x64dbg (x32dbg) log registers every step like windbg

Question

So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know how to get a log like this?

Answer 1

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com.

In this case you will want to register a callback for CB_STEPPED, which gets called after every step. The basic functionality could look something like this:

PLUG_EXPORT void CBSTEPPED(CBTYPE, PLUG_CB_STEPPED* info)
{
    REGDUMP regdump;
    DbgGetRegDump(&regdump);

    auto& r = regdump.regcontext;

    _plugin_logprintf(R"(eax=%p ebx=%p ecx=%p
edx=%p esi=%p edi=%p
eip=%p esp=%p ebp=%p
)",
r.cax, r.cbx, r.ccx,
r.cdx, r.csi, r.cdi,
r.cip, r.csp, r.cbp);
}

I added 64-bit support and a menu to enable/disable this functionality and put the source code on GitHub: https://github.com/mrexodia/regstep.

This functionality is dubiously useful in my opinion, because the changes to register values are highlighted in red in the register view and the affected registers of the selected instruction are underlined there as well. In addition you have the info box below the CPU view, which shows you all relevant values for the currently selected instruction too, but if you think logging registers every step is useful for you feel free to extend the plugin to your liking.

Answer 2

You have registers listed in CPU view (View->CPU) like this:

In case you want to get them in a trace log, you have to do: Trace->Trace into... and in Log Text field, write: registerName: {registerName} for every register name you want to be listed, for example:

eax: {eax}, ebx: {ebx}

and click OK. Then under Log window (View->Log Window) you will get that trace.