Hot answers tagged

4

x64dbg can load the pdb and list all the function names if you have pdb for your executable view->modules->download symbols for this module also x64dbg can use the source file (ctrl+shift+s) just for completion sake windbg usage :\>cdb -c ".lines;bp `winchk.cpp:17`" winchk.exe Microsoft (R) Windows Debugger Version 10.0.17763.132 AMD64 ...


3

To launch a script, it has to be first loaded into x64dbg — you will see it in the Script tab:                                               Before loading a script, the content of this tab is empty: You may load a script in any of the following ways: Copy the content of your script into clipboard, then switch to the Script tab, and paste it with Shift+V (...


2

You can do it in IDA by calling VirtualProtect in the process' context with Appcall. From Practical Appcall examples: In the following example we will change the PE header page protection to execute/read/write (normally it is read-only): virtprot = Appcall.proto("kernel32_VirtualProtect", "BOOL __stdcall VirtualProtect(LPVOID addr, DWORD sz,...


2

x64dbg comes in two versions, 32 and 64 bits. You need to run the 32-bit version of x64dbg to detect a 32-bit application.


2

In IDA, you can find sequences of bytes via Search->Sequence of bytes. That said, if your byte pattern is poorly-chosen (for reasons such as that it includes relocatable byte sequences, or it was created for a different version of the software), the result of the search may well be that the pattern cannot be found in the target binary.


2

This answer covers the entire analysis process that you can perform when you want to analyse a potentially malicious sample. If you are interseted only in unpacking, see Manual unpacking subsection. Quick solution In order to determine whether your file is malicious, if you don't mind sharing your file with other parties, you could try any of the two ...


1

Yes, it is. For decimal numbers, use the syntax with the period just before the number, e.g. .10: Particularly, in your case you will obtain exactly what you wanted (I omitted leading zeroes):


1

I have experienced this in the past with different tools, too. What I have done is find something easy to locate in both tools, such as the DLL Main of a library or Entry Point of the PE file (or another string) etc. Then you can calculate the offset between the two tools. Depending on the program, it can change with each run of the debugger. What X64dbg is ...


1

write a script like this (this is not an actual representation of CONTEXT64 only a partially ripped up struct from MSDN CONTEXT DOCS ClearTypes // clear existing types AddType uint64_t,DWORD64 // add windows specific DWORD64,DWORD,WORD AddType uint32_t,DWORD AddType uint16_t,WORD AddUnion ...


1

Pretty sure System.Diagnostics.Debugger.IsAttached detects only managed debuggers, whereas the code you mentioned CheckRemoteDebuggerPresent, should work on any kind of debugger, provided there is no anti-anti-debugging protection applied. Managed debuggers, refer to those such as your .net managed debugger. Note that CheckRemoteDebuggerPresent, when the ...


1

you don't ... there's a slim chance to use a hardware breakpoint to trigger when the (mapped) resource string gets accessed, though. you need to stake out what APIs get used which could be used to read the string(s). The first one to go to here would be LoadString for obvious reasons. But it's possible that your target uses FindResource (or the corresponding ...


1

You can put a breakpoint on the 'MessageBox' syscall, and inspect it's arguments. From the MSDN the arguments are: int MessageBox(hWnd, lpText, lpCaption, uType); And you are interessted in 'lpText': The message to be displayed. If the string consists of more than one line, you can separate the lines using a carriage return and/or linefeed character ...


1

I am not sure what you are asking (never used sticky notes and don't have it installed ) but if you want to run sticky notes from command line you can do something like this the command below will run calculator instead of the wildcard calc use stick C:\>powershell -c "(get-startapps -name *calc*).Appid Microsoft.WindowsCalculator_8wekyb3d8bbwe!App ...


1

If you want to use x64dbg for debugging and at the same time IDA Pro for static analysis, I recommend you one of my favourite plugin: https://github.com/bootleg/ret-sync You can for example run your binary program in a VM with x64dbg and synchronize it to highlight the current instruction in IDA Pro and much more like auto rebase, controlling/BP from IDA, ...


1

Calls on x86/x64 are encoded based on how far the target is from the source, not as an RVA into the image. I.e., the number 0x1C88 is a distance, not an RVA. To find the RVA, follow the call to its destination, and then subtract that address by the module imagebase. Then, in IDA, press G and enter 0x140000000+[RVA HERE].


1

As expected, the USB was indeed detected but due that Linux has no idea how to deal with it without a proper driver, it only parses its hardware related parameters (Vendor and Product IDs) and stops there. Here are the USB device's entries in usb-devices and lsusb commands respectively: # usb-devices [...] T: Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#= 8 ...


1

Yes, it is explicitly not supported on the issues page, however, if you are very serious about using x64dbg, it does support writing plugins that create breakpoints and react to debugger events such as breakpoints being hit... so you could write your own plugin that does what you want.


1

Use the keyboard shortcut Ctrl-G (go to expression) and type "eip" or "rip" depending on your architecture.


Only top voted, non community-wiki answers of a minimum length are eligible