I have a program that I want to perform malware analysis on. The program seems to use HTTPs with SSL pinning (my theory) and some other proprietary protocol. I want to understand what is the best tool to use in order to debug the process of constructing data in this program and sending the request out / receiving it back and debugging the received request? Assuming I can't just easily MITM it with Wireshark or other MITM and http/s traffic tools.

My questions are:

  1. Can I use x64dbg for analysing the data that is supposed to be sent trough network before it hits Kernel and encryption(incase its https) and what could be the most easiest way to find https/proprietery protocol request function in this assembly form ? I have no information on when it executes and it seems pretty random.

  2. Is WinDbg ussualy better then x64dbg in terms of debugging Kernel and system requests, because I so far didn't find a way on how to do it by using x64dbg? It seems that it could be easier to spot the breakpoint using WinDbg as i would be just intercepting the network traffic from this process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.