is it possible to save the step-by-step execution route of the program?

i.e. lets say in x64dbg the program executes one handle after another enter image description here

and so on, probably hundreds of calls... But according to the specific function, it might show "YES" and "NO".

So, I want to save/remember the steps from the beginning to the "YES" window, and then compare it to the execution/steps, when it shows "NO".

So, I could see on which handle (specific logic in function) the difference happens.


1 Answer 1


You may want to use "Trace record" and "Run trace".

Using Trace record, the debugger records and highlights every instructions as you step through the code. You will easily know when the same instruction is executed twice by virtue of the highlighting.

enter image description here

When "Run trace" is enabled with "Trace record", the debugger additionally saves the code execution path along with the state of the registers and associated memory at each step.

enter image description here

Further read: https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html

  • so, later i can compare/replay that, right? thanks, i am newbie..
    – T.Todua
    Dec 23, 2018 at 22:15
  • @T.Todua You can save the traces to a file which you can compare later. AFAIK rr and qira on linux support replaying traces but not x64dbg.
    – 0xec
    Dec 23, 2018 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.