1

My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg? Or for example if we want to trace back from a chosen address... I hope I am clear enough...

3
  • 3
    You cannot really trace back a program, however you can press “-“ in x64dbg to go to the previous address. With regards to calls you can also just look at the stack. From your question it’s not quite clear what you are trying to achieve (are you manually stepping or are you debugging a crash for example?)
    – mrexodia
    Feb 3, 2019 at 16:33
  • I wasn't very clear, indeed... Sorry for that ! And thanks for the answer, it solved my problem and it is very useful...
    – Bob36180
    Feb 4, 2019 at 10:24
  • No, is exist, in x64dbg you can go back by pressing minus (-) i.ibb.co/YcJ5X1g/Untitled.png Aug 26, 2022 at 14:44

1 Answer 1

4

You have two options, assuming the function is not inlined:

  • at the beginning of the function look at the stack, it should point to the caller. In some cases it can be possible to optimise the invocation of the function and instead of using call use jmp. For example when one function is a subset of another or in recursive functions.
  • I don't think it's possible via x64dbg but you could record a trace of the entire execution and then replay the bits you're interested in and check the callers. For this you could use e.g. https://rr-project.org/
3
  • 2
    It is possible to record an execution trace with x64dbg. See the Trace tab.
    – mrexodia
    Feb 4, 2019 at 14:57
  • @mrexodia is this identical to record&replay functionality?
    – 0xC0000022L
    Apr 30, 2021 at 9:18
  • Not sure what that is. If you’re referring to the WinDbg TTD, kinda but to be honest I wouldn’t use it to trace really big functions since it’s kinda slow to record a trace. It can show the program state at each step though if that’s what you mean.
    – mrexodia
    Apr 30, 2021 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.