Questions tagged [x64dbg]

An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.

Filter by
Sorted by
Tagged with
0
votes
1answer
74 views

How to log CPU instructions executed by program with x64dbg?

How to log CPU instructions executed by program with x64dbg? I saw x64dbg - see the current position? question, but I can't find the way to log instructions. Thanks!
1
vote
3answers
917 views

FThunks when trying to get IAT

Pretty new to RE so sorry if this is a dumb question. I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
0
votes
0answers
25 views

x64dbg Lock Memory Address w/ a Value

In cheat-engine, there is a way to 'lock a memory address', where if anything tried to change it -- it will change it back to the value you locked it with. Does anyone know of a way, or plugin that ...
0
votes
1answer
35 views

Calling/debugging calls to DLL via ollydbg or x64dbg

I have used dependency walker on a DLL of an old game from 2001. I have found a function which I want to be able to analyze. I see the name of the function and the entry point (at the end). How do I ...
4
votes
2answers
418 views

Reverse engineering file format - ImageLink

I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files: book.bbi ...
0
votes
0answers
35 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
1
vote
2answers
451 views

When trying to change command line, received an error: “Could not set command line!”

I download CurrPort program and run it on xdbg64. I pressed File -> Changed Command line and changed the command line to: "C:\Users\myusername\Downloads\cport\cports.exe" "/close * * 127.0.0....
0
votes
1answer
27 views

How to calculate value inside stack segment (SS)

I have an assembly row which the following information: EBP = 006FFB50 SS = 002B When I looked on this row: mov eax,dword ptr ss:[ebp+8] I assumed that EBP + 8 = 006FFB50 + 8 = 006FFB58. But ...
0
votes
1answer
29 views

How to view the functions of a loaded library in x64dbg

I am working on a packed file with UPX. In one of the lines it calls to the value of the address 0xF5222C which is: 0x778057c0. The debugger auto-completes it to kernel32.LoadLibraryA. Where can I ...
0
votes
1answer
138 views

Nop the string in online games

So i found a string "RespawnTime" in online games and i just edit the string to nop and it worked perfectly, my player is no more waiting to respawn My question is how is that possible? I just edit ...
0
votes
1answer
846 views

Go back to the function call address

My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg? Or for example if we want to trace ...
0
votes
0answers
34 views

What's the reason for a program to crash every time a breakpoint is set in x64dbg?

I know this question may be an ambiguous one and so may not be straightforward, so I apologize for that. Nevertheless, I believe that anti-debugging is responsible for the constant crashing of the ...
3
votes
1answer
1k views

x64dbg - see the current position?

i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment?
0
votes
1answer
118 views

How can I navigate to the Disassembly address location?

I'm using x32dbg and I've set a hardware memory breakpoint. It triggers successfully for a specified module and the debugger pauses and a message on the bottom says: Hardware breakpoint (byte, read/...
0
votes
0answers
49 views

Relative/absolute addressing; RVA, ASLR, the relocation table and patching instructions

I've been trying to learn reverse-engineering for fun, cracking my own dummy games and whatnot and I just learned ASLR is a thing. I'm now trying to re-conceptualize everything I've read so far ...
0
votes
0answers
48 views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
0
votes
1answer
91 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
1
vote
1answer
105 views

x64dbg throwing exception

I have been working on finding an overflow in wordpad and i was able to run an exception with an undefined behavior (my point of view). I am using x64dbg (I am not a pro x64dbg) and it shows ...
1
vote
1answer
39 views

How can I easily convert little endian pointers in hex dumps?

I am tracking down a data structure whose address is inside the second operand: mov rcx, qword ptr ss:[rbp+E0] When I look at the value of [rbp+E0] I see the following dump: 21 C4 FC 5E 00 00 00 00 ...
2
votes
1answer
428 views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
1
vote
1answer
97 views

Find Retdec Address Range in x64dbg

How do I find this function from RetDec in x64dbg? // Address range: 0x1017dba0 - 0x1017dbda int32_t function_1017dba0(int32_t * a1) { int32_t fileHandle = (int32_t)CreateFileA("\\\\.\\...
1
vote
1answer
364 views

Storing a string with with x64dbg

I want to patch a Windows binary (actually an ocx) with x64dbg. More specifically, I want to store a string of 60 bytes and store its address in EAX at a certain point. Do I just have to add it to a ...
1
vote
1answer
799 views

Debugger always paused in ntdll.Kifastsystemcallret

I am using x32dbg to debug a program. I want to find the line which corresponds to a pop up message in my program to put a Break point. But everytime that I set "Pause" after the pop up window's ...
0
votes
0answers
25 views

Set a breakpoint for a win command without an address

How to make these columns empty or make a new breakpoint where they are empty? I just need a stop at these win commands (in the summary column), not at a specific address. I don't know what exactly ...
0
votes
1answer
28 views

How to whitelist an address for breakpoint?

If I have breakpoint on some win function, how to whitelist some address on which I don't want stopping? Seems that it is needed to use conditions. How? I use x64dbg, but if you only know a way in ...
1
vote
1answer
74 views

x64dbg, breakpoint on write in memory with specific value

In x64dbg, we can set hardware breakpoint on write in memory dump but can we add more codition? Ex. Set breakpoin on write of value of 2F.
2
votes
0answers
40 views

x64dbg break when hex string is loaded

I'm trying to break execution when a string is loaded in memory. I can´t find the string by using the search for -> string references So I press Alt + M and press Ctrl + B to search my string ...
0
votes
0answers
29 views

Debug x64dbgpy scripts in vscode?

i've tried to debug a x64dbgpy script using ptvsd and vscode. don't ask me how, but i was able to break into the script using a "remote python attach" session, setting breakpoints and stepping into ...
2
votes
2answers
227 views

Dealing with obfuscated PUSH PUSH RET instructions

I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
1
vote
1answer
61 views

How's this code able to make use of the stack?

I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and ...
-2
votes
1answer
254 views

Debug and crack .NET executable PE

First of all, i'm trying to learn reverse engineering for testing my codes and that's all and i'm not stupid enough to do illegal things with my knowledge so please don't give me legal advises. I'm ...
1
vote
0answers
94 views

Recommended plugins for x64dbg

I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks. The more you can ...
0
votes
1answer
83 views

Patching memory

I've successfully reversed and patched an application on windows, but patching the executable on disk triggers a CRC check and prevents it from loading. I've used x64dbg and have the addresses I need (...
0
votes
0answers
41 views

x64dbg call function from current thread

While debugging an executable with x64dbg, I want to make a function call (while the executable is stopped on a breakpoint), what I want to do is the same as the following gdb line: p (void*)freopen("...
0
votes
0answers
49 views

How to display the addresses rather than the labels in x64dbg?

By default, it shows addresses as labels when it can. (call <JMP.&printf>). However, I need it show the actual address itself in the disassembly view. I have looked all around in the GUI, ...
1
vote
0answers
33 views

How to ret with jxx in x64dbg's sciprt

main: call foo call bar ret foo: // code cmp $number, 0 je ret // code ret bar: // code cmp $number, 0 je ret // code ret I would like to ...
0
votes
0answers
50 views

Tracing back the user code section that triggered a message

I have a Windows GUI x86 executable and I have identified, in the .rsrc section, where the error string I want to trace is. Let's assume it is in id=83Ah. I have set a bpx user32:LoadStringA and then ...
0
votes
0answers
37 views

Finding out what creates FIFA RTWC 98's main window

I am currently familiarizing myself with x64dbg as a tool for reverse engineering. As an exercise, I challenged myself to try and patch FIFA RTWC 98's executable to force it to run on a windowed mode. ...
0
votes
0answers
62 views

Reversing WSASend finding functions that called it

I'm trying to make my first DLL calling game functions What I need is tracing functions that call WSASend, so it will be easy for me to get all functions address to call them from my DLL. What I ...
2
votes
1answer
91 views

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

#include <Windows.h> int handle_exception (EXCEPTION_POINTERS *exception_pointers) { exception_pointers->ContextRecord->Rip += 4; return EXCEPTION_CONTINUE_EXECUTION; } int main (...
2
votes
2answers
97 views

Function Prologue, add esp directive

I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code: push ebp ;...
-1
votes
2answers
334 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...
9
votes
4answers
13k views

OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?

OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
0
votes
1answer
73 views

xor eax,3 why does the input change the way it does?

I am new to reverse engineering and I am trying to figure out exactly what xor is doing in this little program. I know if I put any number other than 0 I get a xor eax,3 so if I put in 1 I get 2 if I ...
1
vote
1answer
280 views

Trace back function call

I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or ...
0
votes
0answers
88 views

About x64dbg find command + Help to unpack a program

The find command in x64dbg(x86), (found here: https://help.x64dbg.com/en/latest/commands/searching/find.html) doesn't return anything. For example: findall 0x00524180, "E8 ????????" returns 50 ...
3
votes
1answer
414 views

Is it possible to view and modify process memory without attaching the debugger in x64dbg?

This functionality is available in Cheat Engine where the debugger won't be attached until you set a breakpoint or explicitly ask for the debugger to be attached. I've looked everywhere and couldn't ...
1
vote
2answers
87 views

Patched Application causes Acces Violation c0000005

I've been working with this application to remove it's trial limitations. But every byte I change, it throws an acces violation. Piece of the code: Original: 003354C6 - 0F85 D3000000 - jne ...
1
vote
0answers
152 views

x64dbg “Use Graph command or menu action to draw control flow graph here…”

When I press "G" in the CPU view of the debugger I often get the following screen: In what cases can this error message happen? Obviously I can't yet give an exact way to reproduce it, I'm curios ...
1
vote
1answer
78 views

Dump array of char* ASCII text to file? (ollydbg or x32dbg)

This question is similar to: List arrays (de-reference pointers) in Ollydbg I have an array of pointers that point to character arrays. I followed the above link and can view the ASCII values from ...