Questions tagged [x64dbg]

An open-source x64/x32 debugger for windows with UI inspired by OllyDbg.

Filter by
Sorted by
Tagged with
3
votes
1answer
416 views

Is it possible to view and modify process memory without attaching the debugger in x64dbg?

This functionality is available in Cheat Engine where the debugger won't be attached until you set a breakpoint or explicitly ask for the debugger to be attached. I've looked everywhere and couldn't ...
1
vote
1answer
97 views

Find Retdec Address Range in x64dbg

How do I find this function from RetDec in x64dbg? // Address range: 0x1017dba0 - 0x1017dbda int32_t function_1017dba0(int32_t * a1) { int32_t fileHandle = (int32_t)CreateFileA("\\\\.\\...
0
votes
0answers
374 views

In X64dbg, how can I script a string write to memory?

I find that I can write to memory as [addr] = value As given by the documentation at http://help.x64dbg.com/en/latest/introduction/Input.html And while I could work around my problem as dividing ...
1
vote
2answers
463 views

Difference between 32 bit and 64 bit disassemblers

As far as my level of understanding goes, the only difference between a 32 bit and 64 bit disassembler is that the produced assembler-code of a 32 bit disassembler is only using 32 bit assembly ...
2
votes
1answer
116 views

How to hide a process from all the methods of getting the list of processes?

So it seems that there are a lot of ways of getting the process list, although I'm not sure whether in the low level do they acquire them from same place or not so these are the ways i know : ...
1
vote
1answer
100 views

What is the ending bytes in the MOV instruction in 32 bit applications in windows? (B8 mov)

So i just compared NTterminateProcess between 32 and 64 bit version of a program, and the mov instruction which moves the syscall into eax is almost the same, both 5 byte, (both the B8 mov) but the ...
1
vote
1answer
139 views

Getting started with RE, with eventually goal being able to make a keygen [closed]

I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
1
vote
2answers
451 views

When trying to change command line, received an error: “Could not set command line!”

I download CurrPort program and run it on xdbg64. I pressed File -> Changed Command line and changed the command line to: "C:\Users\myusername\Downloads\cport\cports.exe" "/close * * 127.0.0....
1
vote
0answers
79 views

UTF8, UTF16 encoding string search

I want to search for a string written in Georgian from within x64dbg. It shows me spaces except them.. P.S I found this github repository but, I don't know how to install the plugin in the debugger.....
1
vote
1answer
528 views

Finding out what calls win32u.dll functions

There's a button which, when clicked, writes some data to the clipboard. I'm trying to call the function this button executes using DLL Injection. I managed to find the function in win32u.dll which ...
0
votes
2answers
731 views

x64dbg (x32dbg) log registers every step like windbg

So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
3
votes
1answer
138 views

I am analyzing an exe with x64dbg but I dont see the address 00401000 [closed]

Will every .exe file start from 00401000 or am I wrong assuming such a thing. Edit: total beginner here. when the program is first loaded onto x64dbg it immediately goes into a DLL, so I could not ...
1
vote
0answers
130 views

Process terminating when breakpoint reached

I want to set breakpoint on the recv function to replace the received packets. But, I can not put breakpoint on any instruction in the program, the process simply closes with code 4000001f. I also ...
1
vote
0answers
70 views

Hearts Game Passing Cards

I'm trying to make this Hearts game so that i can select more than 3 cards. This is the func that will compare how many cards i've chosen with 3 it'll jump to this address if > 3 so i replace the ...
-1
votes
2answers
335 views

How to know what does the function do?

I've made a simple c++ program. In the ollydbg i searching for the string which is my name, there are 2-3 call functions near the string location but i don't know what those function do. My question ...
0
votes
1answer
91 views

'local call from' in x64dbg

In OllyDbg there was a thing called "local call from xxx,xxx,xxx,xxx ... " which helps me know from where a function is being called in the entire module. Does such a feature exist in x64dbg as well?
0
votes
1answer
87 views

Is there a way to export all the strings for a certain module in x64dbg?

I have an encrypted file that I was able to step through the code until that specific DLL file was decrypted in memory and I was able to list all of its strings. It has a ton of them that I would like ...
1
vote
1answer
364 views

Storing a string with with x64dbg

I want to patch a Windows binary (actually an ocx) with x64dbg. More specifically, I want to store a string of 60 bytes and store its address in EAX at a certain point. Do I just have to add it to a ...
0
votes
1answer
265 views

What does ds mean?

When debugging with x64dbg I sometimes see mov ss:[address] 0xAA, I know that this means: move 0xAA into memory at specified address. But what does mov ds:[address] 0xAA mean?
0
votes
1answer
114 views

What does this function actually do?

I'm taking part in this reverse engineering lab at college and we have this final big homework project. I have a part of the binary that changes it's own asm code by iterating through it's own bytes ...
1
vote
1answer
567 views

x64dbg how to set conditional breakpoint on WinAPI function

I am trying to solve a GUI based crackme. https://crackmes.one/crackme/5c68758633c5d4776a837cc4 so that I learn security. I want to set a conditional Break point on user32.CallWindowProcA. Microsoft ...
1
vote
1answer
281 views

Trace back function call

I'm learning reverse engineering and I'm trying to find where an error message is called. I want to get in the part of the code, in the main module, where it decides to display the error message or ...
4
votes
2answers
419 views

Reverse engineering file format - ImageLink

I have some technical documentation which is supplied in the form of a generic Windows viewer and a database. The database contains different "books", which are represented by a bunch files: book.bbi ...
0
votes
1answer
388 views

x64dbg - Locating where data is initially written

I am hoping someone can help me with a question or two. Essentially I used to be a computer programmer who always wanted to get into a bit of game hacking, having not done any serious programming for ...
0
votes
1answer
847 views

Go back to the function call address

My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg? Or for example if we want to trace ...
0
votes
2answers
288 views

Print opcodes in trace - x64dbg

How can I print the opcodes in a trace log? I can use {x:bswap([cip])} but this will print a fix amount of bytes (which most of the time will end up as either more or less number of bytes), ...
1
vote
1answer
803 views

Debugger always paused in ntdll.Kifastsystemcallret

I am using x32dbg to debug a program. I want to find the line which corresponds to a pop up message in my program to put a Break point. But everytime that I set "Pause" after the pop up window's ...
0
votes
1answer
1k views

x64dbg - Conditional breakpoint based on function argument

How can I set a conditional breakpoint based on the argument of a function? I am trying to break on the windows function LoadLibraryExW: https://docs.microsoft.com/en-us/windows/desktop/api/...
0
votes
1answer
134 views

The callstack does not show the message handler

After clicking a button or doing anything which might generate a message to be translated and dispatched, why is that the callstack might not show the message handler? Say I am reversing an ...
1
vote
1answer
194 views

Is there any debugger that supports step-back? [duplicate]

In Ida when I use debugger, but I can't step back. Is there any debugger that allow go backwards?
0
votes
1answer
72 views

x64dbg “System” meaning

I'm a bit confused about what "system" refers to when looking at the callstack in x64dbg. Does it mean the code is currently being executed in ring0? I thought that only system calls are executed in ...
2
votes
1answer
187 views

dongle check happen before a debugger start debugging

i'm trying to fake the test ( dongle exist ) but one problem that i encounter is that the application detect it before i start debugging it . this is what happen with more details : open( not ...
2
votes
1answer
935 views

How to save (trace) the execution route/sequences in debugger and Replay?

is it possible to save the step-by-step execution route of the program? i.e. lets say in x64dbg the program executes one handle after another and so on, probably hundreds of calls... But according ...
0
votes
1answer
186 views

How to locate an specific data structure in an executable?

I need to locate an specific "struct" variable in the data section from an assembly. This structure is used for an specific System Function (Windows) "SetCommState()". I'm wondering how to locate the ...
9
votes
4answers
13k views

OllyDbg vs x64dbg - Is there anything in OllyDbg that is not available in x64dbg?

OllyDbg had been nice in the past, but as it was frozen, x32dbg/x64dbg era came. However, some people still use OllyDbg. Are there any reasons to use the old OllyDbg still? Doesn't x32dbg/64dbg covers ...
1
vote
1answer
710 views

Run any line/command in x64dbg

Is it possible, to run whichever line I want? For example, if it is at black position, and i want to run the RED CIRCLED command: I couldn't find a way to do that, neither in right click or etc......
1
vote
1answer
2k views

x64dbg how to watch all changes after one step

We know that x64dbg will mark the changes as red color after we step an assembly instruction, so how can I get all changes without scroll monitor windows? x64dbg 32bit version trace: NEW UPDATE ...
2
votes
1answer
487 views

What's the fastest way to set a breakpoint when a value I know gets written in memory, if the memory address is different each time due to ASLR?

I have a 64bit exe I'm debugging with x64dbg. I'm searching for a specfic string value myvalue that sits encrypted somewhere in the exe (so, searching for myvalue at the beginning returns nothing). ...
0
votes
2answers
593 views

.exe file to .class, decompiled to .java, how to put back to .class?

I'm trying to reverse engineer a very complex .exe to alter its behavior. Ran JWScan that tells me it's been wrapped with Jar2Exe (which I also saw during debugging). Looking at the complex exe with ...
2
votes
0answers
3k views

How to step to specific function call?

I'm reverse engineering an application and I identified a specific function call that has an output that I need to capture. For the actual capture, I'll do a memory dump, so that I can handle. However,...
2
votes
1answer
795 views

Debug a windows service entry without windbg

An answer to a similar question here mentions that the entry of a windows service can be patched to allow attaching a debugger (in my case x64dbg). Google searches on the topic are all related to ...
1
vote
2answers
3k views

Automating bypassing anti-debug checks

I'm working on bypassing the anti-debug checks of an unpacker in x64dbg. My end goal is to bypass all of the checks so that I can run the (unmodified) process with a debugger attached without any ...
1
vote
2answers
199 views

How to reach functions triggered by non-standard buttons?

I've already read related posts such as: link1: https://stackoverflow.com/questions/24138087/how-can-i-set-a-breakpoint-for-a-button-click-using-ollydbg link2: How can I set a breakpoint for a button ...
1
vote
0answers
133 views

x64dbg flow-indent style trace logs

I have recently been using x64dbg a lot. I am coming from using tools like dtrace and frida-trace on macOS. Is there any way to get flow-indent style trace logs in x64dbg? Or would you recommend a ...
2
votes
1answer
727 views

Does x64dbg display the whole memory info even for a simple program opened?

I'm very new in software reverse engineering. I created a very simple c program using Visual Studio and the code is listed below. #include <stdio.h> void main() { int x, y, z; while(...
1
vote
2answers
4k views

Comparison between orginal and modified DLL files with x64dbg

Is it possible to find the modifications between a original DLL file and a modified one using x64dbg? And, if I can't do it with x64dbg, what tool would be better than a debugger to find the ...
1
vote
1answer
1k views

Outputting a patched DLL from x64dbg

I've been working on reversing an extremely outdated piece of software that I happen to need in order to get at the information stored in some equally outdated "database" files. Using x64dbg, I've ...
2
votes
0answers
414 views

How to solve anti-patch protection involving NtContinue? [duplicate]

I'm having an issue when trying to patch an application. If I open the .exe application with x64dbg, it first goes through ntdll.dll and then runs the application module. It works fine as long as I ...
4
votes
1answer
1k views

Search strings in multiple files/processes/modules (x64dbg)

when you click String references in x64dbg, it only lists strings from current module/file. Is that possible to search strings in multiple (selected) files/modules?
3
votes
1answer
1k views

x64dbg - see the current position?

i.e. when the program is running, and x64dbg is attached to the process - how can i see where it is at this moment?