New answers tagged x64dbg
1
Currently it is not supported to do debug automation in callbacks. This is related to the threading model and is further explained at https://x64dbg.com/blog/2016/10/20/threading-model.html, which links to some older resources.
Recently there was an interesting development though, because it became possible to automate in the debug callbacks with x64dbg’s ...
1
Procedure:
Get base address in x64dbg: Load the binary in x64dbg. Go to "Memory Map" tab.
Find the binary name in info column. Then copy the address with the right
click on it. For example, in the following screenshot, the x86_64 PE binary
name is Project1.exe and the base address is 0x00007FF6A4850000.
Rebase in IDA: Open the binary in IDA. Click on Edit >...
1
This is an application that used to be part of ScyllaHide. It was responsible for finding addresses of undocumented (and unexported) functions in ntdll by downloading the Microsoft symbols and finding their address there. If you are interested you can find more information about the removal at https://github.com/x64dbg/ScyllaHide/commit/...
0
I don't have 50 reps to comment, but PDBs are symbols. It's failing to load symsrv.dll, which tells me that you don't have the debugging tools installed? If so, you will need to install it: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/debugger-download-tools
After doing so, it SHOULD work. I haven't used PDBReader but when symbols are ...
1
Out of the box, x64dbg doesn't have a feature to show Win API call descriptions unlike OllyDbg.
For that, you need to use a plugin like xAnalyzer or the older APIInfo Plugin.
0
It is possible that the application is packed using a packer or the strings are encrypted. I would first see if it is packed using a tool like PEiD or Detect It Easy.
0
Normally the debugger should pause at the location where breakpoint is triggered, or you can use "jump to EIP" or similar command to navigate to the instruction being executed (which should be the one that triggered the exception).
Top 50 recent answers are included
