2

is it possible to save the step-by-step execution route of the program?

i.e. lets say in x64dbg the program executes one handle after another enter image description here

and so on, probably hundreds of calls... But according to the specific function, it might show "YES" and "NO".

So, I want to save/remember the steps from the beginning to the "YES" window, and then compare it to the execution/steps, when it shows "NO".

So, I could see on which handle (specific logic in function) the difference happens.

3

You may want to use "Trace record" and "Run trace".

Using Trace record, the debugger records and highlights every instructions as you step through the code. You will easily know when the same instruction is executed twice by virtue of the highlighting.

enter image description here

When "Run trace" is enabled with "Trace record", the debugger additionally saves the code execution path along with the state of the registers and associated memory at each step.

enter image description here

Further read: https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html

  • so, later i can compare/replay that, right? thanks, i am newbie.. – T.Todua Dec 23 '18 at 22:15
  • @T.Todua You can save the traces to a file which you can compare later. AFAIK rr and qira on linux support replaying traces but not x64dbg. – 0xec Dec 23 '18 at 22:44

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.