Questions tagged [x64dbg]

An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.

Filter by
Sorted by
Tagged with
1 vote
0 answers
24 views

analyze track program protected

What are the modern methods of dealing with obfuscation and code virtualization? all these protectors create unrealistic code traces?
user avatar
  • 11
1 vote
1 answer
37 views

How to locate a string in memory with x64dbg

I opened a 32-bit program with x32dbg, I wrote something on a text box like this : How can I find the piece of code that manipulates the string "Goku" ? I searched all string references but ...
user avatar
  • 111
1 vote
1 answer
62 views

Calling function with string as parameter

I'm trying to call a function in a game that makes my character sending a message. I already called a few functions in this game but this one has a tricky parameter. The function signature should be ...
user avatar
  • 131
0 votes
1 answer
70 views

How to find the first function that sets the value currently stored in a given register?

I'm interested in a general approach to the following problem: The function F_Init allocates a byte buffer called Buffer with a size called BufSize. The Buffer is allocated with each frame/iteration ...
user avatar
0 votes
1 answer
78 views

x64dbg: is there a way to save the complete disassembly of a module to a text file?

Is it possible to save the complete disassembly / listing to a file, and if so, how can it be done?
user avatar
1 vote
1 answer
136 views

How to load a PDB file into x64dbg?

I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
user avatar
2 votes
1 answer
75 views

x64dbg : TraceInto only in user code

The question seems pretty simple, but I can't achieve this simple thing in a reasonable time. I have a malware proceeding to deobfuscate a large amount of APIs in memory. Only the pointer to the ...
user avatar
  • 23
1 vote
1 answer
49 views

Searching for strings only partially works in x64Dbg

Please note that I am new to x64dbg. As you can be seen in the picture below, the error message has the string [ebp+8]:L"The information you have entered is invalid!\n..." However, when I ...
user avatar
0 votes
0 answers
57 views

x64dbg placing a on write breakpoint on a dynamic allocated address

I am currently trying to reverse the registration scheme of a crackme. I found the jump instruction that decides if the title of the program says “registered” or “unregistered” by simply searching for ...
user avatar
1 vote
1 answer
49 views

How to navigate Disassembly view to specific absolute address location?

I have an absolute address that I want to scroll the Disassembly to in order to see which instructions are at that address. I understand that I can scroll by hand, or I can edit RIP. But the former ...
user avatar
0 votes
0 answers
24 views

Call function only when check box is checked

Which function is responsible whether the check box is checked or not in disassembler's intermodular calls window?
user avatar
1 vote
1 answer
102 views

Instructions to compare two strings

I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
user avatar
0 votes
0 answers
41 views

x64dbg isn't running the program I'm looking at

I'm almost definitely being an idiot but I have opened up an .exe file in x64dbg and I can run the file just fine when looking at the assembly but it doesn't open a second window so I can see the ...
user avatar
  • 1
0 votes
1 answer
69 views

x64dbg doesn't show Chinese strings in String references?

I'm wondering if x64dbg can show Chinese letters in String references? Because I try to reverse 3 Chinese programs from complete different coders and I never found any Chinese strings. But in the ...
user avatar
1 vote
1 answer
171 views

x64dbg is unable to find string references vs. Ollydbg

I want to know how to find string references in x64dbg as Olly does : it finds every string references I need when I open Memory map window, then rightclick on "Search" and then I enter the ...
user avatar
0 votes
1 answer
71 views

please explain the difference between the two types of follow

in file i find mov rcx,qword ptr ds:[404320] when I wanted to see what is at the address 404320 i press "follow in dump" and i got a choice between "constant: file.0000000000404320&...
user avatar
  • 3
0 votes
0 answers
88 views

Heavens gate code

Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you. I use Intel Pin push cs push 0xa02829 jmp far ...
user avatar
  • 21
0 votes
1 answer
122 views

How do I find a function and find out what it does using reverse engineering?

I am attempting to find a function in a specific game. Is there any way that, using the assembly code I get from decompiling the game in either IDA or x64dbg, I can locate a function I am specifically ...
user avatar
2 votes
1 answer
176 views

Finding function from pattern

I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find: \x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C \x89\x4C\x24\x20\x48\x83\xEC\x28\x48\...
user avatar
2 votes
0 answers
80 views

Strange exception thrown while debugging in Win10, but not Win7

I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
user avatar
1 vote
1 answer
126 views

A tutorial or docs to unpack a custom packed PE

I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
user avatar
  • 11
1 vote
1 answer
44 views

How to use decimal in x64dbg calculator?

The x64dbg calculator can evaluate hex expressions. Is there a syntax to calculate the sum of a hex value and a decimal value? For the example in the snapshot, is it possible to treat 10 as a decimal?...
user avatar
0 votes
0 answers
121 views

How to decrypt/decode the strings found in desktop application with x64dbg?

I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
user avatar
1 vote
3 answers
325 views

x64dbg Crash on Dynamic Debugging Remove Anti-Debugging Protection

I am trying to run Dynamic code analysis using x64dbg for Windows 64 bit executable. I install the anti-debugging plugin for x64dbg from https://github.com/x64dbg/ScyllaHide. I still find the ...
user avatar
0 votes
1 answer
101 views

decoding thread context structure in x64dbg

Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
user avatar
0 votes
1 answer
61 views

function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?

I need urgent help , I was debugging a software made by Visual basic 6 , and I found vbavarindexload function and I need to know what is doing ? Thanks in advance
user avatar
0 votes
1 answer
150 views

How can I detect if my application is running in x64debug?

I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response. When building the application, I am easily able to detect it is ...
user avatar
0 votes
1 answer
770 views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
user avatar
2 votes
1 answer
732 views

How to get offset of specific function in exe?

Suppose I have self-compiled exe-file (aka portable executable), its source (c/c++) and generated pdb-file. And what if I want to get offset of its function (non-winapi function) in debugger (x64dbg, ...
user avatar
  • 23
0 votes
0 answers
49 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
user avatar
0 votes
1 answer
580 views

How to bypass anti-debugging C++

So I have a crackme my friend sent to try and crack it but the problem that I cannot bypass the anti-debugging or even patching it. I even tried using ScyllaHide at max settings but still it detects ...
user avatar
1 vote
0 answers
208 views

Is there a clear Ollydbg successor?

I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
user avatar
1 vote
1 answer
853 views

How to run a script in x64dbg

In the x64dbg manual is many scripting commands and other things, but nowhere in it is mentioned, how to launch a script. So, my question is: How to launch a script in x64dbg?
user avatar
  • 1,046
1 vote
0 answers
95 views

Patches are not applying after saving in X64dbg

I'm new to this and I used X64 debugger for a short while The thing is , I was testing the security for some software (for educational purposes only!) and finally I found a way break into it , but ...
user avatar
2 votes
1 answer
146 views

Why module address is different in Cheat Engine than in x32dbg?

Why the module address is different in Cheat Engine than in x32dbg? I'm trying to read this: My c++ attempt: #include "pch.h" #include "Functions.h" #include "offsets.h"...
user avatar
0 votes
2 answers
269 views

Breaking on string access from StringTable (resource)

If I have a resource like this: STRINGTABLE LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US { 100, "OK" 101, "Warning" 102, "Error" 103, "Name" 104, &...
user avatar
0 votes
1 answer
2k views

Can't find strings on x64 dbg

I can't find strings from message boxes. Questions: How do i find the strings? What are these strange symbols? Is it possible to transform them into readable ones? how? Detailed information: I ...
user avatar
1 vote
1 answer
144 views

Reverse engineer sticky notes to allow external script to open new notes

For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse ...
user avatar
0 votes
2 answers
294 views

Finding function in IDA from x64dbg

I've found a function I want to call in x64dbg, and wanted to see it's prototype and how it looks like in IDA. However, I was expecting to see a function in IDA but land in the middle of one. The ...
user avatar
  • 3
0 votes
1 answer
383 views

A Process does not list on x64dbg attach list

I learning RE with x64dbg on Windows10. It does not listing process in running process list that I want to attach. The Process is running 32bit crackme application for learning. It was created by ...
user avatar
-1 votes
1 answer
67 views

Call function more times with other args

I want to call the same function more times but with other args, I can't add new instructions, so how can I call it?
user avatar
  • 1
1 vote
1 answer
1k views

Bypass USB key activation of a software

(The software is Chinese and contains malware. I do not know if I could upload it here, so temporarily, please let me describe it) I am asked by a spa store to "do something" to make a ...
user avatar
0 votes
1 answer
1k views

In x64dbg, how to set software breakpoint on specific memory address?

This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg. In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
user avatar
0 votes
1 answer
201 views

Proper workflow for x64dbg to Angr?

I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set ...
user avatar
  • 1
1 vote
2 answers
87 views

Changing page permissions at runtime under a debugger

Does x64dbg or another debugger provide a way to change the page permissions for all mapped pages for a given section at runtime? Perhaps via a plugin?
user avatar
  • 111
0 votes
1 answer
815 views

Program prevents x64dbg from starting or kills it if it's already running. What to do?

I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows. It looks like the program has some sort of anti-debug protection. I have the following behavior: ...
user avatar
  • 1
1 vote
1 answer
1k views

With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?

I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra. I'...
user avatar
  • 123
0 votes
0 answers
107 views

Conditional breakpoint on register containing string catch everything

I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything: I also tried with dereferenced register [ESI] ==...
user avatar
  • 461
1 vote
1 answer
266 views

how can ı debug encrypted dll with x32dbg and look getregistery request

I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point. I can bypass ...
user avatar
0 votes
1 answer
159 views

Calling MessageBoxW x64 confused about pointer

OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this. I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
user avatar
  • 101