Questions tagged [x64dbg]
An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.
224 questions
24
votes
4
answers
25k
views
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
OllyDbg had been nice in the past, but it stopped development a decade ago, x32dbg/x64dbg era came.
However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't ...
- 683
10
votes
2
answers
37k
views
How to view string references?
I have attached debugger to process/application (exe), but when i go to string references, it shows ntdll.dll references, instead of program.
how to get the references from program itself?
is it ...
- 683
9
votes
1
answer
12k
views
Trace back which function called the message box in x64dbg?
I have an error message pop up on the screen every few seconds on a program.
I would like to trace it back as to which function is calling the message box and why.
I found the referenced string but ...
- 93
7
votes
2
answers
5k
views
How to label local variables in x64dbg
As the title stands, I want to label local variables ([ebp - x] addresses) the same way I do with functions and global variables. What I've learned:
I found no way to label locals in the debugger ...
6
votes
3
answers
2k
views
Reverse engineer Listen to this device on Windows - Reverse engineer Windows when there's no API
I'm writing an Autohotkey script to toggle Listen to this device for my microphone, without interacting with a GUI.
I thought it would be a simple registry key being modified so I used RegShot to ...
- 111
5
votes
1
answer
2k
views
How does this EB F2 x86 instruction work?
In the following code snippet, the EB F2 instruction is causing execution to jump back up to the line indicated by the arrow. How is this the case given that there is no address supplied to EB and the ...
- 1,880
5
votes
1
answer
5k
views
Search strings in multiple files/processes/modules (x64dbg)
when you click String references in x64dbg, it only lists strings from current module/file. Is that possible to search strings in multiple (selected) files/modules?
- 683
5
votes
1
answer
9k
views
Dealing with exceptions in x64dbg
I'm debugging a game and I often come across an exception (EXCEPTION_PRIV_INSTRUCTION)
The debugger pauses on the address where it stops, now I want to step over one command at a time but when I step ...
- 107
5
votes
2
answers
10k
views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
- 203
5
votes
2
answers
16k
views
How can i add plugins in x64dbg?
I am trying to add 'xAnalyzer' plugin into it but after copying the files, I can't see it in debugger.
Its installation instructions are not working.
- 51
5
votes
1
answer
1k
views
Is it possible to view and modify process memory without attaching the debugger in x64dbg?
This functionality is available in Cheat Engine where the debugger won't be attached until you set a breakpoint or explicitly ask for the debugger to be attached. I've looked everywhere and couldn't ...
- 53
5
votes
1
answer
451
views
School project - Cracking a school emulator
John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
- 51
5
votes
0
answers
690
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 161
4
votes
2
answers
7k
views
How to break when specific text is found
In this line of code:
mov eax,dword ptr [eax+8];
eax+8 contains a long string of text, I want to find out where it originally came from.
In either OllyDbg or x32dbg, how can I break when ...
- 361
4
votes
1
answer
3k
views
Displaying IDA names in x64dbg or OllyDbg
I like x64dbg, but, without seeing IDA's names, it's hard to keep track of all the hex. Is there any way to export IDA's names into x64dbg (ideally contiuously)
- 41
4
votes
1
answer
3k
views
Debug a windows service entry without windbg
An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
- 422
4
votes
1
answer
7k
views
How to copy binary file with x64dbg\x32dbg after it changed it self
I know how to do it with OllyDbg but with x64dbg\x32dbg I don't know how to do it.
I have a packed binary file and at some point it unpacks itself and I found the point where it does it.
I want to ...
- 583
4
votes
2
answers
295
views
Malware analysis - Debugger hangs at HttpSendRequestA
I'm reverse engineering a malware that at some point tries to connect to http://api.ipify.org in order to get the IP address of the infected PC.
I was able to replicate this behaviour with a small ...
- 308
4
votes
2
answers
1k
views
Reverse engineering file format - ImageLink
I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files:
book.bbi ...
4
votes
1
answer
1k
views
Change string value when string is in a RAM address x64 c++ program
I'm new to reverse engineering.
I'm simply trying to change the value of a string in x64dbg, of a program I make myself in VS
(It's a c++ program, and is VERY simple; it just prints a string, and two ...
- 41
4
votes
2
answers
634
views
How to reverse a game and inject a dll in client program?
I am trying to make a bot for a game. But when I open the game in debugger like Ollydbg or in x64dbg the game simply closes and also it doesn't appears in the Attach to the process list in File menu ...
- 41
4
votes
1
answer
2k
views
IDA Pro Plugin to add x64dbg
Is there a plugin for IDA Pro to enable me to add x64dbg debugger support to IDA Pro 6.8 or 6.9?
- 311
3
votes
2
answers
10k
views
Comparison between orginal and modified DLL files with x64dbg
Is it possible to find the modifications between a original DLL file and a modified one using x64dbg?
And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
- 31
3
votes
2
answers
6k
views
x64dbg - see the current position?
i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment?
- 683
3
votes
1
answer
5k
views
How to load a PDB file into x64dbg?
I want to see symbols in the disassembly wherever possible, and I have a PDB file for the .exe I'm debugging, but I can't find a way to load the PDB file from disk. Is it even possible?
- 187
3
votes
1
answer
647
views
I am analyzing an exe with x64dbg but I dont see the address 00401000 [closed]
Will every .exe file start from 00401000 or am I wrong assuming such a thing.
Edit: total beginner here.
when the program is first loaded onto x64dbg it immediately goes into a DLL, so I could not ...
- 31
3
votes
1
answer
130
views
How can I set up a conditional breakpoint for the CreateFileW function for when a specific file/path is read in x64dbg?
I'm currently debugging a program using x64dbg, and I'm struggling to set up a conditional breakpoint on the CreateFileW function:
HANDLE CreateFileW(
[in] LPCWSTR lpFileName,...
- 35
3
votes
1
answer
358
views
Load PDB for MemoryModule-loaded DLL in x64dbg
I need to debug a DLL, which I have a PDB file for.
The debug target is a program, that loads the DLL using MemoryModule library from Github.
The loaded module isn't listed as a module in x64dbg, ...
- 43
3
votes
1
answer
629
views
exe file not opening after patching
I hope everyone is well. I'm new here and I'm hope someone can help me with the problem I'm facing.
I've been trying to reverse engineer a program but everytime I change an instruction, not matter how ...
- 49
3
votes
2
answers
1k
views
x64dbg: Conditional breakpoint: how to log only if register value has changed?
What i'm trying to achieve is to use a conditional breakpoint, that never actually breaks but logs in x64dbg's console the value of r9 only when it changes, to prevent console cluttering.
But i do not ...
- 73
3
votes
1
answer
1k
views
x64dbg: is there a way to save the complete disassembly of a module to a text file?
Is it possible to save the complete disassembly / listing to a file, and if so, how can it be done?
- 187
3
votes
1
answer
4k
views
How to unpack Armadillo protected software using x64dbg?
I am planning to reverse-engineer a Windows executable that has been protected with Armadillo.
When I put the executable through Detect It Easy, the results show that the executable was protected with ...
3
votes
2
answers
3k
views
When trying to change command line, received an error: "Could not set command line!"
I download CurrPort program and run it on xdbg64.
I pressed File -> Changed Command line and changed the command line to:
"C:\Users\myusername\Downloads\cport\cports.exe" "/close * * 127.0.0....
- 583
3
votes
1
answer
4k
views
Find what writes to a dynamic memory address
I am looking at some code using x64dbg and found the assembly code that writes to a certain block of memory: dword ptr [rdx + 0x18]. And changing this space in the dump has an output that I am looking ...
- 31
3
votes
1
answer
497
views
Unable to use CreateRemoteThread in target process
I'm trying to get a debugger attached to a malware, but it seems to pick up whenever a new remote thread is created (which makes it so I can't use Scyllahide).
Even if I suspend all threads, it does ...
- 33
3
votes
0
answers
340
views
How to see parameters in stack in x64dbg like in OllyDbg for known API calls?
Based on Detailed API call descriptions not available in x64dbg
When I debug a known API call like for example WSARecv, in OllyDbg I can nicely see the parameters in the stack:
I've installed both ...
- 161
3
votes
0
answers
433
views
x32dbg error C0000005, EXCEPTION_ACCESS_VIOLATION
Having some trouble with cracking a program, as the software does not prompt me to enter a serial key for activation. Instead, a serial key 924D-E42E-427D is already displayed within the program. So ...
- 31
3
votes
0
answers
234
views
Exporting patches as loader in x64dbg?
Is there a way to export modifications made in x64dbg as a separate executable file, which can be used to patch a desired executable file without detection?
The resulting file should function as a ...
3
votes
1
answer
261
views
How to call Windows console in ASM and printf some values there?
Is there a working way to embed the windows console in disasm code? I tried AllocConsole with GetStdHandle or AttachConsole with PID of an existing console but it didn't work. I have tried printf ...
- 131
3
votes
0
answers
520
views
Anti Dumping Techniques (C++)
how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle?
I tried this already but it didnt work. Scylla could still dump it fine.
- 31
3
votes
0
answers
323
views
How would I crack a software that has Xor encryption
So, before you shout at me to go on google I would just like to say I am new to reverse Engineering. Like I have been doing it for a hour. So, I was doing a bunch of crackmes.one using the search all ...
- 31
3
votes
1
answer
837
views
Locating function parameters in x32dbg
I'm a bit rusty and trying to analyze a piece of code in x32dbg. As follows:
0627BF49 | 8B0B | mov ecx,dword ptr ds:[ebx] |
0627BF4B | 8B85 CCF5FFFF ...
3
votes
0
answers
260
views
Define function in x64dbg
I am reversing a fairly complex app. In x64dbg (with xAnalyzer), is it possible to have custom function definitions?
A simple example would be to have a definition for WinMain(hInstance, ...
- 141
3
votes
0
answers
324
views
What tool is able to analyze/decompile asm execution trace?
I got a trace of the execution from x64dbg and I need to analyze it. The problem is that the trace is quite large and there are quite big chunks of the code that repeat (I assume they are loops).
I ...
- 131
2
votes
2
answers
8k
views
Automating bypassing anti-debug checks
I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
- 180
2
votes
1
answer
3k
views
How to run a script in x64dbg
In the x64dbg manual is many scripting commands and other things, but nowhere in it is mentioned, how to launch a script.
So, my question is: How to launch a script in x64dbg?
- 1,132
2
votes
1
answer
1k
views
x64dbg or alternative: Run to selection while storing all ran opcodes
I'm trying to trace a function, but unfortunately that function is huge and has lots and lots of jumps to other locations, making it almost impossible to trace for humans. I know the entry point and ...
- 123
2
votes
2
answers
1k
views
Dealing with obfuscated PUSH PUSH RET instructions
I wanted to run an app on a VM but there are PUSH PUSH RETs stopping me from looking at their anti VM code. There is a messagebox when I run it on a VM. I set a breakpoint at MessageBoxA and it gets ...
- 153
2
votes
2
answers
291
views
Function Prologue, add esp directive
I need to see how a DLL was written and I am using a x32dbg to do it at run-time. I am a newbie to this reversing stuff, so I am confused with this piece of code:
push ebp ;...
- 23
2
votes
1
answer
3k
views
How to navigate Disassembly view to specific absolute address location?
I have an absolute address that I want to scroll the Disassembly to in order to see which instructions are at that address. I understand that I can scroll by hand, or I can edit RIP. But the former ...
- 187