Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
177
questions
1
vote
0
answers
24
views
analyze track program protected
What are the modern methods of dealing with obfuscation and code virtualization? all these protectors create unrealistic code traces?
- 11
1
vote
1
answer
37
views
How to locate a string in memory with x64dbg
I opened a 32-bit program with x32dbg, I wrote something on a text box like this :
How can I find the piece of code that manipulates the string "Goku" ? I searched all string references but ...
- 111
1
vote
1
answer
62
views
Calling function with string as parameter
I'm trying to call a function in a game that makes my character sending a message.
I already called a few functions in this game but this one has a tricky parameter.
The function signature should be ...
- 131
0
votes
1
answer
70
views
How to find the first function that sets the value currently stored in a given register?
I'm interested in a general approach to the following problem:
The function F_Init allocates a byte buffer called Buffer with a size called BufSize. The Buffer is allocated with each frame/iteration ...
- 3
0
votes
1
answer
78
views
x64dbg: is there a way to save the complete disassembly of a module to a text file?
Is it possible to save the complete disassembly / listing to a file, and if so, how can it be done?
- 127
1
vote
1
answer
136
views
How to load a PDB file into x64dbg?
I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
- 127
2
votes
1
answer
75
views
x64dbg : TraceInto only in user code
The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
- 23
1
vote
1
answer
49
views
Searching for strings only partially works in x64Dbg
Please note that I am new to x64dbg.
As you can be seen in the picture below, the error message has the string
[ebp+8]:L"The information you have entered is invalid!\n..."
However, when I ...
0
votes
0
answers
57
views
x64dbg placing a on write breakpoint on a dynamic allocated address
I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
- 1
1
vote
1
answer
49
views
How to navigate Disassembly view to specific absolute address location?
I have an absolute address that I want to scroll the Disassembly to in order to see which instructions are at that address. I understand that I can scroll by hand, or I can edit RIP. But the former ...
- 127
0
votes
0
answers
24
views
Call function only when check box is checked
Which function is responsible whether the check box is checked or not in disassembler's intermodular calls window?
1
vote
1
answer
102
views
Instructions to compare two strings
I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
0
votes
0
answers
41
views
x64dbg isn't running the program I'm looking at
I'm almost definitely being an idiot but I have opened up an .exe file in x64dbg and I can run the file just fine when looking at the assembly but it doesn't open a second window so I can see the ...
- 1
0
votes
1
answer
69
views
x64dbg doesn't show Chinese strings in String references?
I'm wondering if x64dbg can show Chinese letters in String references? Because I try to reverse 3 Chinese programs from complete different coders and I never found any Chinese strings. But in the ...
- 1
1
vote
1
answer
171
views
x64dbg is unable to find string references vs. Ollydbg
I want to know how to find string references in x64dbg as Olly does : it finds every string references I need when I open Memory map window, then rightclick on "Search" and then I enter the ...
- 69
0
votes
1
answer
71
views
please explain the difference between the two types of follow
in file i find
mov rcx,qword ptr ds:[404320]
when I wanted to see what is at the address 404320
i press "follow in dump" and i got a choice between "constant: file.0000000000404320&...
- 3
0
votes
0
answers
88
views
Heavens gate code
Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you.
I use Intel Pin
push cs
push 0xa02829
jmp far ...
- 21
0
votes
1
answer
122
views
How do I find a function and find out what it does using reverse engineering?
I am attempting to find a function in a specific game. Is there any way that, using the assembly code I get from decompiling the game in either IDA or x64dbg, I can locate a function I am specifically ...
- 37
2
votes
1
answer
176
views
Finding function from pattern
I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find:
\x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C
\x89\x4C\x24\x20\x48\x83\xEC\x28\x48\...
- 37
2
votes
0
answers
80
views
Strange exception thrown while debugging in Win10, but not Win7
I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
- 121
1
vote
1
answer
126
views
A tutorial or docs to unpack a custom packed PE
I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
- 11
1
vote
1
answer
44
views
How to use decimal in x64dbg calculator?
The x64dbg calculator can evaluate hex expressions.
Is there a syntax to calculate the sum of a hex value and a decimal value? For the example in the snapshot, is it possible to treat 10 as a decimal?...
- 165
0
votes
0
answers
121
views
How to decrypt/decode the strings found in desktop application with x64dbg?
I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
- 101
1
vote
3
answers
325
views
x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection
I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
1
answer
101
views
decoding thread context structure in x64dbg
Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
0
votes
1
answer
61
views
function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?
I need urgent help , I was debugging a software made by Visual basic 6 , and I found
vbavarindexload function and I need to know what is doing ?
Thanks in advance
- 1
0
votes
1
answer
150
views
How can I detect if my application is running in x64debug?
I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response.
When building the application, I am easily able to detect it is ...
- 3
0
votes
1
answer
770
views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
2
votes
1
answer
732
views
How to get offset of specific function in exe?
Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
- 23
0
votes
0
answers
49
views
How to extract an AutoIT script when tools fail to extract it?
Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it.
What would you do? is there any place in ...
- 320
0
votes
1
answer
580
views
How to bypass anti-debugging C++
So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it.
I even tried using ScyllaHide at max settings but still it detects ...
1
vote
0
answers
208
views
Is there a clear Ollydbg successor?
I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
- 11
1
vote
1
answer
853
views
How to run a script in x64dbg
In the x64dbg manual is many scripting commands and other things, but nowhere in it is mentioned, how to launch a script.
So, my question is: How to launch a script in x64dbg?
- 1,046
1
vote
0
answers
95
views
Patches are not applying after saving in X64dbg
I'm new to this and I used X64 debugger for a short while
The thing is , I was testing the security for some software (for educational purposes only!) and finally I found a way break into it , but ...
- 121
2
votes
1
answer
146
views
Why module address is different in Cheat Engine than in x32dbg?
Why the module address is different in Cheat Engine than in x32dbg?
I'm trying to read this:
My c++ attempt:
#include "pch.h"
#include "Functions.h"
#include "offsets.h"...
0
votes
2
answers
269
views
Breaking on string access from StringTable (resource)
If I have a resource like this:
STRINGTABLE
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
{
100, "OK"
101, "Warning"
102, "Error"
103, "Name"
104, &...
- 259
0
votes
1
answer
2k
views
Can't find strings on x64 dbg
I can't find strings from message boxes.
Questions:
How do i find the strings?
What are these strange symbols?
Is it possible to transform them into readable ones? how?
Detailed information:
I ...
1
vote
1
answer
144
views
Reverse engineer sticky notes to allow external script to open new notes
For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse ...
0
votes
2
answers
294
views
Finding function in IDA from x64dbg
I've found a function I want to call in x64dbg, and wanted to see it's prototype and how it looks like in IDA. However, I was expecting to see a function in IDA but land in the middle of one.
The ...
- 3
0
votes
1
answer
383
views
A Process does not list on x64dbg attach list
I learning RE with x64dbg on Windows10.
It does not listing process in running process list that I want to attach.
The Process is running 32bit crackme application for learning.
It was created by ...
- 133
-1
votes
1
answer
67
views
Call function more times with other args
I want to call the same function more times but with other args, I can't add new instructions, so how can I call it?
- 1
1
vote
1
answer
1k
views
Bypass USB key activation of a software
(The software is Chinese and contains malware. I do not know if I could upload it here, so temporarily, please let me describe it)
I am asked by a spa store to "do something" to make a ...
- 11
0
votes
1
answer
1k
views
In x64dbg, how to set software breakpoint on specific memory address?
This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg.
In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
- 115
0
votes
1
answer
201
views
Proper workflow for x64dbg to Angr?
I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set ...
- 1
1
vote
2
answers
87
views
Changing page permissions at runtime under a debugger
Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
- 111
0
votes
1
answer
815
views
Program prevents x64dbg from starting or kills it if it's already running. What to do?
I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows.
It looks like the program has some sort of anti-debug protection. I have the following behavior:
...
- 1
1
vote
1
answer
1k
views
With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?
I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra.
I'...
- 123
0
votes
0
answers
107
views
Conditional breakpoint on register containing string catch everything
I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything:
I also tried with dereferenced register [ESI] ==...
- 461
1
vote
1
answer
266
views
how can ı debug encrypted dll with x32dbg and look getregistery request
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass ...
- 13
0
votes
1
answer
159
views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
- 101