0

So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know how to get a log like this?

2

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com.

In this case you will want to register a callback for CB_STEPPED, which gets called after every step. The basic functionality could look something like this:

PLUG_EXPORT void CBSTEPPED(CBTYPE, PLUG_CB_STEPPED* info)
{
    REGDUMP regdump;
    DbgGetRegDump(&regdump);

    auto& r = regdump.regcontext;

    _plugin_logprintf(R"(eax=%p ebx=%p ecx=%p
edx=%p esi=%p edi=%p
eip=%p esp=%p ebp=%p
)",
r.cax, r.cbx, r.ccx,
r.cdx, r.csi, r.cdi,
r.cip, r.csp, r.cbp);
}

I added 64-bit support and a menu to enable/disable this functionality and put the source code on GitHub: https://github.com/mrexodia/regstep.

This functionality is dubiously useful in my opinion, because the changes to register values are highlighted in red in the register view and the affected registers of the selected instruction are underlined there as well. In addition you have the info box below the CPU view, which shows you all relevant values for the currently selected instruction too, but if you think logging registers every step is useful for you feel free to extend the plugin to your liking.

0

You have registers listed in CPU view (View->CPU) like this: enter image description here

In case you want to get them in a trace log, you have to do: Trace->Trace into... and in Log Text field, write: registerName: {registerName} for every register name you want to be listed, for example:

eax: {eax}, ebx: {ebx}

and click OK. Then under Log window (View->Log Window) you will get that trace.

  • Unfortunately the program I'm working on is multi threaded and that just created a single instance list of x steps. I used eip {eip}, esp {esp} and it gave me x lines of the same values. I'm trying to use it to track previous values from before jmps and calls <img src="codeproject.com/KB/debug/WinDBGAndSOS/WinDBGCommandWindow.PNG" width="100" height="100"> It would be great to be able to track the registers each step like this – Teddy Jul 12 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.