Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
164
questions
0
votes
1answer
51 views
please explain the difference between the two types of follow
in file i find
mov rcx,qword ptr ds:[404320]
when I wanted to see what is at the address 404320
i press "follow in dump" and i got a choice between "constant: file.0000000000404320&...
0
votes
0answers
63 views
Heavens gate code
Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you.
I use Intel Pin
push cs
push 0xa02829
jmp far ...
0
votes
1answer
76 views
How do I find a function and find out what it does using reverse engineering?
I am attempting to find a function in a specific game. Is there anyway that , using the assembly code I get from decompiling the game in either Ida or x64dbg , I can locate a function I am ...
2
votes
1answer
110 views
Finding function from pattern
I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find:
\x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C
\x89\x4C\x24\x20\x48\x83\xEC\x28\x48\...
2
votes
0answers
59 views
Strange exception thrown while debugging in Win10, but not Win7
I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
1
vote
1answer
97 views
A tutorial or docs to unpack a custom packed PE
I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
1
vote
1answer
32 views
How to use decimal in x64dbg calculator?
The x64dbg calculator can evaluate hex expressions.
Is there a syntax to calculate the sum of a hex value and a decimal value? For the example in the snapshot, is it possible to treat 10 as a decimal?...
0
votes
0answers
56 views
How to decrypt/decode the strings found in desktop application with x64dbg?
I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
1
vote
3answers
132 views
x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection
I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
0
votes
1answer
62 views
decoding thread context structure in x64dbg
Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
0
votes
1answer
44 views
function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?
I need urgent help , I was debugging a software made by Visual basic 6 , and I found
vbavarindexload function and I need to know what is doing ?
Thanks in advance
0
votes
1answer
95 views
How can I detect if my application is running in x64debug?
I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response.
When building the application, I am easily able to detect it is ...
0
votes
1answer
288 views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
2
votes
1answer
395 views
How to get offset of specific function in exe?
Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
0
votes
0answers
29 views
How to extract an AutoIT script when tools fail to extract it?
Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it.
What would you do? is there any place in ...
0
votes
1answer
344 views
How to bypass anti-debugging C++
So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it.
I even tried using ScyllaHide at max settings but still it detects ...
1
vote
0answers
125 views
Is there a clear Ollydbg successor?
I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
1
vote
1answer
445 views
How to run a script in x64dbg
In the x64dbg manual is many scripting commands and other things, but nowhere in it is mentioned, how to launch a script.
So, my question is: How to launch a script in x64dbg?
1
vote
0answers
55 views
Patches are not applying after saving in X64dbg
I'm new to this and I used X64 debugger for a short while
The thing is , I was testing the security for some software (for educational purposes only!) and finally I found a way break into it , but ...
2
votes
1answer
98 views
Why module address is different in Cheat Engine than in x32dbg?
Why the module address is different in Cheat Engine than in x32dbg?
I'm trying to read this:
My c++ attempt:
#include "pch.h"
#include "Functions.h"
#include "offsets.h"...
0
votes
2answers
133 views
Breaking on string access from StringTable (resource)
If I have a resource like this:
STRINGTABLE
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
{
100, "OK"
101, "Warning"
102, "Error"
103, "Name"
104, &...
0
votes
1answer
1k views
Can't find strings on x64 dbg
I can't find strings from message boxes.
Questions:
How do i find the strings?
What are these strange symbols?
Is it possible to transform them into readable ones? how?
Detailed information:
I ...
1
vote
1answer
89 views
Reverse engineer sticky notes to allow external script to open new notes
For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse ...
0
votes
0answers
107 views
EXCEPTION_ACCESS_VIOLATION in x32dbg
What is EXCEPTION_ACCESS_VIOLATION and how can i handle it?
I am a complete beginner and could not understand. Thanks in advance.
Edit: as I learned EXCEPTION_ACCESS_VIOLATION occurs when either ...
0
votes
0answers
40 views
Pressing an application's button
I'm trying to press a button in a game (Final Fantasy XIV). I was hoping to make my life easier by automaticlaly log me in. Currently I want to press "Play" by reversing the Play button ...
0
votes
2answers
162 views
Finding function in IDA from x64dbg
I've found a function I want to call in x64dbg, and wanted to see it's prototype and how it looks like in IDA. However, I was expecting to see a function in IDA but land in the middle of one.
The ...
0
votes
1answer
227 views
A Process does not list on x64dbg attach list
I learning RE with x64dbg on Windows10.
It does not listing process in running process list that I want to attach.
The Process is running 32bit crackme application for learning.
It was created by ...
-1
votes
1answer
53 views
Call function more times with other args
I want to call the same function more times but with other args, I can't add new instructions, so how can I call it?
1
vote
1answer
770 views
Bypass USB key activation of a software
(The software is Chinese and contains malware. I do not know if I could upload it here, so temporarily, please let me describe it)
I am asked by a spa store to "do something" to make a ...
0
votes
1answer
843 views
In x64dbg, how to set software breakpoint on specific memory address?
This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg.
In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
0
votes
1answer
152 views
Proper workflow for x64dbg to Angr?
I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set ...
1
vote
2answers
48 views
Changing page permissions at runtime under a debugger
Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
0
votes
1answer
502 views
Program prevents x64dbg from starting or kills it if it's already running. What to do?
I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows.
It looks like the program has some sort of anti-debug protection. I have the following behavior:
...
1
vote
1answer
716 views
With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?
I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra.
I'...
0
votes
0answers
50 views
Conditional breakpoint on register containing string catch everything
I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything:
I also tried with dereferenced register [ESI] ==...
1
vote
1answer
147 views
how can ı debug encrypted dll with x32dbg and look getregistery request
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass ...
0
votes
1answer
128 views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
2
votes
1answer
225 views
x64dbg or alternative: Run to selection while storing all ran opcodes
I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and ...
0
votes
1answer
132 views
Debug with IDA Pro right click option
So I was wondering if is there a way for IDA to appears in the righ click options of an executable.
As you can see, Debug with x64dbg was built by itself, IDA 32 didn't do, so I just changed it in ...
0
votes
0answers
105 views
x64dbg show some text in Chinese
While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why.
This happened after I moved to a new computer but both of them were Windows 10.
In my old computer I ...
1
vote
1answer
452 views
Calling/debugging calls to DLL via ollydbg or x64dbg
I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end).
How do I ...
0
votes
0answers
89 views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
1
vote
1answer
144 views
How to calculate value inside stack segment (SS)
I have an assembly row which the following information:
EBP = 006FFB50
SS = 002B
When I looked on this row:
mov eax,dword ptr ss:[ebp+8]
I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58.
But ...
0
votes
1answer
248 views
How to view the functions of a loaded library in x64dbg
I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I ...
0
votes
0answers
81 views
What's the reason for a program to crash every time a breakpoint is set in x64dbg?
I know this question may be an ambiguous one and so may not be straightforward, so I apologize for that. Nevertheless, I believe that anti-debugging is responsible for the constant crashing of the ...
0
votes
0answers
294 views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
1
vote
1answer
97 views
How can I easily convert little endian pointers in hex dumps?
I am tracking down a data structure whose address is inside the second operand:
mov rcx, qword ptr ss:[rbp+E0]
When I look at the value of [rbp+E0] I see the following dump:
21 C4 FC 5E 00 00 00 00
...
0
votes
0answers
39 views
Set a breakpoint for a win command without an address
How to make these columns empty or make a new breakpoint where they are empty? I just need a stop at these win commands (in the summary column), not at a specific address.
I don't know what exactly ...
0
votes
1answer
33 views
How to whitelist an address for breakpoint?
If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping?
Seems that it is needed to use conditions. How?
I use x64dbg, but if you only know a way in ...
2
votes
0answers
143 views
x64dbg break when hex string is loaded
I'm trying to break execution when a string is loaded in memory.
I can´t find the string by using the search for -> string references
So I press Alt + M and press Ctrl + B to search my string ...