Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
1
vote
1answer
42 views
Debug a windows service entry without windbg
An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
1
vote
2answers
120 views
Automating bypassing anti-debug checks
I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
1
vote
2answers
97 views
How to reach functions triggered by non-standard buttons?
I've already read related posts such as:
link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg
link2: How can I set a breakpoint for a button ...
1
vote
0answers
31 views
x64dbg flow-indent style trace logs
I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
0
votes
0answers
64 views
problem with adding TitanHide to x64dbg
I am new and I have a simple problem.
Can someone tell me how to add TitanHide to x64dbg?
I found this:
How can i add plugins in x64dbg?
but i guess in case of TitanHide it's harder.
Thanks for help....
2
votes
1answer
48 views
Does x64dbg display the whole memory info even for a simple program opened?
I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below.
#include <stdio.h>
void main()
{
int x, y, z;
while(...
1
vote
2answers
86 views
Comparison between orginal and modified DLL files with x64dbg
Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?
And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
1
vote
1answer
65 views
Outputting a patched DLL from x64dbg
I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files.
Using x64dbg, I've ...
2
votes
0answers
60 views
How to solve anti-patch protection involving NtContinue? [duplicate]
I'm having an issue when trying to patch an application. If I open the .exe application with x64dbg, it first goes through ntdll.dll and then runs the application module. It works fine as long as I ...
4
votes
1answer
65 views
Search strings in multiple files/processes/modules (x64dbg)
when you click String references in x64dbg, it only lists strings from current module/file. Is that possible to search strings in multiple (selected) files/modules?
3
votes
1answer
68 views
x64dbg - see the current position?
i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment? because, i want to breakpoint at the moment of the specific button-click in target ...
3
votes
1answer
96 views
Unable to use CreateRemoteThread in target process
I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does ...
2
votes
1answer
61 views
Forcefully interpret code in x64dbg
I was just wondering if there was a way to force an interpretation of a block of code in x64dbg.
The section im analyzing fluctuates between this:
and this:
1
vote
2answers
327 views
How to view string references?
I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program.
how to get the references from program itself?
is it ...
4
votes
1answer
275 views
How to copy binary file with x64dbg\x32dbg after it changed it self
I know how to do it with OllyDbg but with x64dbg\x32dbg I don't know how to do it.
I have a packed binary file and at some point it unpacks itself and I found the point where it does it.
I want to ...
0
votes
0answers
81 views
xdbg64 loading dll with export function
anyone knows how to load a DLL in xdbg64 with parameter for the export function?
eg. lets say x.dll with the following export functions routine & start
how do I load x.dll into xdbg64 using the ...
0
votes
1answer
294 views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
1
vote
0answers
77 views
Failed to set breakpoint (Anti-debug protection)
Sorry for my bad English in advance.
There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
2answers
88 views
FThunks when trying to get IAT
Pretty new to RE so sorry if this is a dumb question.
I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
1
vote
1answer
138 views
identifying function prototype from dll
I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution.
So my requirement is to create a program ...
0
votes
1answer
99 views
x64Dbg view jumps to selected command
I've poked around the settings for x64dbg and never managed to find this. I was just wondering if there was an option for x64dbg similar to ollydbg's "show jumps to selected command":
Thanks all
2
votes
1answer
193 views
(Newbie warning) Trace back which function called the message box? (x64dbg)
I have an error message pop up on the screen every few seconds on a program.
I would like to trace it back as to which function is calling the message box and why.
I found the referenced string but ...
-1
votes
1answer
333 views
VMProtect keygen, turn off the anti-debugging
who faced with VMProtect? I just found on the Internet crackme and decided to grunt it, but unfortunately not that good of it did not work out, as the message about prevention of debugging climbed out....
0
votes
1answer
190 views
Is there a way to see all “values” in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
0
votes
1answer
102 views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
0
votes
1answer
130 views
Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?
Some of my breakpoints perfectly survive multiple restarts.
But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
0
votes
0answers
45 views
x64dbg - IAT corrupted in saved patched executable?
I've modified 146 bytes in the .text section of an executable, and it runs perfectly within x64dbg. However, when I go to save the patches to the executable via
File -> Patch File -> Patch File ...
1
vote
0answers
280 views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
-2
votes
1answer
124 views
What are modern techniques of reverse engineering? [closed]
I read an article on x64dbg blog(https://x64dbg.com/blog/2016/07/09/introducing-contemporary-reverse-engineering-technique-to-real-world-use.html) which mentions modern techniques of reverse ...
6
votes
1answer
344 views
How does this EB F2 x86 instruction work?
In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
1
vote
2answers
267 views
Record all calls to specific function? Olly/x64dbg
I need to find values of arguments that are passed to specific function.
Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
0
votes
1answer
269 views
How can I define a struct in x64/x32Dbg?
See the image how there is ecx, ecx+4, ecx+8, ecx+24, etc... What if this is a struct and I want to define it... Can I do this in x64Dbg and if so, how? I do see a Struct tab in the hex dump area, but ...
1
vote
1answer
281 views
Dealing with exceptions in x64dbg
I'm debugging a game and I often come across an exception (EXCEPTION_PRIV_INSTRUCTION)
The debugger pauses on the address where it stops, now I want to step over one command at a time but when I step ...
4
votes
0answers
95 views
Define function in x64dbg
I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions?
A simple example would be to have a definition for WinMain(hInstance, ...
2
votes
0answers
94 views
How can I fix an unpacked binary which calls out-of-bounds memory?
I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
5
votes
1answer
226 views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
2
votes
1answer
116 views
Log EIP while in a certain memory range?
I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
0
votes
0answers
91 views
Can't access address in x32dbg
Hi guys, from the image - it can be seen that the address at EAX can't be accessed. I was wondering why this was the case - especially since the code is clearly pulling a value from the memory address ...
4
votes
2answers
463 views
How to label local variables in x64dbg
As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:
I found no way to label locals in the debugger ...
1
vote
1answer
56 views
In a native debugger, what must be done in order to resolve ntdll/other API symbols manually?
I'm reversing a Windows binary using x32Dbg and I have the following instruction: call ntdll.776C695A.
What steps should I take in order to find out which function this is and/or what it does? The ...
0
votes
0answers
432 views
Why some ppl don't use IDA Pro dbg to do dynamic analysis?
Could someone explain to me why there is so much people stating one should use IDA for static analysis and other dbg to dynamic analysis (ollydbg, x64dbg, etc)?
I'm studying IDA for few months and I ...
2
votes
0answers
120 views
What tool is able to analyze/decompile asm execution trace?
I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops).
I ...
4
votes
2answers
2k views
How to break when specific text is found
In this line of code:
mov eax,dword ptr [eax+8];
eax+8 contains a long string of text, I want to find out where it originally came from.
In either OllyDbg or x32dbg, how can I break when ...
1
vote
1answer
267 views
Find what writes to a dynamic memory address
I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
0
votes
1answer
760 views
Calling DLL exports in x64dbg
I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
1
vote
0answers
454 views
Find memory mapped file with x64dbg
I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says:
Type: Section
Description: A memory mapped file or ...
5
votes
1answer
1k views
IDA Pro Plugin to add x64dbg
Is there a plugin for IDA Pro to enable me to add x64dbg debugger support to IDA Pro 6.8 or 6.9?
3
votes
1answer
1k views
Displaying IDA names in x64dbg or OllyDbg
I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
