How to use memory address information from IDAFree to set a breakpoint in x32dbg?

Question

I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in IDAFree and then I see the API function call in IDA. I follow it in code and IDA shows it's at address: 10001B66

My problem is that when I try to set a breakpoint at this address in x32dbg (bp 0x10001B66), it gives me an error:

Error setting breakpoint at 10001B66! (memread)

Additionally, in x32dbg, I'm seeing addresses such as 714A7D39 for my DLL. Now, I'm new to this but I'm guessing that the memread error is because 10001B66 -- as seen in IDA -- is not a valid memory address in the context of execution in the debugger.

So how do I get the correct address of this API function call so that I can set the correct breakpoint?

Answer 1

Procedure:

1. Get base address in x64dbg: Load the binary in x64dbg. Go to "Memory Map" tab. Find the binary name in info column. Then copy the address with the right click on it. For example, in the following screenshot, the x86_64 PE binary name is Project1.exe and the base address is 0x00007FF6A4850000.

2. Rebase in IDA: Open the binary in IDA. Click on Edit > Segments > Rebase program > Enter the value which is copied from previous step.

3. Start debugging: Find the API call in IDA. Copy the address of that instruction from assembly view. Go to "CPU" tab in x64dbg. Press Ctrl+G in x64dbg and enter the address which you want to see.

This procedure changes the base address of the loaded binary in IDA according to x64dbg. This can also be done manually by calculating the difference between the base address and the point where you want to set the breakpoint.

Source: YouTube/OALabs: Disable ASLR For Easier Malware Debugging With x64dbg and IDA Pro