Questions tagged [x64dbg]

An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.

40 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
211 views

Define function in x64dbg

I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions? A simple example would be to have a definition for WinMain(hInstance, ...
3
votes
0answers
255 views

What tool is able to analyze/decompile asm execution trace?

I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops). I ...
2
votes
0answers
59 views

Strange exception thrown while debugging in Win10, but not Win7

I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
2
votes
0answers
143 views

x64dbg break when hex string is loaded

I'm trying to break execution when a string is loaded in memory. I can´t find the string by using the search for -> string references So I press Alt + M and press Ctrl + B to search my string ...
2
votes
0answers
5k views

How to step to specific function call?

I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
2
votes
0answers
266 views

How can I fix an unpacked binary which calls out-of-bounds memory?

I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
2
votes
1answer
98 views

Why module address is different in Cheat Engine than in x32dbg?

Why the module address is different in Cheat Engine than in x32dbg? I'm trying to read this: My c++ attempt: #include "pch.h" #include "Functions.h" #include "offsets.h"...
1
vote
0answers
125 views

Is there a clear Ollydbg successor?

I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
1
vote
0answers
55 views

Patches are not applying after saving in X64dbg

I'm new to this and I used X64 debugger for a short while The thing is , I was testing the security for some software (for educational purposes only!) and finally I found a way break into it , but ...
1
vote
0answers
250 views

Recommended plugins for x64dbg

I was wondering, as professional reverse engineers - what would be your "must-have" plug ins? Please give a brief description and say how it helps you and possible drawbacks. The more you can ...
1
vote
0answers
45 views

How to ret with jxx in x64dbg's sciprt

main: call foo call bar ret foo: // code cmp $number, 0 je ret // code ret bar: // code cmp $number, 0 je ret // code ret I would like to ...
1
vote
0answers
371 views

x64dbg "Use Graph command or menu action to draw control flow graph here..."

When I press "G" in the CPU view of the debugger I often get the following screen: In what cases can this error message happen? Obviously I can't yet give an exact way to reproduce it, I'm curios ...
1
vote
0answers
223 views

UTF8, UTF16 encoding string search

I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them.. P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
0answers
246 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
1
vote
0answers
72 views

Hearts Game Passing Cards

I'm trying to make this Hearts game so that i can select more than 3 cards. This is the func that will compare how many cards i've chosen with 3 it'll jump to this address if > 3 so i replace the ...
1
vote
0answers
142 views

x64dbg flow-indent style trace logs

I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
1
vote
0answers
300 views

Failed to set breakpoint (Anti-debug protection)

Sorry for my bad English in advance. There is a program that has some protection. The problem is I can not set hardware and software breakpoints in x64dbg (to be more precise - not everywhere), cuz ...
1
vote
0answers
891 views

Find memory mapped file with x64dbg

I have 64 bit process I want to debug with x64dbg. There is memory mapped file, I found with help of Process Explorer. Properties windows says: Type: Section Description: A memory mapped file or ...
0
votes
0answers
62 views

Heavens gate code

Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you. I use Intel Pin push cs push 0xa02829 jmp far ...
0
votes
1answer
76 views

How do I find a function and find out what it does using reverse engineering?

I am attempting to find a function in a specific game. Is there anyway that , using the assembly code I get from decompiling the game in either Ida or x64dbg , I can locate a function I am ...
0
votes
0answers
56 views

How to decrypt/decode the strings found in desktop application with x64dbg?

I'm a beginner and I have no experience at all in Reverse Engineering. I want to study it so find the "string" references, but all I get is some incomprehensible strings which are probably ...
0
votes
1answer
44 views

function vbavarindexload in msvbvm60.dll, what is doing ? and Parameters?

I need urgent help , I was debugging a software made by Visual basic 6 , and I found vbavarindexload function and I need to know what is doing ? Thanks in advance
0
votes
1answer
288 views

How to unpack Armadillo protected software using x64dbg?

I am planning to reverse-engineer a Windows executable that has been protected with Armadillo. When I put the executable through Detect It Easy, the results show that the executable was protected with ...
0
votes
0answers
29 views

How to extract an AutoIT script when tools fail to extract it?

Lets say you have a Autoit malware (windows executable, autoit v3), and you want to extract the script from it. But tools such as exe2aut fail to extract it. What would you do? is there any place in ...
0
votes
0answers
107 views

EXCEPTION_ACCESS_VIOLATION in x32dbg

What is EXCEPTION_ACCESS_VIOLATION and how can i handle it? I am a complete beginner and could not understand. Thanks in advance. Edit: as I learned EXCEPTION_ACCESS_VIOLATION occurs when either ...
0
votes
0answers
40 views

Pressing an application's button

I'm trying to press a button in a game (Final Fantasy XIV). I was hoping to make my life easier by automaticlaly log me in. Currently I want to press "Play" by reversing the Play button ...
0
votes
1answer
152 views

Proper workflow for x64dbg to Angr?

I am trying to use Angr to reverse engineer a plugin for an application. This plugin is loaded via DLL by the main application. To debug, I use x64dbg to attach to the main application exe. I then set ...
0
votes
1answer
502 views

Program prevents x64dbg from starting or kills it if it's already running. What to do?

I have the following problem with x64dbg. I am trying to debug a x64 PE program with x64dbg on Windows. It looks like the program has some sort of anti-debug protection. I have the following behavior: ...
0
votes
0answers
50 views

Conditional breakpoint on register containing string catch everything

I am trying to setup a conditional breakpoint to catch a specific string ("Sessions") that will be on ESI register but it catches everything: I also tried with dereferenced register [ESI] ==...
0
votes
0answers
105 views

x64dbg show some text in Chinese

While debugging some 32-bit file with x32dbg, some of the text appear in Chinese and I don't why. This happened after I moved to a new computer but both of them were Windows 10. In my old computer I ...
0
votes
0answers
89 views

String as constant , even not visible in disassembler

I was reading this article Where I saw that while reversing the WinRAR I saw that the x64dbg is not able to search for a string in all modules "evaluation copy". but why is that happening. ...
0
votes
0answers
81 views

What's the reason for a program to crash every time a breakpoint is set in x64dbg?

I know this question may be an ambiguous one and so may not be straightforward, so I apologize for that. Nevertheless, I believe that anti-debugging is responsible for the constant crashing of the ...
0
votes
0answers
294 views

x64dbg execute till next call OR return

I am using x64dbg and I want to know if there's any way to run the code till next Call statement? I know there is an "Execute till return" option, but I want to execute till next call ...
0
votes
0answers
39 views

Set a breakpoint for a win command without an address

How to make these columns empty or make a new breakpoint where they are empty? I just need a stop at these win commands (in the summary column), not at a specific address. I don't know what exactly ...
0
votes
0answers
60 views

Tracing back the user code section that triggered a message

I have a Windows GUI x86 executable and I have identified, in the .rsrc section, where the error string I want to trace is. Let's assume it is in id=83Ah. I have set a bpx user32:LoadStringA and then ...
0
votes
0answers
134 views

Reversing WSASend finding functions that called it

I'm trying to make my first DLL calling game functions What I need is tracing functions that call WSASend, so it will be easy for me to get all functions address to call them from my DLL. What I ...
0
votes
0answers
287 views

X32DBG ignores dependent DLL

I have EXE file which calls one specific DLL among other system DLLs. When I change a string value in this specific DLL I can see the changes when I execute the EXE file. For example I can change text ...
0
votes
0answers
1k views

In X64dbg, how can I script a string write to memory?

I find that I can write to memory as [addr] = value As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html And while I could work around my problem as dividing ...
-1
votes
1answer
53 views

Call function more times with other args

I want to call the same function more times but with other args, I can't add new instructions, so how can I call it?
-1
votes
3answers
564 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...