We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?

x64dbg 32bit version trace: enter image description here

NEW UPDATE

x32dbg only display one change for memory when calls a function which modify at least 16 bytes:

Source code:

enter image description here

x32dbg CPU monitor:

enter image description here

x32dbg Trace monitor:

enter image description here

The function testmem.test should have 4 bytes changes, how to get those changes?

  • You can use the trace feature. Start a trace from the trace tab and then just step around. In the trace tab you can see the changes in the context menu. – mrexodia Nov 9 at 10:36
  • @mrexodia Can I trace changes in memory? This is what I really want. – A.J Nov 12 at 1:09
  • You can only see changes to memory if the instruction that changes the memory is in the trace. – mrexodia Nov 12 at 13:00
  • @mrexodia As my upload picture shows, I only found changes to registers, how to see changes to memory? – A.J Nov 13 at 2:52
  • The instruction you selected does not make any changes to memory. You can see the memory changes if you highlight an instruction that makes memory changes. Example: i.imgur.com/oOBXlnf.png – mrexodia 2 days ago

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.