Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
0
votes
1answer
23 views
x64dbg - Conditional breakpoint based on function argument
How can I set a conditional breakpoint based on the argument of a function?
I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
0
votes
1answer
44 views
The callstack does not show the message handler
After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler?
Say I am reversing an ...
0
votes
0answers
31 views
File exe patch seems to be corrupt!
I can edit the file from jne to je and it works if I do the x32dbg operation.
However, when I save the patch in the executable, when I launch the program it gives me an error. It is certainly a ...
1
vote
1answer
39 views
Is there any debugger that supports step-back? [duplicate]
In Ida when I use debugger, but I can't step back.
Is there any debugger that allow go backwards?
0
votes
1answer
26 views
x64dbg “System” meaning
I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ...
0
votes
0answers
19 views
Debug Software Dongle Activkey [closed]
please I have a software called mensura it is protected with a dongle actikey I have a friends who found his crack he debug a file.dll my qestion how to know the responsible function .and what a ...
2
votes
1answer
43 views
dongle check happen before a debugger start debugging
i'm trying to fake the test ( dongle exist )
but one problem that i encounter is that the application detect it before i start debugging it .
this is what happen with more details : open( not ...
2
votes
1answer
85 views
How to save (trace) the execution route/sequences in debugger and Replay?
is it possible to save the step-by-step execution route of the program?
i.e. lets say in x64dbg the program executes one handle after another
and so on, probably hundreds of calls...
But according ...
0
votes
1answer
106 views
How to locate an specific data structure in an executable?
I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
0
votes
0answers
90 views
Invisible strings ? (x64dbg)
I am a newbie in reverse-engineering, and I use x64dbg ...
However, I don't understand something: in my program there are various words (such as "failed to" or "Please" ...) and when I type in x64dbg ...
7
votes
3answers
770 views
OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?
OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
1
vote
1answer
89 views
Run any line/command in x64dbg
Is it possible, to run whichever line I want?
For example, if it is at black position, and i want to run the RED CIRCLED command:
I couldn't find a way to do that, neither in right click or etc......
1
vote
1answer
141 views
x64dbg how to watch all changes after one step
We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows?
x64dbg 32bit version trace:
NEW UPDATE
...
2
votes
1answer
118 views
What's the fastest way to set a breakpoint when a value I know gets written in memory, if the memory address is different each time due to ASLR?
I have a 64bit exe I'm debugging with x64dbg.
I'm searching for a specfic string value myvalue that sits encrypted somewhere in the exe (so, searching for myvalue at the beginning returns nothing).
...
0
votes
2answers
90 views
.exe file to .class, decompiled to .java, how to put back to .class?
I'm trying to reverse engineer a very complex .exe to alter its behavior.
Ran JWScan that tells me it's been wrapped with Jar2Exe (which I also saw during debugging).
Looking at the complex exe with ...
1
vote
0answers
136 views
How to step to specific function call?
I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
2
votes
1answer
83 views
Debug a windows service entry without windbg
An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
1
vote
2answers
383 views
Automating bypassing anti-debug checks
I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
1
vote
2answers
118 views
How to reach functions triggered by non-standard buttons?
I've already read related posts such as:
link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg
link2: How can I set a breakpoint for a button ...
1
vote
0answers
44 views
x64dbg flow-indent style trace logs
I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
0
votes
0answers
254 views
problem with adding TitanHide to x64dbg
I am new and I have a simple problem.
Can someone tell me how to add TitanHide to x64dbg?
I found this:
How can i add plugins in x64dbg?
but i guess in case of TitanHide it's harder.
Thanks for help....
2
votes
1answer
95 views
Does x64dbg display the whole memory info even for a simple program opened?
I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below.
#include <stdio.h>
void main()
{
int x, y, z;
while(...
1
vote
2answers
283 views
Comparison between orginal and modified DLL files with x64dbg
Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?
And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
1
vote
1answer
171 views
Outputting a patched DLL from x64dbg
I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files.
Using x64dbg, I've ...
2
votes
0answers
76 views
How to solve anti-patch protection involving NtContinue? [duplicate]
I'm having an issue when trying to patch an application. If I open the .exe application with x64dbg, it first goes through ntdll.dll and then runs the application module. It works fine as long as I ...
4
votes
1answer
140 views
Search strings in multiple files/processes/modules (x64dbg)
when you click String references in x64dbg, it only lists strings from current module/file. Is that possible to search strings in multiple (selected) files/modules?
3
votes
1answer
148 views
x64dbg - see the current position?
i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment?
3
votes
1answer
126 views
Unable to use CreateRemoteThread in target process
I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does ...
2
votes
1answer
75 views
Forcefully interpret code in x64dbg
I was just wondering if there was a way to force an interpretation of a block of code in x64dbg.
The section im analyzing fluctuates between this:
and this:
1
vote
2answers
2k views
How to view string references?
I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program.
how to get the references from program itself?
is it ...
4
votes
1answer
617 views
How to copy binary file with x64dbg\x32dbg after it changed it self
I know how to do it with OllyDbg but with x64dbg\x32dbg I don't know how to do it.
I have a packed binary file and at some point it unpacks itself and I found the point where it does it.
I want to ...
0
votes
0answers
161 views
xdbg64 loading dll with export function
anyone knows how to load a DLL in xdbg64 with parameter for the export function?
eg. lets say x.dll with the following export functions routine & start
how do I load x.dll into xdbg64 using the ...
0
votes
1answer
841 views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
1
vote
0answers
104 views
Failed to set breakpoint (Anti-debug protection)
Sorry for my bad English in advance.
There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
2answers
201 views
FThunks when trying to get IAT
Pretty new to RE so sorry if this is a dumb question.
I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
1
vote
1answer
181 views
identifying function prototype from dll
I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution.
So my requirement is to create a program ...
0
votes
1answer
201 views
x64Dbg view jumps to selected command
I've poked around the settings for x64dbg and never managed to find this. I was just wondering if there was an option for x64dbg similar to ollydbg's "show jumps to selected command":
Thanks all
2
votes
1answer
612 views
Trace back which function called the message box in x64dbg?
I have an error message pop up on the screen every few seconds on a program.
I would like to trace it back as to which function is calling the message box and why.
I found the referenced string but ...
-1
votes
1answer
592 views
VMProtect keygen, turn off the anti-debugging
who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
0
votes
1answer
215 views
Is there a way to see all “values” in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
0
votes
1answer
255 views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
1
vote
1answer
242 views
Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?
Some of my breakpoints perfectly survive multiple restarts.
But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
0
votes
0answers
68 views
x64dbg - IAT corrupted in saved patched executable?
I've modified 146 bytes in the .text section of an executable, and it runs perfectly within x64dbg. However, when I go to save the patches to the executable via
File -> Patch File -> Patch File ...
1
vote
0answers
440 views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
-2
votes
1answer
132 views
What are modern techniques of reverse engineering? [closed]
I read an article on x64dbg blog(https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html) which mentions modern techniques of reverse ...
6
votes
1answer
416 views
How does this EB F2 x86 instruction work?
In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
2
votes
2answers
418 views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
0
votes
1answer
463 views
How can I define a struct in x64/x32Dbg?
See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but ...
1
vote
1answer
546 views
Dealing with exceptions in x64dbg
I'm debugging a game and I often come across an exception (EXCEPTION_PRIV_INSTRUCTION)
The debugger pauses on the address where it stops, now I want to step over one command at a time but when I step ...
4
votes
0answers
115 views
Define function in x64dbg
I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions?
A simple example would be to have a definition for WinMain(hInstance, ...
