New answers tagged

0

You can save the debug-time segments in the IDB for “offline” analysis but on subsequent runs this will be useful only if they are allocated at exactly the same addresses.


1

Position dependent code If the executable was compiled as position dependent code, the addresses will not change - they will remain the same in process' virtual memory each time you run it. In this case, it simply suffices to find these addresses once during the runtime and they won't change. Position independent code In this (more likely) case, the ...


1

Another way this could be achieved is by using the Stacktrace function and then printing the arguments' locations - something like this: dprintf( "%08p %08p %08p %08p %08p %s", stk[i].FramePointer, stk[i].ReturnAddress, stk[i].Args[0], stk[i].Args[1], stk[i].Args[2], Buffer ...


2

According to Microsoft Docs, the ABI for x64 Windows looks like this: The x64 Application Binary Interface (ABI) uses a four-register fast-call calling convention by default. Space is allocated on the call stack as a shadow store for callees to save those registers. There's a strict one-to-one correspondence between the arguments to a function call and ...


1

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this case you will want to register a callback for CB_STEPPED, which gets called after every step. The basic functionality could look something like this: ...


Top 50 recent answers are included