Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
138
questions
0
votes
1answer
41 views
With ghidra/x64dbg sync, how to display dynamic values in ghidra's decompile window?
I'm reversing a program and a library without debugging symbols. I'm using x64dbg to break at specific regions and observe what is happening at runtime, and annotate the decompile version in ghidra.
I'...
0
votes
0answers
24 views
Conditional breakpoint on register containing string catch everything
I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything:
I also tried with dereferenced register [ESI] ==...
1
vote
1answer
42 views
how can ı debug encrypted dll with x32dbg and look getregistery request
I have an executable with 2 .dll calls 1 of this dll is guard.dll others name is guardlib.dll both of them is encrypted c++ library file and they are called before executable entry point.
I can bypass ...
0
votes
1answer
58 views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
1
vote
1answer
70 views
x64dbg or alternative: Run to selection while storing all ran opcodes
I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and ...
0
votes
1answer
59 views
Debug with IDA Pro right click option
So I was wondering if is there a way for IDA to appears in the righ click options of an executable.
As you can see, Debug with x64dbg was built by itself, IDA 32 didn't do, so I just changed it in ...
0
votes
0answers
47 views
x64dbg show some text in Chinese
While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why.
This happened after I moved to a new computer but both of them were Windows 10.
In my old computer I ...
0
votes
0answers
29 views
x64dbg Lock Memory Address w/ a Value
In cheat-engine, there is a way to 'lock a memory address', where if anything tried to change it -- it will change it back to the value you locked it with. Does anyone know of a way, or plugin that ...
0
votes
1answer
93 views
Calling/debugging calls to DLL via ollydbg or x64dbg
I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end).
How do I ...
0
votes
0answers
41 views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
1answer
31 views
How to calculate value inside stack segment (SS)
I have an assembly row which the following information:
EBP = 006FFB50
SS = 002B
When I looked on this row:
mov eax,dword ptr ss:[ebp+8]
I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58.
But ...
0
votes
1answer
42 views
How to view the functions of a loaded library in x64dbg
I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I ...
0
votes
0answers
38 views
What's the reason for a program to crash every time a breakpoint is set in x64dbg?
I know this question may be an ambiguous one and so may not be straightforward, so I apologize for that. Nevertheless, I believe that anti-debugging is responsible for the constant crashing of the ...
0
votes
0answers
62 views
Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions
I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing.
I'm now trying to re-conceptualize everything I've read so far ...
0
votes
0answers
78 views
x64dbg execute till next call OR return
I am using x64dbg and I want to know if there's any way to run the code till next Call statement?
I know there is an "Execute till return" option,
but I want to execute till next call ...
1
vote
1answer
47 views
How can I easily convert little endian pointers in hex dumps?
I am tracking down a data structure whose address is inside the second operand:
mov rcx, qword ptr ss:[rbp+E0]
When I look at the value of [rbp+E0] I see the following dump:
21 C4 FC 5E 00 00 00 00
...
0
votes
0answers
26 views
Set a breakpoint for a win command without an address
How to make these columns empty or make a new breakpoint where they are empty? I just need a stop at these win commands (in the summary column), not at a specific address.
I don't know what exactly ...
0
votes
1answer
31 views
How to whitelist an address for breakpoint?
If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping?
Seems that it is needed to use conditions. How?
I use x64dbg, but if you only know a way in ...
2
votes
0answers
46 views
x64dbg break when hex string is loaded
I'm trying to break execution when a string is loaded in memory.
I can´t find the string by using the search for -> string references
So I press Alt + M and press Ctrl + B to search my string ...
0
votes
0answers
47 views
Debug x64dbgpy scripts in vscode?
i've tried to debug a x64dbgpy script using ptvsd and vscode. don't ask me how, but i was able to break into the script using a "remote python attach" session, setting breakpoints and stepping into ...
1
vote
1answer
151 views
x64dbg, breakpoint on write in memory with specific value
In x64dbg, we can set hardware breakpoint on write in memory dump but can we add more codition?
Ex. Set breakpoin on write of value of 2F.
1
vote
1answer
174 views
x64dbg throwing exception
I have been working on finding an overflow in wordpad and i was able to run an exception with an undefined behavior (my point of view). I am using x64dbg (I am not a pro x64dbg) and it shows ...
2
votes
2answers
288 views
Dealing with obfuscated PUSH PUSH RET instructions
I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
0
votes
1answer
100 views
How to log CPU instructions executed by program with x64dbg?
How to log CPU instructions executed by program with x64dbg?
I saw x64dbg - see the current position? question, but I can't find the way to log instructions.
Thanks!
1
vote
1answer
63 views
How's this code able to make use of the stack?
I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and ...
-2
votes
1answer
586 views
Debug and crack .NET executable PE
First of all, i'm trying to learn reverse engineering for testing my codes and that's all and i'm not stupid enough to do illegal things with my knowledge so please don't give me legal advises.
I'm ...
1
vote
0answers
135 views
Recommended plugins for x64dbg
I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks.
The more you can ...
0
votes
0answers
56 views
x64dbg call function from current thread
While debugging an executable with x64dbg, I want to make a function call (while the executable is stopped on a breakpoint), what I want to do is the same as the following gdb line:
p (void*)freopen("...
0
votes
1answer
129 views
Patching memory
I've successfully reversed and patched an application on windows, but patching the executable on disk triggers a CRC check and prevents it from loading. I've used x64dbg and have the addresses I need (...
0
votes
0answers
57 views
How to display the addresses rather than the labels in x64dbg?
By default, it shows addresses as labels when it can. (call <JMP.&printf>). However, I need it show the actual address itself in the disassembly view. I have looked all around in the GUI, ...
1
vote
0answers
34 views
How to ret with jxx in x64dbg's sciprt
main:
call foo
call bar
ret
foo:
// code
cmp $number, 0
je ret
// code
ret
bar:
// code
cmp $number, 0
je ret
// code
ret
I would like to ...
0
votes
0answers
42 views
Finding out what creates FIFA RTWC 98's main window
I am currently familiarizing myself with x64dbg as a tool for reverse engineering. As an exercise, I challenged myself to try and patch FIFA RTWC 98's executable to force it to run on a windowed mode.
...
0
votes
0answers
51 views
Tracing back the user code section that triggered a message
I have a Windows GUI x86 executable and I have identified, in the .rsrc section, where the error string I want to trace is. Let's assume it is in id=83Ah.
I have set a bpx user32:LoadStringA and then ...
0
votes
0answers
76 views
Reversing WSASend finding functions that called it
I'm trying to make my first DLL calling game functions
What I need is tracing functions that call WSASend, so it will be easy for me to get all functions address to call them from my DLL.
What I ...
2
votes
2answers
116 views
Function Prologue, add esp directive
I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:
push ebp ;...
2
votes
1answer
95 views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
3
votes
1answer
549 views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
0
votes
1answer
74 views
xor eax,3 why does the input change the way it does?
I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
0
votes
0answers
142 views
About x64dbg find command + Help to unpack a program
The find command in x64dbg(x86),
(found here: https://help.x64dbg.com/en/latest/commands/searching/find.html)
doesn't return anything. For example:
findall 0x00524180, "E8 ????????" returns 50 ...
1
vote
2answers
102 views
Patched Application causes Acces Violation c0000005
I've been working with this application to remove it's trial limitations.
But every byte I change, it throws an acces violation.
Piece of the code:
Original:
003354C6 - 0F85 D3000000 - jne ...
1
vote
0answers
206 views
x64dbg “Use Graph command or menu action to draw control flow graph here…”
When I press "G" in the CPU view of the debugger I often get the following screen:
In what cases can this error message happen? Obviously I can't yet give an exact way to reproduce it, I'm curios ...
1
vote
1answer
87 views
Dump array of char* ASCII text to file? (ollydbg or x32dbg)
This question is similar to: List arrays (de-reference pointers) in Ollydbg
I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...
0
votes
2answers
241 views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
2
votes
1answer
240 views
change compare function in assembly and .exe stopped working x64dbg
I'm trying to bypass (crack) a very old software that require license in order to unlock all the features
i was digging in the lines with a little bit of knowledge in assembly
and i found the line ...
2
votes
1answer
321 views
bypass license of very old software, Access violation (C0000005) x32dbg
I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license
so, with a little bit of knowledge in ...
0
votes
1answer
142 views
Nop the string in online games
So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn
My question is how is that possible? I just edit ...
0
votes
1answer
511 views
x64dbg: break when a register contains a value
Is there a way to break code execution when a register contains a particular value with x64dbg? I'm not talking about setting a conditional breakpoint at a specific location, but about watching the ...
0
votes
1answer
105 views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
0
votes
1answer
1k views
How to use memory address information from IDAFree to set a breakpoint in x32dbg?
I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
0
votes
2answers
371 views
What's ScyllaHide's PDBReaderx64.exe Doing?
I just downloaded the binary of ScyllaHide for x64dbg. According to the instructions, I need to generate an NtApiCollection.ini file by running PDBReaderx64.exe or PDBReaderx86.exe. But I've got a ...
