Hot answers tagged

21 votes
Accepted

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Debugging software with a combination of managed and unmanaged code: Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which ...
Clint_2018's user avatar
14 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...
mrexodia's user avatar
  • 1,652
10 votes
Accepted

Trace back which function called the message box in x64dbg?

You can find this out by first running the program to the entry point to skip all of the boilerplate code, then go to the Symbols tab in x64Dbg, going to User32.dll and then filtering for the ...
the_endian's user avatar
  • 1,830
10 votes
Accepted

How to view string references?

When x64dbg attaches to a process it will first stop at the 'Attach breakpoint'. The button to search for string references will search the module currently shown in the disassembly. To search in ...
mrexodia's user avatar
  • 1,652
10 votes
Accepted

How does this EB F2 x86 instruction work?

from google starmans realm quoting relevant info These are also known as SHORT Relative Jumps. Programs using only Relative Jump instructions can be relocated anywhere in memory without ...
blabb's user avatar
  • 16.3k
9 votes

Displaying IDA names in x64dbg or OllyDbg

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
mrexodia's user avatar
  • 1,652
8 votes

Dealing with exceptions in x64dbg

Exceptions are complicated business. I will attempt to explain briefly how SEH (Structured Exception Handling) in Windows works to invoke the appropriate exception handler. Your game probably does not ...
barnaby-b's user avatar
  • 141
8 votes
Accepted

Search strings in multiple files/processes/modules (x64dbg)

From what I know you can search for String references in all modules. The way is: right click ---> search for ---> all modules ---> String references
user22363's user avatar
  • 355
7 votes

How to break when specific text is found

You are searching for Conditional Breakpoints OllyDBG It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00 Conditional Breakpoint Displays dialog window asking user to ...
Megabeets's user avatar
  • 8,919
7 votes

Tracing function calls in x64dbg

It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which ...
bart1e's user avatar
  • 3,369
7 votes

Debug a windows service entry without windbg

I'll post my own answer here so I can find this again in the future. Using CFF Explorer open the service binary. Find the AddressOfEntryPoint in the Optional Header. Find the .text entry in Section ...
Twifty's user avatar
  • 422
6 votes

How can i add plugins in x64dbg?

Download Download the files apis_def.zip xAnalyzer.dp32 xAnalyzer.dp64 from here Steps Copy xAnalyzer.dp32 to x32/plugins directory Copy xAnalyzer.dp64 to x64/plugins directory Create a folder ...
GameMaster Greatee's user avatar
6 votes

x64dbg (x32dbg) log registers every step like windbg

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this ...
mrexodia's user avatar
  • 1,652
5 votes

How to view string references?

The way is: Debug -> Run to user code Then you will see the strings of the program itself. x64dbg/x32dbg as any other debugger, walks you trough all the process initialization code before ...
0xfede7c8's user avatar
  • 243
5 votes
Accepted

Automating bypassing anti-debug checks

What you could do: With each found anti-debug, patch the exe with the bypass and continue with the patched one. If your debugger is scriptable (like e.g. Ida) run it under the script, insert ...
josh's user avatar
  • 1,964
5 votes

Storing a string with with x64dbg

I don't know how to do it in x64dbg, but here is another way to achieve it. Open your ocx (dll) file in Resource Hacker and you should see the resorces within your dll file. Then click Create ...
bart1e's user avatar
  • 3,369
5 votes
Accepted

xor eax,3 why does the input change the way it does?

In C, this function would look like this: int fun() { int a; // some code you haven't pasted here; probably scanf("%d", &a);... if (some_condition) a ^= 3; // xor a with 3 ...
bart1e's user avatar
  • 3,369
5 votes
Accepted

x64dbg or alternative: Run to selection while storing all ran opcodes

On Windows Travel Debugging (TTD) is a perfect use case for this scenario. To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has ...
chentiangemalc's user avatar
5 votes
Accepted

How to run a script in x64dbg

To launch a script, it has to be first loaded into x64dbg — you will see it in the Script tab:                                               Before loading a script, the content of this tab is empty: ...
MarianD's user avatar
  • 1,120
4 votes
Accepted

How to copy binary file with x64dbg\x32dbg after it changed it self

It sounds like you want to dump the executable. You can use Scylla (which is built into x64dbg) to dump and restore the executable. You can find Scylla in Plugins -> Scylla
mrexodia's user avatar
  • 1,652
4 votes
Accepted

Forcefully interpret code in x64dbg

You are encountering the issue of backwards disassembly. When you give x64dbg an address to disassemble at it will start decoding at exactly this address, go to the next instruction, etc. For example ...
mrexodia's user avatar
  • 1,652
4 votes

x64dbg - see the current position?

From your screenshot I understand that you want to break on. You can do this by breaking on the debug string event. Use the following setting: If you want to pause the execution, simply click the “...
mrexodia's user avatar
  • 1,652
4 votes

Comparison between orginal and modified DLL files with x64dbg

You shouldn't use a debugger to search for differences. You should use a diff tool. Of course, most diff tools work on ASCII text, but there are some that deal with binary files. Some examples: ...
Paweł Łukasik's user avatar
4 votes

OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?

Outside of maybe custom plug-ins or perhaps buried features and usability differences, there's really no incentive to use OllyDbg over x32dbg/x64dbg. Since OllyDbg was the debugger of choice for so ...
dsasmblr's user avatar
  • 2,234
4 votes
Accepted

How to save (trace) the execution route/sequences in debugger and Replay?

You may want to use "Trace record" and "Run trace". Using Trace record, the debugger records and highlights every instructions as you step through the code. You will easily know when the same ...
0xec's user avatar
  • 6,040
4 votes

Go back to the function call address

You have two options, assuming the function is not inlined: at the beginning of the function look at the stack, it should point to the caller. In some cases it can be possible to optimise the ...
zxxc's user avatar
  • 233
4 votes
Accepted

What does ds mean?

The ds means "data segment" register in x86 architecture, while ss states for "stack segment" register. You would probably want to read link for more comprehensive description. When you see mov ds:[...
bart1e's user avatar
  • 3,369
4 votes

I am analyzing an exe with x64dbg but I dont see the address 00401000

no every exe will not start from 0x401000 the image base is hardcoded in header and is configurable with /entry switch when linking (ms linkers) the operating system can and will override the ...
blabb's user avatar
  • 16.3k
4 votes
Accepted

bypass license of very old software, Access violation (C0000005) x32dbg

mov al, 1, the instruction you want to use becomes b0 01 (you can check here), assuming x86-32. That is, 2 Bytes. The instruction you are patching (mov byte ptr ds:[ecx+0x72], al) is 88 41 72 and so ...
0xC0000022L's user avatar
  • 10.9k
4 votes
Accepted

Function Prologue, add esp directive

The large integer that is added to ESP is negative and is used to move the stack pointer to a an address that allows 0x44 bytes on the stack for the current function. At this point, ESP=EBP-0x44. So, ...
Yotamz's user avatar
  • 882

Only top scored, non community-wiki answers of a minimum length are eligible