My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg? Or for example if we want to trace back from a chosen address... I hope I am clear enough...
-
3You cannot really trace back a program, however you can press “-“ in x64dbg to go to the previous address. With regards to calls you can also just look at the stack. From your question it’s not quite clear what you are trying to achieve (are you manually stepping or are you debugging a crash for example?)– mrexodiaFeb 3, 2019 at 16:33
-
I wasn't very clear, indeed... Sorry for that ! And thanks for the answer, it solved my problem and it is very useful...– Bob36180Feb 4, 2019 at 10:24
-
No, is exist, in x64dbg you can go back by pressing minus (-) i.ibb.co/YcJ5X1g/Untitled.png– Raymond W. FarrisAug 26, 2022 at 14:44
Add a comment
|
1 Answer
You have two options, assuming the function is not inlined:
- at the beginning of the function look at the stack, it should point to the caller. In some cases it can be possible to optimise the invocation of the function and instead of using
callusejmp. For example when one function is a subset of another or in recursive functions. - I don't think it's possible via
x64dbgbut you could record a trace of the entire execution and then replay the bits you're interested in and check the callers. For this you could use e.g. https://rr-project.org/
-
2It is possible to record an execution trace with x64dbg. See the Trace tab.– mrexodiaFeb 4, 2019 at 14:57
-
-
Not sure what that is. If you’re referring to the WinDbg TTD, kinda but to be honest I wouldn’t use it to trace really big functions since it’s kinda slow to record a trace. It can show the program state at each step though if that’s what you mean.– mrexodiaApr 30, 2021 at 15:07