Questions tagged [x64dbg]

An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.

Filter by
Sorted by
Tagged with
2 votes
0 answers
64 views

Help with reversing an application with x64dbg

I am a newbie to reverse engineering. I am trying to reverse engineer an app that uses some form of internet explorer frame kind of thing because I could see use of mshtml.dll and jscript9.dll and ...
Madhur's user avatar
  • 21
3 votes
1 answer
76 views

Load PDB for MemoryModule-loaded DLL in x64dbg

I need to debug a DLL, which I have a PDB file for. The debug target is a program, that loads the DLL using MemoryModule library from Github. The loaded module isn't listed as a module in x64dbg, ...
Ri0ee's user avatar
  • 43
3 votes
0 answers
42 views

How to see parameters in stack in x64dbg like in OllyDbg for known API calls?

Based on Detailed API call descriptions not available in x64dbg When I debug a known API call like for example WSARecv, in OllyDbg I can nicely see the parameters in the stack: I've installed both ...
kuhi's user avatar
  • 161
4 votes
2 answers
108 views

Malware analysis - Debugger hangs at HttpSendRequestA

I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC. I was able to replicate this behaviour with a small ...
Luca D'Amico's user avatar
2 votes
1 answer
117 views

Understanding the logic behind decompiled code

Hi I was learning reverse engineering by doing some crackme(s) found online using IDA and x64dbg. I'm quite confused on the below decompiled code. bool Logic() { char CODE[] = "RAND_STRING&...
Nimrod's user avatar
  • 151
4 votes
1 answer
82 views

Change string value when string is in a RAM address x64 c++ program

I'm new to reverse engineering. I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS (It's a c++ program, and is VERY simple; it just prints a string, and two ...
clouded.'s user avatar
3 votes
0 answers
118 views

x32dbg error C0000005, EXCEPTION_ACCESS_VIOLATION

Having some trouble with cracking a program, as the software does not prompt me to enter a serial key for activation. Instead, a serial key 924D-E42E-427D is already displayed within the program. So ...
tolier's user avatar
  • 31
2 votes
0 answers
53 views

Problem while debug with x64dbg

I am debugging with x32dbg a program (x) which at some point opens another program (y). Is it possible to continue debugging also on program (y) when opened by the first one (x)? Unfortunately, ...
Didimo8's user avatar
  • 21
4 votes
0 answers
99 views

Comparison of Windows Debuggers

I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
jinscoe123's user avatar
3 votes
0 answers
79 views

Exporting patches as loader in x64dbg?

Is there a way to export modifications made in x64dbg as a separate executable file, which can be used to patch a desired executable file without detection? The resulting file should function as a ...
Halil Nevzat Demirel's user avatar
-1 votes
1 answer
84 views

Anti-patching checksum [closed]

I'm busy with debugging a program in x64dbg and it has some kind of anti-patching mechanism so can someone please advise me on how I would go about finding the functions which are calculating the ...
jjprince's user avatar
1 vote
0 answers
102 views

How can I set a breakpoint in x64dbg to be triggered when a certain message is logged?

I am debugging a certain program and I need to stop execution when a certain debug message is logged using OutputDebugStringA(). How can I set a breakpoint for this?
Ytagger's user avatar
  • 11
3 votes
1 answer
262 views

exe file not opening after patching

I hope everyone is well. I'm new here and I'm hope someone can help me with the problem I'm facing. I've been trying to reverse engineer a program but everytime I change an instruction, not matter how ...
jjprince's user avatar
3 votes
1 answer
116 views

How to call Windows console in ASM and printf some values there?

Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
EvilCracker's user avatar
3 votes
2 answers
237 views

x64dbg: Conditional breakpoint: how to log only if register value has changed?

What i'm trying to achieve is to use a conditional breakpoint, that never actually breaks but logs in x64dbg's console the value of r9 only when it changes, to prevent console cluttering. But i do not ...
EncoderX's user avatar
2 votes
0 answers
62 views

How to search for a graphical string?

I am trying to search for a string but in my case, that string is not like a normal string but it's a graphical string. As you have seen, that is not a normal string that can search for but it's a ...
Lion King's user avatar
  • 269
2 votes
1 answer
182 views

Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?

Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version. Problem is i have to do it again cause there ...
EncoderX's user avatar
2 votes
0 answers
141 views

Find caller function by DLL loading in x64dbg

First of all I'm noob at debugging task and I'm try to self-study to learn how to debug exe using x64dbg. I have EXE file packed by themida. i bypassed themida packing using themida plugin in x64dbg....
Anuruddha wijesiri's user avatar
3 votes
0 answers
258 views

Anti Dumping Techniques (C++)

how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle? I tried this already but it didnt work. Scylla could still dump it fine.
Heinz Josef's user avatar
2 votes
0 answers
89 views

Find an address of injected code via GetModuleHandleA

I am reversing really old game (20 years old). l2.exe loads Dsetup.dll Network.dll. (not sure about order) inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
Vetal.lebed's user avatar
3 votes
0 answers
245 views

How would I crack a software that has Xor encryption

So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
user42257's user avatar
2 votes
0 answers
154 views

What is the correct way to load pdb symbols to show the functions by their name instead of their addresses in x64dbg?

I am trying to reverse a portion of a game, that game loads a DLL file called "ddraw.dll". Most of the DLL file functions don't appear by their names but appear by their addresses for ...
Lion King's user avatar
  • 269
3 votes
1 answer
366 views

Locating function parameters in x32dbg

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows: 0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] | 0627BF4B | 8B85 CCF5FFFF ...
throwawayn000b9999's user avatar
1 vote
0 answers
94 views

Copy all ASCII in x64db

How i can copy all ASCII or Hex values starting from specific point without scrolling up or keep moving the mouse? For example from below point till first offset. Thanks
Ahmed Mohammed's user avatar
2 votes
1 answer
309 views

Trying to learn more about unpacking

I am working on getting better with concepts of unpacking manually to get more clarity on understanding packing routines and decryption logic, so I am trying a few tutorials on PESpin! Previously I ...
ElementalX's user avatar
4 votes
2 answers
339 views

How to reverse a game and inject a dll in client program?

I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
Lftbrito's user avatar
2 votes
0 answers
60 views

analyze track program protected

What are the modern methods of dealing with obfuscation and code virtualization? all these protectors create unrealistic code traces?
bArt's user avatar
  • 21
1 vote
1 answer
876 views

How to locate a string in memory with x64dbg

I opened a 32-bit program with x32dbg, I wrote something on a text box like this : How can I find the piece of code that manipulates the string "Goku" ? I searched all string references but ...
Aminos's user avatar
  • 111
1 vote
1 answer
147 views

Calling function with string as parameter

I'm trying to call a function in a game that makes my character sending a message. I already called a few functions in this game but this one has a tricky parameter. The function signature should be ...
kuhi's user avatar
  • 161
0 votes
1 answer
133 views

How to find the first function that sets the value currently stored in a given register?

I'm interested in a general approach to the following problem: The function F_Init allocates a byte buffer called Buffer with a size called BufSize. The Buffer is allocated with each frame/iteration ...
01101111's user avatar
3 votes
1 answer
434 views

x64dbg: is there a way to save the complete disassembly of a module to a text file?

Is it possible to save the complete disassembly / listing to a file, and if so, how can it be done?
Violet Giraffe's user avatar
1 vote
1 answer
2k views

How to load a PDB file into x64dbg?

I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
Violet Giraffe's user avatar
2 votes
1 answer
212 views

x64dbg : TraceInto only in user code

The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
HK47's user avatar
  • 23
1 vote
1 answer
285 views

Searching for strings only partially works in x64Dbg

Please note that I am new to x64dbg. As you can be seen in the picture below, the error message has the string [ebp+8]:L"The information you have entered is invalid!\n..." However, when I ...
Mahmoud Maarouf's user avatar
1 vote
0 answers
176 views

x64dbg placing a on write breakpoint on a dynamic allocated address

I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
Gero B.'s user avatar
  • 11
1 vote
1 answer
373 views

How to navigate Disassembly view to specific absolute address location?

I have an absolute address that I want to scroll the Disassembly to in order to see which instructions are at that address. I understand that I can scroll by hand, or I can edit RIP. But the former ...
Violet Giraffe's user avatar
2 votes
1 answer
270 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
Kıvanç Cantimur's user avatar
1 vote
0 answers
246 views

x64dbg isn't running the program I'm looking at

I'm almost definitely being an idiot but I have opened up an .exe file in x64dbg and I can run the file just fine when looking at the assembly but it doesn't open a second window so I can see the ...
x02's user avatar
  • 11
0 votes
1 answer
132 views

x64dbg doesn't show Chinese strings in String references?

I'm wondering if x64dbg can show Chinese letters in String references? Because I try to reverse 3 Chinese programs from complete different coders and I never found any Chinese strings. But in the ...
Sunrise's user avatar
1 vote
1 answer
658 views

x64dbg is unable to find string references vs. Ollydbg

I want to know how to find string references in x64dbg as Olly does : it finds every string references I need when I open Memory map window, then rightclick on "Search" and then I enter the ...
Bob36180's user avatar
0 votes
1 answer
154 views

please explain the difference between the two types of follow

in file i find mov rcx,qword ptr ds:[404320] when I wanted to see what is at the address 404320 i press "follow in dump" and i got a choice between "constant: file.0000000000404320&...
iko's user avatar
  • 3
0 votes
0 answers
132 views

Heavens gate code

Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you. I use Intel Pin push cs push 0xa02829 jmp far ...
ALex's user avatar
  • 21
0 votes
1 answer
344 views

How do I find a function and find out what it does using reverse engineering?

I am attempting to find a function in a specific game. Is there any way that, using the assembly code I get from decompiling the game in either IDA or x64dbg, I can locate a function I am specifically ...
CoolNite's user avatar
2 votes
1 answer
440 views

Finding function from pattern

I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find: \x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C \x89\x4C\x24\x20\x48\x83\xEC\x28\x48\...
CoolNite's user avatar
2 votes
0 answers
227 views

Strange exception thrown while debugging in Win10, but not Win7

I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
Code Doggo's user avatar
1 vote
1 answer
379 views

A tutorial or docs to unpack a custom packed PE

I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
Jcknsz's user avatar
  • 11
1 vote
1 answer
127 views

How to use decimal in x64dbg calculator?

The x64dbg calculator can evaluate hex expressions. Is there a syntax to calculate the sum of a hex value and a decimal value? For the example in the snapshot, is it possible to treat 10 as a decimal?...
Just a learner's user avatar
0 votes
0 answers
268 views

How to decrypt/decode the strings found in desktop application with x64dbg?

I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
aspirinemaga's user avatar
1 vote
3 answers
828 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
Charles Weerawansa's user avatar
0 votes
1 answer
283 views

decoding thread context structure in x64dbg

Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
prakashyadav008's user avatar