Questions tagged [x64dbg]

An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.

Filter by
Sorted by
Tagged with
9
votes
4answers
13k views

OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?

OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
6
votes
1answer
4k views

Trace back which function called the message box in x64dbg?

I have an error message pop up on the screen every few seconds on a program. I would like to trace it back as to which function is calling the message box and why. I found the referenced string but ...
5
votes
1answer
885 views

How does this EB F2 x86 instruction work?

In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
5
votes
2answers
12k views

How to view string references?

I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program. how to get the references from program itself? is it ...
5
votes
2answers
2k views

How to label local variables in x64dbg

As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned: I found no way to label locals in the debugger ...
5
votes
1answer
336 views

School project - Cracking a school emulator

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
4
votes
2answers
5k views

How to break when specific text is found

In this line of code: mov eax,dword ptr [eax+8]; eax+8 contains a long string of text, I want to find out where it originally came from. In either OllyDbg or x32dbg, how can I break when ...
4
votes
1answer
1k views

Search strings in multiple files/processes/modules (x64dbg)

when you click String references in x64dbg, it only lists strings from current module/file. Is that possible to search strings in multiple (selected) files/modules?
4
votes
1answer
4k views

How to copy binary file with x64dbg\x32dbg after it changed it self

I know how to do it with OllyDbg but with x64dbg\x32dbg I don't know how to do it. I have a packed binary file and at some point it unpacks itself and I found the point where it does it. I want to ...
4
votes
2answers
419 views

Reverse engineering file format - ImageLink

I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files: book.bbi ...
4
votes
1answer
2k views

IDA Pro Plugin to add x64dbg

Is there a plugin for IDA Pro to enable me to add x64dbg debugger support to IDA Pro 6.8 or 6.9?
3
votes
1answer
2k views

Displaying IDA names in x64dbg or OllyDbg

I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
3
votes
1answer
138 views

I am analyzing an exe with x64dbg but I dont see the address 00401000 [closed]

Will every .exe file start from 00401000 or am I wrong assuming such a thing. Edit: total beginner here. when the program is first loaded onto x64dbg it immediately goes into a DLL, so I could not ...
3
votes
1answer
1k views

x64dbg - see the current position?

i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment?
3
votes
1answer
3k views

Dealing with exceptions in x64dbg

I'm debugging a game and I often come across an exception (EXCEPTION_PRIV_INSTRUCTION) The debugger pauses on the address where it stops, now I want to step over one command at a time but when I step ...
3
votes
1answer
416 views

Is it possible to view and modify process memory without attaching the debugger in x64dbg?

This functionality is available in Cheat Engine where the debugger won't be attached until you set a breakpoint or explicitly ask for the debugger to be attached. I've looked everywhere and couldn't ...
3
votes
1answer
232 views

Unable to use CreateRemoteThread in target process

I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide). Even if I suspend all threads, it does ...
3
votes
0answers
180 views

Define function in x64dbg

I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions? A simple example would be to have a definition for WinMain(hInstance, ...
3
votes
0answers
222 views

What tool is able to analyze/decompile asm execution trace?

I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops). I ...
2
votes
2answers
228 views

Dealing with obfuscated PUSH PUSH RET instructions

I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
2
votes
2answers
97 views

Function Prologue, add esp directive

I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code: push ebp ;...
2
votes
1answer
252 views

bypass license of very old software, Access violation (C0000005) x32dbg

I'm trying to bypass the license of a very old software that i was using many years ago, now, the company of that software is closed and i can't get a license so, with a little bit of knowledge in ...
2
votes
1answer
795 views

Debug a windows service entry without windbg

An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
2
votes
1answer
195 views

Forcefully interpret code in x64dbg

I was just wondering if there was a way to force an interpretation of a block of code in x64dbg. The section im analyzing fluctuates between this: and this:
2
votes
2answers
153 views

Find a instruction in a binary file (PE) based on a virtual address of a string reference

English is not my first language, so I'm sorry if my text isn't so clear. I'm trying to program an automatic patcher for a PE binary that should work for multiple versions of this executable. For ...
2
votes
1answer
935 views

How to save (trace) the execution route/sequences in debugger and Replay?

is it possible to save the step-by-step execution route of the program? i.e. lets say in x64dbg the program executes one handle after another and so on, probably hundreds of calls... But according ...
2
votes
1answer
487 views

What's the fastest way to set a breakpoint when a value I know gets written in memory, if the memory address is different each time due to ASLR?

I have a 64bit exe I'm debugging with x64dbg. I'm searching for a specfic string value myvalue that sits encrypted somewhere in the exe (so, searching for myvalue at the beginning returns nothing). ...
2
votes
2answers
1k views

Record all calls to specific function? Olly/x64dbg

I need to find values of arguments that are passed to specific function. Normally I set INT3 breakpoint and check registers and the stack whenever it is reached. But there is too many calls to this ...
2
votes
1answer
105 views

In a native debugger, what must be done in order to resolve ntdll/other API symbols manually?

I'm reversing a Windows binary using x32Dbg and I have the following instruction: call ntdll.776C695A. What steps should I take in order to find out which function this is and/or what it does? The ...
2
votes
1answer
91 views

I can't set a hardware breakpoint on RIP + N-byte after calling NtContinue()

#include <Windows.h> int handle_exception (EXCEPTION_POINTERS *exception_pointers) { exception_pointers->ContextRecord->Rip += 4; return EXCEPTION_CONTINUE_EXECUTION; } int main (...
2
votes
1answer
201 views

change compare function in assembly and .exe stopped working x64dbg

I'm trying to bypass (crack) a very old software that require license in order to unlock all the features i was digging in the lines with a little bit of knowledge in assembly and i found the line ...
2
votes
1answer
116 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
2
votes
1answer
727 views

Does x64dbg display the whole memory info even for a simple program opened?

I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below. #include <stdio.h> void main() { int x, y, z; while(...
2
votes
1answer
278 views

Log EIP while in a certain memory range?

I'm looking for a means to log EIP of a process while it is within a certain memory range. I've dabbled a little bit in x64dbg's logging functionality, but was unsuccessful in getting a memory range ...
2
votes
1answer
187 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
2
votes
0answers
40 views

x64dbg break when hex string is loaded

I'm trying to break execution when a string is loaded in memory. I can´t find the string by using the search for -> string references So I press Alt + M and press Ctrl + B to search my string ...
2
votes
1answer
437 views

Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API

I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI. I thought it would be a simple registry key being modified so I used RegShot to ...
2
votes
0answers
3k views

How to step to specific function call?

I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
2
votes
0answers
414 views

How to solve anti-patch protection involving NtContinue? [duplicate]

I'm having an issue when trying to patch an application. If I open the .exe application with x64dbg, it first goes through ntdll.dll and then runs the application module. It works fine as long as I ...
2
votes
0answers
243 views

How can I fix an unpacked binary which calls out-of-bounds memory?

I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is ...
1
vote
1answer
364 views

Storing a string with with x64dbg

I want to patch a Windows binary (actually an ocx) with x64dbg. More specifically, I want to store a string of 60 bytes and store its address in EAX at a certain point. Do I just have to add it to a ...
1
vote
2answers
4k views

Comparison between orginal and modified DLL files with x64dbg

Is it possible to find the modifications between a original DLL file and a modified one using x64dbg? And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
1
vote
1answer
61 views

How's this code able to make use of the stack?

I am trying to reverse engineer software to extend its functionality as expected of me. So I don't have the source code with me. Anyways, I am used to seeing codes that start like the one below, and ...
1
vote
2answers
463 views

Difference between 32 bit and 64 bit disassemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
1
vote
1answer
710 views

Run any line/command in x64dbg

Is it possible, to run whichever line I want? For example, if it is at black position, and i want to run the RED CIRCLED command: I couldn't find a way to do that, neither in right click or etc......
1
vote
2answers
3k views

Automating bypassing anti-debug checks

I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
1
vote
1answer
1k views

Outputting a patched DLL from x64dbg

I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files. Using x64dbg, I've ...
1
vote
2answers
88 views

Patched Application causes Acces Violation c0000005

I've been working with this application to remove it's trial limitations. But every byte I change, it throws an acces violation. Piece of the code: Original: 003354C6 - 0F85 D3000000 - jne ...
1
vote
1answer
567 views

x64dbg how to set conditional breakpoint on WinAPI function

I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
1
vote
1answer
2k views

x64dbg how to watch all changes after one step

We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows? x64dbg 32bit version trace: NEW UPDATE ...