17
Debugging software with a combination of managed and unmanaged code:
Ollydbg debugs and runs managed code very well (of course in this case it only runs as a native debugger and not like DnSpy which shows the .Net functions and code perfectly).
There are times when, if the malware makes a lot of calls to unmanaged code (native code DLLs) it is far more ...
10
from google starmans realm
quoting relevant info
These are also known as SHORT Relative Jumps. Programs using only Relative
Jump instructions can be relocated anywhere in memory without having to
change the machine code for the Jumps. The first byte of a SHORT Jump is
always EB and the second is a relative offset from 00h to 7Fh for ...
9
The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.
9
When x64dbg attaches to a process it will first stop at the 'Attach breakpoint'. The button to search for string references will search the module currently shown in the disassembly. To search in another module you simply have to go there.
One way to do this is to go to the Symbols tab and double click the module you are interested in. This should take you ...
9
Disclaimer: I am the main developer of x64dbg, take that into account :)
I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If you are working on a modern system I think x64dbg is a better choice because it was designed to work there.
That said, x64dbg isn’t better in all aspects. One ...
6
You can find this out by first running the program to the entry point to skip all of the boilerplate code, then go to the Symbols tab in x64Dbg, going to User32.dll and then filtering for the MessageBox functions. Place breakpoints on any functions with MessageBox in them and then run the program. Now, when MessageBox is called, the program will break and ...
6
You are searching for Conditional Breakpoints
OllyDBG
It's possible to set a conditional breakpoint in both OllyDbg 1.01 and 2.00
Conditional Breakpoint
Displays dialog window asking user to set or modify parameters of
simple conditional INT3 breakpoints at one or more addresses
addr[naddr] in the memory of the debugged process. [Source: Official ...
6
From what I know you can search for String references in all modules.
The way is: right click ---> search for ---> all modules ---> String references
6
I'll post my own answer here so I can find this again in the future.
Using CFF Explorer open the service binary.
Find the AddressOfEntryPoint in the Optional Header.
Find the .text entry in Section Headers.
Calculate raw_offset = raw_address - virtual_address + AddressOfEntryPoint.
Within the built-in hex editor, navigate to raw_address.
Change the two ...
5
Exceptions are complicated business. I will attempt to explain briefly how SEH (Structured Exception Handling) in Windows works to invoke the appropriate exception handler. Your game probably does not use SEH, however, since your question is too broad so will be my answer. I based it on SEH since it's the easiest to understand and you can work your way up.
...
5
In C, this function would look like this:
int fun()
{
int a;
// some code you haven't pasted here; probably scanf("%d", &a);...
if (some_condition)
a ^= 3; // xor a with 3
else
a ^= 2; // xor a with 2
printf("a = %d.\n", a);
return 0;
}
I cannot say anything more about it having only the snipped you shared with ...
5
On Windows Travel Debugging (TTD) is a perfect use case for this scenario.
To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has administrator privileges and use that account when recording in the debugger. In order to run the debugger elevated, select and hold (or right-click) the WinDbg ...
4
The way is:
Debug -> Run to user code
Then you will see the strings of the program itself.
x64dbg/x32dbg as any other debugger, walks you trough all the process initialization code before entering your "main".
4
It sounds like you want to dump the executable. You can use Scylla (which is built into x64dbg) to dump and restore the executable.
You can find Scylla in Plugins -> Scylla
4
Download
Download the files
apis_def.zip
xAnalyzer.dp32
xAnalyzer.dp64
from
here
Steps
Copy xAnalyzer.dp32 to x32/plugins directory
Copy xAnalyzer.dp64 to x64/plugins directory
Create a folder named "apis_def" in both x32/plugins & x64/plugins directory
Now copy the contents of "apis_def.zip" into both "apis_def" folder
All done!
4
You are encountering the issue of backwards disassembly. When you give x64dbg an address to disassemble at it will start decoding at exactly this address, go to the next instruction, etc.
For example if you have the bytes:
EB 00 48 83 C4 38 C3
And you start disassembling at the first byte you will see:
0 | EB 00 | jmp 2
2 | 48 83 C4 38 | add rsp,38
...
4
From your screenshot I understand that you want to break on. You can do this by breaking on the debug string event. Use the following setting:
If you want to pause the execution, simply click the “pause” button. If you want to see the current instruction executes you can use the “Threads” tab and double click the EIP/RIP column of one you’re interested in.
4
Outside of maybe custom plug-ins or perhaps buried features and usability differences, there's really no incentive to use OllyDbg over x32dbg/x64dbg. Since OllyDbg was the debugger of choice for so many years, it will take awhile to run its course.
That said, it's still extremely capable for a 32-bit debugger with a rich support/plug-in ecosystem (even if a ...
4
You may want to use "Trace record" and "Run trace".
Using Trace record, the debugger records and highlights every instructions as you step through the code. You will easily know when the same instruction is executed twice by virtue of the highlighting.
When "Run trace" is enabled with "Trace record", the debugger additionally saves the code execution path ...
4
I don't know how to do it in x64dbg, but here is another way to achieve it.
Open your ocx (dll) file in Resource Hacker and you should see the resorces within your dll file. Then click Create Resources from Blank Script button and type there:
your_res_name RCDATA
{
"the_very_long_string_you_want_to_add\0"
}
And click Compile Script button (or press F5 ...
4
no every exe will not start from 0x401000
the image base is hardcoded in header and is configurable with /entry switch when linking (ms linkers)
the operating system can and will override the preferred image base
all other address in the exe file are relative to the hardcoded preferred imagebase
if os overrides it and maps it elsewhere ...
4
There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com.
In this case you will want to register a callback for CB_STEPPED, which gets called after every step. The basic functionality could look something like this:
...
4
mov al, 1, the instruction you want to use becomes b0 01 (you can check here), assuming x86-32. That is, 2 Bytes.
The instruction you are patching (mov byte ptr ds:[ecx+0x72], al) is 88 41 72 and so takes up 3 Bytes. See the problem already?
That means you are only patching the first two bytes of the instruction and need to pad it with a single-byte NOP (...
4
The large integer that is added to ESP is negative and is used to move the stack pointer to a an address that allows 0x44 bytes on the stack for the current function.
At this point, ESP=EBP-0x44. So, EBP-0x44 is essentially, [ESP].
It is equivalent to PUSH EAX, as a parameter for the CALL that comes next.
The ss: is a selector which indicates that the "...
4
The RET instruction transfers control to the return address located on the stack. Normally this is used to go back from a function to where the function was called, as the address of the next instruction was pushed into the stack by the CALL instruction.
However, RET can be misused: a PUSH before a RET instruction is a typical obfuscation technique. In this ...
4
It sounds like you are looking for proper debugger integration in Ghidra. This has recently been published to the GitHub repository in the debugger branch. There is also a good blogpost showcasing it.
Sadly there does not seem to be a x64dbg backend yet, but I would expect that this will appear as either an official backend or a community plugin at some ...
4
x64dbg can load the pdb and list all the function names if you have pdb for your executable
view->modules->download symbols for this module
also x64dbg can use the source file (ctrl+shift+s)
just for completion sake windbg usage
:\>cdb -c ".lines;bp `winchk.cpp:17`" winchk.exe
Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64
...
3
It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which will log the module name, address and the instruction after a space.
As far as I am concerned, there is unfortunately no support for string comparison in x64dbg, ...
3
Two ways to label local variables in x64dbg:
In x64dbg, follow in dump at address of local var (like this [ebp-4]). Right click at this address and select Add label, then name the label.
Now in the CPU window, local var is displayed like the following picture:
Try the labeless plugin : https://github.com/a1ext/labeless/ to sync from IDA to x64dbg.
...
3
Local variables labeling is not yet supported by x64dbg and as far as I know there's no plugin to achieve that.
However, you can still label a specific memory address. You can do this by selecting the address and press :, or right click it and select Label >> Label Current Address.
If you want this functionality you can ask for it on the x64dbg's Github ...
Only top voted, non community-wiki answers of a minimum length are eligible