1

I'm currently debugging a program using x64dbg, and I'm wondering how to quickly jump to the start or end (prologue/epilogue) of a function while I'm in the middle of it. I couldn't find this information through Googling.

Specifically, I'd like to know if x64dbg has any built-in commands or shortcuts to navigate directly to the beginning or end of a function while debugging. If such functionality exists, what are the steps or commands to use it effectively?

Additionally, if there are any alternative methods or plugins available that can achieve this, I'd appreciate hearing about them as well.

Related

2 Answers 2

1

Finding the start of a function

The start of a function is indicated by

push ebp

The easiest way to find it for a function is to use the well-known xAnalyzer plugin:

  1. Analyze the module by right-clicking and selecting: xAnalyzer - Analyze function>

  2. The code will now be highlighted with a black line, simply follow the line to the beginning and find the push ebp

enter image description here

Finding the end of a function

Simply hit the Execute until return button:

enter image description here

Or click on Ctrl + F9.

This is a self-answer, I'm looking for other answers too.

1

In x64dbg, You can right-click the beginning of the function or any place in the instructions/disassembly that you want the execution to continue from for that matter, and simply press on "Set New Origin Here" or Ctrl+*.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.