Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
1
vote
1answer
66 views
Run any line/command in x64dbg
Is it possible, to run whichever line I want?
For example, if it is at black position, and i want to run the RED CIRCLED command:
I couldn't find a way to do that, neither in right click or etc......
1
vote
1answer
87 views
x64dbg how to watch all changes after one step
We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?
x64dbg 32bit version trace:
NEW UPDATE
...
2
votes
1answer
70 views
What's the fastest way to set a breakpoint when a value I know gets written in memory, if the memory address is different each time due to ASLR?
I have a 64bit exe I'm debugging with x64dbg.
I'm searching for a specfic string value myvalue that sits encrypted somewhere in the exe (so, searching for myvalue at the beginning returns nothing).
...
0
votes
2answers
54 views
.exe file to .class, decompiled to .java, how to put back to .class?
I'm trying to reverse engineer a very complex .exe to alter its behavior.
Ran JWScan that tells me it's been wrapped with Jar2Exe (which I also saw during debugging).
Looking at the complex exe with ...
0
votes
0answers
48 views
How to step to specific function call?
I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
2
votes
1answer
69 views
Debug a windows service entry without windbg
An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
1
vote
2answers
199 views
Automating bypassing anti-debug checks
I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
1
vote
2answers
112 views
How to reach functions triggered by non-standard buttons?
I've already read related posts such as:
link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg
link2: How can I set a breakpoint for a button ...
1
vote
0answers
38 views
x64dbg flow-indent style trace logs
I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
0
votes
0answers
151 views
problem with adding TitanHide to x64dbg
I am new and I have a simple problem.
Can someone tell me how to add TitanHide to x64dbg?
I found this:
How can i add plugins in x64dbg?
but i guess in case of TitanHide it's harder.
Thanks for help....
2
votes
1answer
66 views
Does x64dbg display the whole memory info even for a simple program opened?
I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below.
#include <stdio.h>
void main()
{
int x, y, z;
while(...
1
vote
2answers
145 views
Comparison between orginal and modified DLL files with x64dbg
Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?
And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
1
vote
1answer
102 views
Outputting a patched DLL from x64dbg
I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files.
Using x64dbg, I've ...
2
votes
0answers
68 views
How to solve anti-patch protection involving NtContinue? [duplicate]
I'm having an issue when trying to patch an application. If I open the .exe application with x64dbg, it first goes through ntdll.dll and then runs the application module. It works fine as long as I ...
4
votes
1answer
95 views
Search strings in multiple files/processes/modules (x64dbg)
when you click String references in x64dbg, it only lists strings from current module/file. Is that possible to search strings in multiple (selected) files/modules?
3
votes
1answer
99 views
x64dbg - see the current position?
i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment? because, i want to breakpoint at the moment of the specific button-click in target ...
3
votes
1answer
115 views
Unable to use CreateRemoteThread in target process
I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does ...
2
votes
1answer
65 views
Forcefully interpret code in x64dbg
I was just wondering if there was a way to force an interpretation of a block of code in x64dbg.
The section im analyzing fluctuates between this:
and this:
1
vote
2answers
864 views
How to view string references?
I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program.
how to get the references from program itself?
is it ...
4
votes
1answer
427 views
How to copy binary file with x64dbg\x32dbg after it changed it self
I know how to do it with OllyDbg but with x64dbg\x32dbg I don't know how to do it.
I have a packed binary file and at some point it unpacks itself and I found the point where it does it.
I want to ...
0
votes
0answers
135 views
xdbg64 loading dll with export function
anyone knows how to load a DLL in xdbg64 with parameter for the export function?
eg. lets say x.dll with the following export functions routine & start
how do I load x.dll into xdbg64 using the ...
0
votes
1answer
547 views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
1
vote
0answers
89 views
Failed to set breakpoint (Anti-debug protection)
Sorry for my bad English in advance.
There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
2answers
133 views
FThunks when trying to get IAT
Pretty new to RE so sorry if this is a dumb question.
I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
1
vote
1answer
166 views
identifying function prototype from dll
I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution.
So my requirement is to create a program ...
0
votes
1answer
126 views
x64Dbg view jumps to selected command
I've poked around the settings for x64dbg and never managed to find this. I was just wondering if there was an option for x64dbg similar to ollydbg's "show jumps to selected command":
Thanks all
2
votes
1answer
343 views
Trace back which function called the message box in x64dbg?
I have an error message pop up on the screen every few seconds on a program.
I would like to trace it back as to which function is calling the message box and why.
I found the referenced string but ...
-1
votes
1answer
474 views
VMProtect keygen, turn off the anti-debugging
who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
0
votes
1answer
201 views
Is there a way to see all “values” in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
0
votes
1answer
185 views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
1
vote
1answer
185 views
Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?
Some of my breakpoints perfectly survive multiple restarts.
But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
0
votes
0answers
58 views
x64dbg - IAT corrupted in saved patched executable?
I've modified 146 bytes in the .text section of an executable, and it runs perfectly within x64dbg. However, when I go to save the patches to the executable via
File -> Patch File -> Patch File ...
1
vote
0answers
393 views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
-2
votes
1answer
127 views
What are modern techniques of reverse engineering? [closed]
I read an article on x64dbg blog(https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html) which mentions modern techniques of reverse ...
6
votes
1answer
378 views
How does this EB F2 x86 instruction work?
In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
1
vote
2answers
346 views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
0
votes
1answer
370 views
How can I define a struct in x64/x32Dbg?
See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but ...
1
vote
1answer
394 views
Dealing with exceptions in x64dbg
I'm debugging a game and I often come across an exception (EXCEPTION_PRIV_INSTRUCTION)
The debugger pauses on the address where it stops, now I want to step over one command at a time but when I step ...
4
votes
0answers
105 views
Define function in x64dbg
I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions?
A simple example would be to have a definition for WinMain(hInstance, ...
2
votes
0answers
106 views
How can I fix an unpacked binary which calls out-of-bounds memory?
I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
5
votes
1answer
235 views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
2
votes
1answer
137 views
Log EIP while in a certain memory range?
I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
4
votes
2answers
555 views
How to label local variables in x64dbg
As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:
I found no way to label locals in the debugger ...
1
vote
1answer
59 views
In a native debugger, what must be done in order to resolve ntdll/other API symbols manually?
I'm reversing a Windows binary using x32Dbg and I have the following instruction: call ntdll.776C695A.
What steps should I take in order to find out which function this is and/or what it does? The ...
0
votes
0answers
503 views
Why some ppl don't use IDA Pro dbg to do dynamic analysis?
Could someone explain to me why there is so much people stating one should use IDA for static analysis and other dbg to dynamic analysis (ollydbg, x64dbg, etc)?
I'm studying IDA for few months and I ...
2
votes
0answers
132 views
What tool is able to analyze/decompile asm execution trace?
I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops).
I ...
4
votes
2answers
2k views
How to break when specific text is found
In this line of code:
mov eax,dword ptr [eax+8];
eax+8 contains a long string of text, I want to find out where it originally came from.
In either OllyDbg or x32dbg, how can I break when ...
1
vote
1answer
359 views
Find what writes to a dynamic memory address
I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
0
votes
1answer
802 views
Calling DLL exports in x64dbg
I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
1
vote
0answers
482 views
Find memory mapped file with x64dbg
I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says:
Type: Section
Description: A memory mapped file or ...
