All Questions
26 questions
0
votes
0
answers
24
views
Dumping all import symbols from x64dbg
I want to export the symbol addresses from all loaded modules in x64dbg. I know I can do this DLL-by-DLL from the Symbols tab (click on one module > right click in table > Copy > Export Table)...
0
votes
0
answers
43
views
How can I find the part of cmd.exe that processes windows batch commands before they're executed?
I'm able to find the ReadConsoleInputW commands for pause and reading input for commands but I'm unable to find the actual processing of the commands. I'm using x64dbg but I'm fairly new to Reverse ...
4
votes
2
answers
295
views
Malware analysis - Debugger hangs at HttpSendRequestA
I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC.
I was able to replicate this behaviour with a small ...
- 308
3
votes
1
answer
261
views
How to call Windows console in ASM and printf some values there?
Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
- 131
3
votes
1
answer
5k
views
How to load a PDB file into x64dbg?
I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
- 187
2
votes
1
answer
483
views
Instructions to compare two strings
I made a list of which instructions compare two strings in disassembly so that when I get to intermodular calls in x64dbg, I can simply type this instructions to see if there is a comparison have been ...
3
votes
1
answer
4k
views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
0
votes
0
answers
202
views
String as constant , even not visible in disassembler
I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
- 143
2
votes
1
answer
287
views
I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()
#include <Windows.h>
int handle_exception (EXCEPTION_POINTERS *exception_pointers) {
exception_pointers->ContextRecord->Rip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
int main (...
- 131
6
votes
3
answers
2k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 111
0
votes
2
answers
943
views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
- 1
2
votes
2
answers
692
views
Find a instruction in a binary file (PE) based on a virtual address of a string reference
English is not my first language, so I'm sorry if my text isn't so clear.
I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
- 23
2
votes
1
answer
434
views
How to hide a process from all the methods of getting the list of processes?
So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not
so these are the ways i know :
...
- 518
1
vote
1
answer
199
views
What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)
So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
- 518
1
vote
1
answer
296
views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
- 11
2
votes
1
answer
2k
views
Finding out what calls win32u.dll functions
There's a button which, when clicked, writes some data to the clipboard.
I'm trying to call the function this button executes using DLL Injection.
I managed to find the function in win32u.dll which ...
- 153
1
vote
1
answer
327
views
'local call from' in x64dbg
In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
- 163
0
votes
1
answer
5k
views
x64dbg - Conditional breakpoint based on function argument
How can I set a conditional breakpoint based on the argument of a function?
I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
- 203
0
votes
1
answer
212
views
The callstack does not show the message handler
After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler?
Say I am reversing an ...
- 111
0
votes
1
answer
103
views
x64dbg "System" meaning
I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ...
- 111
2
votes
1
answer
461
views
dongle check happen before a debugger start debugging
i'm trying to fake the test ( dongle exist )
but one problem that i encounter is that the application detect it before i start debugging it .
this is what happen with more details : open( not ...
- 21
1
vote
2
answers
644
views
How to reach functions triggered by non-standard buttons?
I've already read related posts such as:
link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg
link2: How can I set a breakpoint for a button ...
- 99
3
votes
1
answer
497
views
Unable to use CreateRemoteThread in target process
I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does ...
- 33
1
vote
0
answers
472
views
Failed to set breakpoint (Anti-debug protection)
Sorry for my bad English in advance.
There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
- 131
1
vote
1
answer
823
views
identifying function prototype from dll
I have an exe file and a dll file. This exe file uses the dll to decode input file. This exe file is gui based and does not support command line execution.
So my requirement is to create a program ...
- 13
5
votes
2
answers
10k
views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
- 203