My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg? Or for example if we want to trace back from a chosen address... I hope I am clear enough...

  • 2
    You cannot really trace back a program, however you can press “-“ in x64dbg to go to the previous address. With regards to calls you can also just look at the stack. From your question it’s not quite clear what you are trying to achieve (are you manually stepping or are you debugging a crash for example?) – mrexodia Feb 3 '19 at 16:33
  • I wasn't very clear, indeed... Sorry for that ! And thanks for the answer, it solved my problem and it is very useful... – Bob36180 Feb 4 '19 at 10:24

You have two options, assuming the function is not inlined:

  • at the beginning of the function look at the stack, it should point to the caller. In some cases it can be possible to optimise the invocation of the function and instead of using call use jmp. For example when one function is a subset of another or in recursive functions.
  • I don't think it's possible via x64dbg but you could record a trace of the entire execution and then replay the bits you're interested in and check the callers. For this you could use e.g. https://rr-project.org/
| improve this answer | |
  • 1
    It is possible to record an execution trace with x64dbg. See the Trace tab. – mrexodia Feb 4 '19 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.