1

I am learning to use x64dbg application and I am exploring different methods for studying an application. So far I know of only a few techniques as listed below:

  1. String References Search
  2. Call Stack
  3. Intermodular Calls

I request you guys to please add on to this list what are the techniques that you use for studying an application. Also let me know what do you think of next when you don't find any string reference or any clue how do you go forward then?

Things go on a whole different level when the application has several threads, how do you guys deal with that, please shed some light on that too.

Improve this question
1
  • CFF Explorer helps (particularly its Identifier for common protections, as well as looking at the Sections for anything out of the ordinary.) Also, Process Monitor is good for getting a general idea what files/registry keys are being used before jumping into a debugger. You can see when threads are created/exited and view the stack for an event (right click on an event > Stack...) If none of that helps, set a software memory breakpoint in x64dbg on the page with the Import Address Table, you'll see every import that gets called. Very verbose, but gives you a detailed idea what's happening
    – tomysshadow
    Jun 12 at 8:24

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.