3

It is also easy using x64dbg. When you break on the WriteProcessMemory the handle will be at [esp+0x4] in the memory. After you write down the handle (in this case 0xDC) you may go to the Handles tab in the x64dbg main window, then Right click -> Refresh. All the handles associated with your debugged process will be listed. Now you need to find the ...


1

Is movq rax, xmm0 buggy in Radare2? No, it's just not fully implemented in all debuggers yet. Native Debugger Works! This instruction works fine using the native debugger. The native debugger is launched with r2 -d yourFileGoesHere. Alternatively, if you are already in r2 looking at the file, but r2 wasn't launched with the -d switch, the file can be ...


Only top voted, non community-wiki answers of a minimum length are eligible