64dbg.

I'm searching for a specfic string value myvalue that sits encrypted somewhere in the exe (so, searching for myvalue at the beginning returns nothing).

When the value gets decrypted, I can search for it and get current memory address. I could place a breakpoint when that specific address gets written/read but that would serve no purpose as it gets decrypted and loaded only once.

Due to ASLR policy, this memory address is different every time I close and open the program.

My objective is to produce a patch for the exe so that myvalue become anothervalue, either right after myvalue gets written or by identifying the piece of code that writes that value.

Disabling ASLR with link /edit /dynamicbase:NO filename.exe did nothing: memory address is different everytime anyway. Disabling ASLR os-wide seems a bit overkill and dangerous.

I can't put breakpoints before it gets written because I don't know the address.

Ideally, there should be a menu on the "memory" page that says "who wrote here" and point me to the diassembler line that did so.

How can I do this?

Answer 1

You can disable ASLR on the executable using a PE editor and disabling IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE in the Dll Characteristics field.

If the value is contained within the executable image, you can calculate its relative address and add it to the executable's base address, assuming this relative address is the same every time.

If it's outside the executable, then it's in a memory page allocated with VirtualAlloc. I don't think page allocations are related to ASLR so disabling it won't help the random address. Maybe you can log calls to VirtualAlloc and find the one that allocates the page you're interested in. Then you can put a breakpoint inside the page at the relative address your value is going to be at.

Another approach - find values you know are written in the same page before your value is written and calculate the target address based on them.