Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?
x64dbg 32bit version trace:
NEW UPDATE
x32dbg only display one change for memory when calls a function which modify at least 16 bytes:
Source code:
x32dbg CPU monitor:
x32dbg Trace monitor:
The function testmem.test should have 4 bytes changes, how to get those changes?
Based on the code screenshot you posted it appears you are looking for differences between two memory snap shots. That is you want to know what all changed in the process address space after you step over the call to test.test().
I hope you understand anything can change anywhere when you step over a single unknown arbitrary function over the whole process memory.
For example,
A global variable may be modified which would normally reside in the writable section of a binary.
Stack contents may be modified.
A third / nth module/s may be loaded and whole blocks of memory may be added which didn't exist prior to executing the function.
etc ..... etc ....
You can't reliably look for what changed between one single step of a function.
x64dbg on the trace window provides you what changed on each execution, you have to scroll and look what changed for each instruction.
Or, if you can limit your lookup to a certain memory range you can dump the memory to a file and diff them.
x64dbg provides you one command to save a block of memory
savedata :memdump: , 0x400000 , 0x1000
or for that matter all debugger will provide you a mechanism to dump raw data at some address of some size to a file.
windbg .writemem
ida makesnapshot
ollydbg binary -> backup or dump in memory map gui
x64dbg savedata (scriptcommand) or dumpmem in GUI memory map
You can use a hexeditor like hxd to byte compare two dumps for looking at all changes to a certain region of memory.
As a real world example you can set a breakpoint as you have set in the specific code on the screenshot. Dump two snapshots one prior to step and one after step
What was dumped
Address=0024D000
Size=00003000
Page Information=Thread 3F8 Stack
Allocation Type=PRV
Current Protection=-RW-G
Allocation Protection=-RW--
dumped prior and renamed the dumpfile
0024D000[3000] written to "xxx\pre" !
single stepped
INT3 breakpoint at test.01071076 (01071076)!
dumped post and renamed the dumpfile
0024D000[3000] written to "xxx\post" !
notice all the changes viz 1111,2222,3333
:\>ls -lg
total 24
-rw-rw-rw- 1 0 12288 2018-11-21 03:02 post.bin
-rw-rw-rw- 1 0 12288 2018-11-21 03:01 pre.bin
:\>fc /b pre.bin post.bin
Comparing files pre.bin and POST.BIN
00002D68: 6A 76
00002D70: 0B 00
00002D71: E1 00
00002D72: 08 00
00002D73: 01 00
00002D74: 00 11
00002D75: 00 11
00002D78: 00 22
00002D79: 00 22
00002D7C: 20 33
00002D7D: E1 33
00002D7E: 08 00
00002D7F: 01 00
:\>xxd -g4 -s 0x2d68 -l 0x20 pre.bin
0002d68: 6a100701 70fd2400 0be10801 00000000 j...p.$.........
0002d78: 00000000 20e10801 04e08442 ccfd2400 .... ......B..$.
:\>xxd -g4 -s 0x2d68 -l 0x20 post.bin
0002d68: 76100701 70fd2400 00000000 11110000 v...p.$.........
0002d78: 22220000 33330000 04e08442 ccfd2400 ""..33.....B..$.
