Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
112
questions
1
vote
0answers
29 views
How to ret with jxx in x64dbg's sciprt
main:
call foo
call bar
ret
foo:
// code
cmp $number, 0
je ret
// code
ret
bar:
// code
cmp $number, 0
je ret
// code
ret
I would like to ...
0
votes
0answers
22 views
Finding out what creates FIFA RTWC 98's main window
I am currently familiarizing myself with x64dbg as a tool for reverse engineering. As an exercise, I challenged myself to try and patch FIFA RTWC 98's executable to force it to run on a windowed mode.
...
0
votes
0answers
36 views
Tracing back the user code section that triggered a message
I have a Windows GUI x86 executable and I have identified, in the .rsrc section, where the error string I want to trace is. Let's assume it is in id=83Ah.
I have set a bpx user32:LoadStringA and then ...
0
votes
0answers
38 views
Reversing WSASend finding functions that called it
I'm trying to make my first DLL calling game functions
What I need is tracing functions that call WSASend, so it will be easy for me to get all functions address to call them from my DLL.
What I ...
2
votes
2answers
79 views
Function Prologue, add esp directive
I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:
push ebp ...
2
votes
1answer
76 views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
1
vote
0answers
92 views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle "Listen to this device" for my microphone:
Registry
I thought it would be a simple registry key that's being modified so I used RegShot to find the key:
...
0
votes
1answer
61 views
xor eax,3 why does the input change the way it does?
I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
0
votes
0answers
37 views
About x64dbg find command + Help to unpack a program
The find command in x64dbg(x86),
(found here: https://help.x64dbg.com/en/latest/commands/searching/find.html)
doesn't return anything. For example:
findall 0x00524180, "E8 ????????" returns 50 ...
1
vote
2answers
49 views
Patched Application causes Acces Violation c0000005
I've been working with this application to remove it's trial limitations.
But every byte I change, it throws an acces violation.
Piece of the code:
Original:
003354C6 - 0F85 D3000000 - jne ...
1
vote
0answers
54 views
x64dbg “Use Graph command or menu action to draw control flow graph here…”
When I press "G" in the CPU view of the debugger I often get the following screen:
In what cases can this error message happen? Obviously I can't yet give an exact way to reproduce it, I'm curios ...
1
vote
1answer
53 views
Dump array of char* ASCII text to file? (ollydbg or x32dbg)
This question is similar to: List arrays (de-reference pointers) in Ollydbg
I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
0
votes
0answers
69 views
unpacking Armadillo-packed exe on Windows 10
I was trying to unpack the Armadillo-protected target from this webpage Armadillo 4.30a with Debug Blocker - manually unpacking on Windows 10. However, I got another child process spawning again after ...
0
votes
0answers
22 views
What is the “Thread XXXX Stack” Section in x64dbg memory map?
So I am trying to understand how an Aegis Packed Malware works, and from what I am seeing the executable is passing the control to a section labelled Thread 2380 Stack after the EntryPoint. This ...
0
votes
2answers
104 views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
2
votes
1answer
112 views
change compare function in assembly and .exe stopped working x64dbg
I'm trying to bypass (crack) a very old software that require license in order to unlock all the features
i was digging in the lines with a little bit of knowledge in assembly
and i found the line ...
2
votes
1answer
172 views
bypass license of very old software, Access violation (C0000005) x32dbg
I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license
so, with a little bit of knowledge in ...
0
votes
1answer
88 views
Nop the string in online games
So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn
My question is how is that possible? I just edit ...
0
votes
1answer
154 views
x64dbg: break when a register contains a value
Is there a way to break code execution when a register contains a particular value with x64dbg? I'm not talking about setting a conditional breakpoint at a specific location, but about watching the ...
0
votes
1answer
70 views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
0
votes
1answer
204 views
How to use memory address information from IDAFree to set a breakpoint in x32dbg?
I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
0
votes
2answers
147 views
What's ScyllaHide's PDBReaderx64.exe Doing?
I just downloaded the binary of ScyllaHide for x64dbg. According to the instructions, I need to generate an NtApiCollection.ini file by running PDBReaderx64.exe or PDBReaderx86.exe. But I've got a ...
0
votes
0answers
128 views
X32DBG ignores dependent DLL
I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
1
vote
1answer
88 views
Detailed API call descriptions not available in x64dbg
I am following a RE tutorial, and the guy is using Ollydbg while I use x64dbg... and I don't find all the descriptions in that Olly has, and it's quite annoying !
There is an example from the two ...
1
vote
1answer
90 views
cannot find a string in x64dbg even when using search all strings
I am trying to debug a program for testing but for some reason i can NOT find any strings related to registeration like Registered, Unregistered,Blocked in x64dbg, i can see all these strings in the ...
0
votes
1answer
94 views
How can I navigate to the Disassembly address location?
I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says:
Hardware breakpoint (byte, read/...
2
votes
2answers
114 views
Find a instruction in a binary file (PE) based on a virtual address of a string reference
English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
3
votes
1answer
239 views
Is it possible to view and modify process memory without attaching the debugger in x64dbg?
This functionality is available in Cheat Engine where the debugger won't be attached until you set a breakpoint or explicitly ask for the debugger to be attached. I've looked everywhere and couldn't ...
0
votes
1answer
59 views
Find Retdec Address Range in x64dbf
How do I find this function from retdec (https://github.com/avast/retdec) in x64dbg?
// Address range: 0x1017dba0 - 0x1017dbda
int32_t function_1017dba0(int32_t * a1) {
int32_t fileHandle = (...
0
votes
0answers
143 views
In X64dbg, how can I script a string write to memory?
I find that I can write to memory as
[addr] = value
As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html
And while I could work around my problem as dividing ...
1
vote
2answers
298 views
Difference between 32 bit and 64 bit disassemblers
As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
2
votes
1answer
100 views
How to hide a process from all the methods of getting the list of processes?
So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not
so these are the ways i know :
...
0
votes
0answers
60 views
What's the point of changing the CS register and can any process do this?
So i was reading this article :
http://waleedassar.blogspot.com/2012/07/wow64-user-mode-system-calls-hooking.html
which explains the wow64, the part that we do a far jmp and change the CS register ...
1
vote
1answer
80 views
What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)
So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
1
vote
1answer
94 views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
1
vote
2answers
250 views
When trying to change command line, received an error: “Could not set command line!”
I download CurrPort program and run it on xdbg64.
I pressed File -> Changed Command line and changed the command line to:
"C:\Users\myusername\Downloads\cport\cports.exe" "/close * * 127.0.0....
1
vote
0answers
52 views
UTF8, UTF16 encoding string search
I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them..
P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
1answer
292 views
Finding out what calls win32u.dll functions
There's a button which, when clicked, writes some data to the clipboard.
I'm trying to call the function this button executes using DLL Injection.
I managed to find the function in win32u.dll which ...
0
votes
2answers
410 views
x64dbg (x32dbg) log registers every step like windbg
So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
0
votes
0answers
75 views
x64dbg stops at question marks
I tried to debug an exe file and there are multiple lines with three question marks. When you run the file after a few breaks it will get to the question marks and stop there. On further running you ...
3
votes
1answer
101 views
I am analyzing an exe with x64dbg but I dont see the address 00401000 [closed]
Will every .exe file start from 00401000 or am I wrong assuming such a thing.
Edit: total beginner here.
when the program is first loaded onto x64dbg it immediately goes into a DLL, so I could not ...
1
vote
0answers
84 views
Process terminating when breakpoint reached
I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
1
vote
0answers
69 views
Hearts Game Passing Cards
I'm trying to make this Hearts game so that i can select more than 3 cards.
This is the func that will compare how many cards i've chosen with 3
it'll jump to this address if > 3
so i replace the ...
-1
votes
2answers
236 views
How to know what does the function do?
I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do.
My question ...
0
votes
1answer
70 views
'local call from' in x64dbg
In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
50 views
Is there a way to export all the strings for a certain module in x64dbg?
I have an encrypted file that I was able to step through the code until that specific DLL file was decrypted in memory and I was able to list all of its strings. It has a ton of them that I would like ...
0
votes
1answer
228 views
Storing a string with with x64dbg
I want to patch a Windows binary (actually an ocx) with x64dbg. More specifically, I want to store a string of 60 bytes and store its address in EAX at a certain point.
Do I just have to add it to a ...
0
votes
1answer
180 views
What does ds mean?
When debugging with x64dbg I sometimes see mov ss:[address] 0xAA, I know that this means: move 0xAA into memory at specified address.
But what does
mov ds:[address] 0xAA
mean?
0
votes
1answer
105 views
What does this function actually do?
I'm taking part in this reverse engineering lab at college and we have this final big homework project. I have a part of the binary that changes it's own asm code by iterating through it's own bytes ...
1
vote
1answer
405 views
x64dbg how to set conditional breakpoint on WinAPI function
I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
