Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
224 questions
1
vote
0
answers
2k
views
In X64dbg, how can I script a string write to memory?
I find that I can write to memory as
[addr] = value
As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html
And while I could work around my problem as dividing ...
- 11
1
vote
1
answer
296
views
Getting started with RE, with eventually goal being able to make a keygen [closed]
I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
- 11
1
vote
0
answers
469
views
UTF8, UTF16 encoding string search
I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them..
P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
0
answers
554
views
Process terminating when breakpoint reached
I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
- 11
1
vote
0
answers
74
views
Hearts Game Passing Cards
I'm trying to make this Hearts game so that i can select more than 3 cards.
This is the func that will compare how many cards i've chosen with 3
it'll jump to this address if > 3
so i replace the ...
- 9
1
vote
0
answers
189
views
x64dbg flow-indent style trace logs
I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
- 180
1
vote
0
answers
472
views
Failed to set breakpoint (Anti-debug protection)
Sorry for my bad English in advance.
There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
- 131
1
vote
1
answer
2k
views
Is it possible to set breakpoints relatively to the memory block in x64dbg or a similar debugger?
Some of my breakpoints perfectly survive multiple restarts.
But many interesting parts of the code I am debugging have different locations in memory after a restart. It seems the reason is, that the ...
- 150
1
vote
0
answers
1k
views
Find memory mapped file with x64dbg
I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says:
Type: Section
Description: A memory mapped file or ...
- 111
0
votes
1
answer
241
views
xor eax,3 why does the input change the way it does?
I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
- 111
0
votes
1
answer
1k
views
What does ds mean?
When debugging with x64dbg I sometimes see mov ss:[address] 0xAA, I know that this means: move 0xAA into memory at specified address.
But what does
mov ds:[address] 0xAA
mean?
- 113
0
votes
1
answer
9k
views
How to use memory address information from IDAFree to set a breakpoint in x32dbg?
I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
- 233
0
votes
1
answer
144
views
What does this function actually do?
I'm taking part in this reverse engineering lab at college and we have this final big homework project. I have a part of the binary that changes it's own asm code by iterating through it's own bytes ...
- 133
0
votes
1
answer
212
views
The callstack does not show the message handler
After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler?
Say I am reversing an ...
- 111
0
votes
1
answer
7k
views
Can't find strings on x64 dbg
I can't find strings from message boxes.
Questions:
How do i find the strings?
What are these strange symbols?
Is it possible to transform them into readable ones? how?
Detailed information:
I ...
0
votes
2
answers
2k
views
Finding function in IDA from x64dbg
I've found a function I want to call in x64dbg, and wanted to see it's prototype and how it looks like in IDA. However, I was expecting to see a function in IDA but land in the middle of one.
The ...
- 3
0
votes
2
answers
794
views
Print opcodes in trace - x64dbg
How can I print the opcodes in a trace log?
I can use {x:bswap([cip])} but this will print a fix amount of bytes (which most of the time will end up as either more or less number of bytes), ...
- 319
0
votes
1
answer
5k
views
Run program until completion without debugging step by step [closed]
I am debugging a program but I no longer want to run step by step. Is there no "resume program" function that I can use to let the program I'm attached to, to run to completion of all its tasks ...
- 103
0
votes
2
answers
162
views
How can I debug if the program closes directly?
I'm trying to debug a game and it's closing under few circumstances:
When debugging (solved by hooking IsDebuggerPresent to return false when called by the game)
When setting a memory/hardware ...
- 161
0
votes
1
answer
114
views
Create exe that jumps directly into main()-function from C
I am using x64dbg to explore image files on Windows. After the computer finishes prowling ntdll.dll it jumps to OptionalHeader.AddressOfEntryPoint.
But this is not my main()-function.
What is this ...
- 3
0
votes
1
answer
184
views
How to find the first function that sets the value currently stored in a given register?
I'm interested in a general approach to the following problem:
The function F_Init allocates a byte buffer called Buffer with a size called BufSize. The Buffer is allocated with each frame/iteration ...
- 3
0
votes
1
answer
213
views
x64dbg doesn't show Chinese strings in String references?
I'm wondering if x64dbg can show Chinese letters in String references? Because I try to reverse 3 Chinese programs from complete different coders and I never found any Chinese strings. But in the ...
- 1
0
votes
1
answer
780
views
How do I find a function and find out what it does using reverse engineering?
I am attempting to find a function in a specific game. Is there any way that, using the assembly code I get from decompiling the game in either IDA or x64dbg, I can locate a function I am specifically ...
- 39
0
votes
1
answer
493
views
decoding thread context structure in x64dbg
Is there any way to decode the thread context structure returned by "GetThreadContext" and used by "SetThreadContext" in x64dbg?
0
votes
1
answer
708
views
How can I detect if my application is running in x64debug?
I am writing my own applications to practice reversing. I want to be able to detect debuggers and change the execution in response.
When building the application, I am easily able to detect it is ...
- 3
0
votes
2
answers
1k
views
Breaking on string access from StringTable (resource)
If I have a resource like this:
STRINGTABLE
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
{
100, "OK"
101, "Warning"
102, "Error"
103, "Name"
104, &...
- 319
0
votes
1
answer
6k
views
In x64dbg, how to set software breakpoint on specific memory address?
This is something I know how to do in Olly Debugger, and can't figure out how to do in x64dbg.
In Olly Debugger, it's possible to set a hardware or software breakpoint, either on access or on write, ...
- 137
0
votes
1
answer
374
views
Calling MessageBoxW x64 confused about pointer
OK, I am very new to x64dbg. I used to use OllyDbg a lot and I'm having some problems with this.
I just made a customized version of MS-PAINT for practice by changing a few things like the default ...
- 101
0
votes
1
answer
611
views
Debug with IDA Pro right click option
So I was wondering if is there a way for IDA to appears in the righ click options of an executable.
As you can see, Debug with x64dbg was built by itself, IDA 32 didn't do, so I just changed it in ...
- 153
0
votes
1
answer
2k
views
How to view the functions of a loaded library in x64dbg
I am working on a packed file with UPX.
In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0.
The debugger auto-completes it to kernel32.LoadLibraryA.
Where can I ...
- 583
0
votes
1
answer
56
views
How to whitelist an address for breakpoint?
If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping?
Seems that it is needed to use conditions. How?
I use x64dbg, but if you only know a way in ...
- 173
0
votes
1
answer
1k
views
Patching memory
I've successfully reversed and patched an application on windows, but patching the executable on disk triggers a CRC check and prevents it from loading. I've used x64dbg and have the addresses I need (...
0
votes
2
answers
943
views
How to compare two different executions of the same file?
When i start the program by just double clicking the .exe, it has a certain behavior. This behavior differs when i start the program from running the launcher provided. I’d like to figure out how to ...
- 1
0
votes
1
answer
262
views
Nop the string in online games
So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn
My question is how is that possible? I just edit ...
- 9
0
votes
1
answer
230
views
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
When a breakpoint callback is triggered trying to automate the debugger inside the callback causes the application to become unresponsive. x64dbg continues functioning but the application itself doesn'...
- 203
0
votes
2
answers
749
views
What's ScyllaHide's PDBReaderx64.exe Doing?
I just downloaded the binary of ScyllaHide for x64dbg. According to the instructions, I need to generate an NtApiCollection.ini file by running PDBReaderx64.exe or PDBReaderx86.exe. But I've got a ...
- 103
0
votes
1
answer
1k
views
x64dbg - Locating where data is initially written
I am hoping someone can help me with a question or two.
Essentially I used to be a computer programmer who always wanted to get into a bit of game hacking, having not done any serious programming for ...
- 103
0
votes
1
answer
103
views
x64dbg "System" meaning
I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ...
- 111
0
votes
2
answers
2k
views
.exe file to .class, decompiled to .java, how to put back to .class?
I'm trying to reverse engineer a very complex .exe to alter its behavior.
Ran JWScan that tells me it's been wrapped with Jar2Exe (which I also saw during debugging).
Looking at the complex exe with ...
- 151
0
votes
1
answer
4k
views
x64Dbg view jumps to selected command
I've poked around the settings for x64dbg and never managed to find this. I was just wondering if there was an option for x64dbg similar to ollydbg's "show jumps to selected command":
Thanks all
- 111
0
votes
1
answer
2k
views
Is there a way to see all "values" in memory?
In a program I'm working on, a variable is set using a memory address:
mov r9, [0x0000000000472C10]
Is this the equivalent? (forgive the python code):
value = 55 <---- value at memory address ...
- 103
0
votes
1
answer
2k
views
Calling DLL exports in x64dbg
I am attempting to debug a x64bit dll with x64dbg. Is there an export caller similar to Ollydbg? I checked the documents and haven't seen anything.
- 191
0
votes
0
answers
20
views
Attach with X32Dbg behaves strange
I am trying to attach to a debug protected 32bit Windows program with X32Dbg and in general the attach process works and the program still run smoothly.
However I CANNOT pause the program and check ...
- 41
0
votes
0
answers
30
views
+50
How can I compare different execution traces of the same exe, but ran with different parameters?
Context
I'm working on analyzing how a software's behavior changes when run with different parameters.
My goal is to compare the execution traces (e.g., function calls, memory accesses, or instruction ...
- 35
0
votes
0
answers
23
views
Log addresses of every called function in Ollydbg/x64dbg in multi-threaded program
I have 2 programs: one 32bit and the second one 64bit. I use Ollydbg/x64dbg to debug them, respectively. These programs are multi-threaded and I have a difficulty when debugging: when an important ...
0
votes
0
answers
24
views
Dumping all import symbols from x64dbg
I want to export the symbol addresses from all loaded modules in x64dbg. I know I can do this DLL-by-DLL from the Symbols tab (click on one module > right click in table > Copy > Export Table)...
0
votes
0
answers
47
views
How to get which Tedit is referenced when retrieving text
Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv
Now, the two parameters for the function are:
LEA param_2=>local_8,[EBP + -0x4]
MOV param_1,...
- 1
0
votes
0
answers
34
views
x64dbg string references can not find
i am trying to register a software with x64dbg, but my experience is not enaugh for do this. Anyone can help me ? i am ready to pay price. Problem is can not find string references in x64dbg.i already ...
0
votes
1
answer
88
views
X64DBG Conditional Breakpoint on Specific Opcode?
Is there any way to break on specific opcode in X64DBG?
For example i want to break on start of a function which is
55 | push ebp
8BEC | mov ebp,esp
can i set a breakpoint like opcode == 0x00EC8B55?
...
0
votes
0
answers
51
views
Why a breakpoint works in x64dbg but not in IDA?
I've spent all morning trying to find a solution to debug with IDA the same function I'm debugging in x64dbg.
In x64dbg, I just go to Symbols -> ws2_32.dll -> WSARecvFrom -> F2 (set ...
- 161