Questions tagged [x64dbg]

An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.

Filter by
Sorted by
Tagged with
0 votes
0 answers
19 views

x64dbg string references can not find

i am trying to register a software with x64dbg, but my experience is not enaugh for do this. Anyone can help me ? i am ready to pay price. Problem is can not find string references in x64dbg.i already ...
KADİR SÖNMEZ's user avatar
0 votes
0 answers
34 views

How can I set up a conditional breakpoint for the CreateFileW function for when a specific file/path is read in x64dbg?

I'm currently debugging a program using x64dbg, and I'm struggling to set up a conditional breakpoint on the CreateFileW function: HANDLE CreateFileW( [in] LPCWSTR lpFileName,...
MendelG's user avatar
  • 53
0 votes
1 answer
74 views

X64DBG Conditional Breakpoint on Specific Opcode?

Is there any way to break on specific opcode in X64DBG? For example i want to break on start of a function which is 55 | push ebp 8BEC | mov ebp,esp can i set a breakpoint like opcode == 0x00EC8B55? ...
Behrooz Sohrabloo's user avatar
0 votes
0 answers
42 views

Why a breakpoint works in x64dbg but not in IDA?

I've spent all morning trying to find a solution to debug with IDA the same function I'm debugging in x64dbg. In x64dbg, I just go to Symbols -> ws2_32.dll -> WSARecvFrom -> F2 (set ...
kuhi's user avatar
  • 161
0 votes
2 answers
118 views

How can I debug if the program closes directly?

I'm trying to debug a game and it's closing under few circumstances: When debugging (solved by hooking IsDebuggerPresent to return false when called by the game) When setting a memory/hardware ...
kuhi's user avatar
  • 161
0 votes
0 answers
77 views

Question about anti-debug methods and anti-anti-debug methods

I've come across several binaries that have simple anti-debug methods in place, like checking IsDebuggerPresent(), NtQueryInformationProcess(), etc. But I recently came across a binary that looked ...
Joshua Terrill's user avatar
0 votes
0 answers
40 views

How can I find the part of cmd.exe that processes windows batch commands before they're executed?

I'm able to find the ReadConsoleInputW commands for pause and reading input for commands but I'm unable to find the actual processing of the commands. I'm using x64dbg but I'm fairly new to Reverse ...
user19244091's user avatar
0 votes
0 answers
35 views

how to set a BP on button in SunAwtCanvas in x96dbg

I'm trying to debug a program in x96dbg that I think this is written in Matlab. There is no string related to buttons or something interesting. Then I go to Handles tab to find buttons and set break ...
owl's user avatar
  • 1
0 votes
0 answers
99 views

Scylla error on FThunk import (manually unpacking UPX)

I'm trying to practice on manual unpacking starting from UPX. I'm using putty.exe x64 This is what I'm doing: upx -o putty_packed.exe putty.exe Disable Dynamic base (ASLR) using CFF Explorer on ...
Ryuk's user avatar
  • 11
1 vote
2 answers
209 views

reversing pyinstaller compiled exe

i created some compiled binaries using different languages and tried to understand them using x64dbg, the compiled binaries produced by the c language/gcc compiler were pretty easy to understand, then ...
Praveen's user avatar
  • 11
0 votes
0 answers
65 views

Logging function call in x64dbg without asm

I want to log every call of the function to see the what parameters are passed and function result. Currently I'm loading a DLL module, hook function I need and then see function output in my log file....
Froglred43's user avatar
0 votes
0 answers
194 views

Need Help Cracking a Program

So I've got this .exe that I want to crack. It's an old management system for people in truck loading business. I kind of understand what's happening with window API calls but I'm unable to access the ...
The one word assaulter's user avatar
0 votes
0 answers
39 views

Exe self-modifies strings searched in debugger

I'm studying a Windows binary file and while searching for some string I noticed the EXE modifies the searched string, e.g., if I search "This is a string", it's modified to "his is a ...
lopan's user avatar
  • 1
0 votes
0 answers
145 views

Retrieve hardcoded string in WinDev compiled app

I wrote an application with WinDev allowing you to open encrypted PDFs without the user having to enter or know the password. This of course only works with PDFs that I have encrypted myself, always ...
deltonio2's user avatar
0 votes
0 answers
46 views

X64dbg question

I got a program that I try to patch. Normally you get a message box or something to get at the right point in program. But this program behaves else. It opens, then you can type in your license number ...
silvio's user avatar
  • 1
1 vote
0 answers
31 views

Is it possible to create a CStringT struct in x32dbg/x64dbg to make them more readable?

I'm working on analyzing a program which makes extensive use of CStringT but I am unclear as to how these are represented in memory, as it does not seem to be consistent. For example using a x32dbg, ...
throwawayn000b9999's user avatar
0 votes
1 answer
112 views

Create exe that jumps directly into main()-function from C

I am using x64dbg to explore image files on Windows. After the computer finishes prowling ntdll.dll it jumps to OptionalHeader.AddressOfEntryPoint. But this is not my main()-function. What is this ...
AirToTec's user avatar
1 vote
0 answers
90 views

Can't find the error message in x32dbg

Am trying to reverse an activation program using the error message in reference string but searching for the string is not successful "all modules - string reference" tried to pause after ...
Abd El-Rahman Sayed's user avatar
1 vote
2 answers
435 views

How can I jump to the start/end of a function in x64dbg?

I'm currently debugging a program using x64dbg, and I'm wondering how to quickly jump to the start or end (prologue/epilogue) of a function while I'm in the middle of it. I couldn't find this ...
MendelG's user avatar
  • 53
1 vote
0 answers
100 views

Notepad can find my string, but x64dbg can't

I open v2game.exe with notepad, and I can see string "teleport" occurs a bunch of times. Now I open v2game.exe with x64dbg (not running the exe). x64dbg can't find the needed string. Why? ...
Gqqnbig's user avatar
  • 133
1 vote
0 answers
113 views

Techniques for analysing an exe file

I am learning to use x64dbg application and I am exploring different methods for studying an application. So far I know of only a few techniques as listed below: String References Search Call Stack ...
Madhur's user avatar
  • 31
2 votes
0 answers
149 views

Help with reversing an application with x64dbg

I am a newbie to reverse engineering. I am trying to reverse engineer an app that uses some form of internet explorer frame kind of thing because I could see use of mshtml.dll and jscript9.dll and ...
Madhur's user avatar
  • 31
3 votes
1 answer
294 views

Load PDB for MemoryModule-loaded DLL in x64dbg

I need to debug a DLL, which I have a PDB file for. The debug target is a program, that loads the DLL using MemoryModule library from Github. The loaded module isn't listed as a module in x64dbg, ...
Ri0ee's user avatar
  • 43
3 votes
0 answers
270 views

How to see parameters in stack in x64dbg like in OllyDbg for known API calls?

Based on Detailed API call descriptions not available in x64dbg When I debug a known API call like for example WSARecv, in OllyDbg I can nicely see the parameters in the stack: I've installed both ...
kuhi's user avatar
  • 161
4 votes
2 answers
277 views

Malware analysis - Debugger hangs at HttpSendRequestA

I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC. I was able to replicate this behaviour with a small ...
Luca D'Amico's user avatar
2 votes
1 answer
133 views

Understanding the logic behind decompiled code

Hi I was learning reverse engineering by doing some crackme(s) found online using IDA and x64dbg. I'm quite confused on the below decompiled code. bool Logic() { char CODE[] = "RAND_STRING&...
Nimrod's user avatar
  • 151
4 votes
1 answer
795 views

Change string value when string is in a RAM address x64 c++ program

I'm new to reverse engineering. I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS (It's a c++ program, and is VERY simple; it just prints a string, and two ...
clouded.'s user avatar
2 votes
1 answer
372 views

xdbg64 Unable to find string.. Need help cracking a program

Ive been trying to crack my friends program for quite some time. He gave me permission and we are trying to see if his mod menu is ready to hit the market. Ive watched a couple youtube videos and I am ...
Alen 's user avatar
  • 21
3 votes
0 answers
382 views

x32dbg error C0000005, EXCEPTION_ACCESS_VIOLATION

Having some trouble with cracking a program, as the software does not prompt me to enter a serial key for activation. Instead, a serial key 924D-E42E-427D is already displayed within the program. So ...
tolier's user avatar
  • 31
2 votes
0 answers
88 views

Problem while debug with x64dbg

I am debugging with x32dbg a program (x) which at some point opens another program (y). Is it possible to continue debugging also on program (y) when opened by the first one (x)? Unfortunately, ...
Didimo8's user avatar
  • 21
4 votes
0 answers
544 views

Comparison of Windows Debuggers

I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
jinscoe123's user avatar
3 votes
0 answers
197 views

Exporting patches as loader in x64dbg?

Is there a way to export modifications made in x64dbg as a separate executable file, which can be used to patch a desired executable file without detection? The resulting file should function as a ...
Halil Nevzat Demirel's user avatar
-1 votes
1 answer
168 views

Anti-patching checksum [closed]

I'm busy with debugging a program in x64dbg and it has some kind of anti-patching mechanism so can someone please advise me on how I would go about finding the functions which are calculating the ...
jjprince's user avatar
1 vote
0 answers
230 views

How can I set a breakpoint in x64dbg to be triggered when a certain message is logged?

I am debugging a certain program and I need to stop execution when a certain debug message is logged using OutputDebugStringA(). How can I set a breakpoint for this?
Ytagger's user avatar
  • 13
3 votes
1 answer
553 views

exe file not opening after patching

I hope everyone is well. I'm new here and I'm hope someone can help me with the problem I'm facing. I've been trying to reverse engineer a program but everytime I change an instruction, not matter how ...
jjprince's user avatar
3 votes
1 answer
240 views

How to call Windows console in ASM and printf some values there?

Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
EvilCracker's user avatar
3 votes
2 answers
853 views

x64dbg: Conditional breakpoint: how to log only if register value has changed?

What i'm trying to achieve is to use a conditional breakpoint, that never actually breaks but logs in x64dbg's console the value of r9 only when it changes, to prevent console cluttering. But i do not ...
EncoderX's user avatar
2 votes
0 answers
132 views

How to search for a graphical string?

I am trying to search for a string but in my case, that string is not like a normal string but it's a graphical string. As you have seen, that is not a normal string that can search for but it's a ...
Lion King's user avatar
  • 269
2 votes
1 answer
495 views

Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?

Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version. Problem is i have to do it again cause there ...
EncoderX's user avatar
2 votes
0 answers
317 views

Find caller function by DLL loading in x64dbg

First of all I'm noob at debugging task and I'm try to self-study to learn how to debug exe using x64dbg. I have EXE file packed by themida. i bypassed themida packing using themida plugin in x64dbg....
Anuruddha wijesiri's user avatar
3 votes
0 answers
468 views

Anti Dumping Techniques (C++)

how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle? I tried this already but it didnt work. Scylla could still dump it fine.
Heinz Josef's user avatar
2 votes
0 answers
156 views

Find an address of injected code via GetModuleHandleA

I am reversing really old game (20 years old). l2.exe loads Dsetup.dll Network.dll. (not sure about order) inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
Vetal.lebed's user avatar
3 votes
0 answers
311 views

How would I crack a software that has Xor encryption

So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
user42257's user avatar
2 votes
0 answers
424 views

What is the correct way to load pdb symbols to show the functions by their name instead of their addresses in x64dbg?

I am trying to reverse a portion of a game, that game loads a DLL file called "ddraw.dll". Most of the DLL file functions don't appear by their names but appear by their addresses for ...
Lion King's user avatar
  • 269
3 votes
1 answer
712 views

Locating function parameters in x32dbg

I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows: 0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] | 0627BF4B | 8B85 CCF5FFFF ...
throwawayn000b9999's user avatar
1 vote
0 answers
139 views

Copy all ASCII in x64db

How i can copy all ASCII or Hex values starting from specific point without scrolling up or keep moving the mouse? For example from below point till first offset. Thanks
Ahmed Mohammed's user avatar
2 votes
1 answer
512 views

Trying to learn more about unpacking

I am working on getting better with concepts of unpacking manually to get more clarity on understanding packing routines and decryption logic, so I am trying a few tutorials on PESpin! Previously I ...
ElementalX's user avatar
4 votes
2 answers
598 views

How to reverse a game and inject a dll in client program?

I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
Lftbrito's user avatar
2 votes
0 answers
68 views

analyze track program protected

What are the modern methods of dealing with obfuscation and code virtualization? all these protectors create unrealistic code traces?
bArt's user avatar
  • 21
1 vote
1 answer
2k views

How to locate a string in memory with x64dbg

I opened a 32-bit program with x32dbg, I wrote something on a text box like this : How can I find the piece of code that manipulates the string "Goku" ? I searched all string references but ...
Aminos's user avatar
  • 111

1
2 3 4 5