mrexodia
  • Member for 8 years, 7 months
  • Last seen more than a week ago
OllyDbg vs x64dbg - Does OllyDbg have any particular advantage over x64dbg?
10 votes

Disclaimer: I am the main developer of x64dbg, take that into account :) I would say that the main difference between OllyDbg and x64dbg is that there is no 64 bit (os) support at all in OllyDbg. If ...

View answer
IDA Hex-Rays Decompiler : Show strings instead of offset
9 votes

Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this: Click on Analysis ...

View answer
How to view string references?
Accepted answer
9 votes

When x64dbg attaches to a process it will first stop at the 'Attach breakpoint'. The button to search for string references will search the module currently shown in the disassembly. To search in ...

View answer
Displaying IDA names in x64dbg or OllyDbg
9 votes

The plugin labeless (https://github.com/a1ext/labeless) was created for exactly this purpose. You can now also use x64dbgida (https://github.com/x64dbg/x64dbgida) to import/export x64dbg databases.

View answer
Can my C# program be dumped from memory and reversed into source code?
Accepted answer
8 votes

It is in fact trivial to dump the byte array or the module directly from dnSpy. To mimic the described scenario I wrote some trivial example code: using System.IO; using System.Reflection; ...

View answer
Thread EntryPoint in TLS callback as AntiDebug technique
Accepted answer
7 votes

When a debugger wants to attach to a process it will do the following things (see the DebugActiveProcess implementation on ReactOS): Connect to the debuggee with DbgUiConnectToDbg Tell the kernel to ...

View answer
Debugger hiding plugin for WinDbg?
6 votes

You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...

View answer
x64dbg (x32dbg) log registers every step like windbg
5 votes

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this ...

View answer
OllyDbg: How to set a conditional breakpoint for a value anywhere in the stack?
5 votes

Not for Ollydbg, but I wrote a plugin called StackContains for x64dbg that allows you to check if a value is present in the check during conditional tracing. This allows you to break as soon as the ...

View answer
x64dbg - see the current position?
4 votes

From your screenshot I understand that you want to break on. You can do this by breaking on the debug string event. Use the following setting: If you want to pause the execution, simply click the “...

View answer
Wrong RVA values inside IMAGE_IMPORT_DESCRIPTOR
4 votes

Unless you are loading a mapped PE file in your vector, you have to convert all RVAs to file offsets. The pseodocode looks something like this: func rva2offset(pe, rva): for section in pe....

View answer
Forcefully interpret code in x64dbg
Accepted answer
4 votes

You are encountering the issue of backwards disassembly. When you give x64dbg an address to disassemble at it will start decoding at exactly this address, go to the next instruction, etc. For example ...

View answer
How to copy binary file with x64dbg\x32dbg after it changed it self
Accepted answer
4 votes

It sounds like you want to dump the executable. You can use Scylla (which is built into x64dbg) to dump and restore the executable. You can find Scylla in Plugins -> Scylla

View answer
How to unpack kkrunchy executables?
Accepted answer
4 votes

For my unpacking session I'm using x64dbg and I will unpack the executable in kkrunchy_023a2.zip. Get to the entry point and enable trace record. Also bind the Trace into beyond trace record option ...

View answer
OllyDbg 2: Providing label arguments?
Accepted answer
4 votes

Since the original LabelArgs plugin was open source, I ported it to OllyDbg 2. It should have the same functionality as the original LabelArgs plugin, feel free to improve on it. Link to the ...

View answer
Run any line/command in x64dbg
Accepted answer
3 votes

You can use the Set New Origin Here option in the context menu of the disassembly view to change EIP/RIP to the selected line: In x64dbg commands this option can be expressed as: cip = dis.sel().

View answer
Outputting a patched DLL from x64dbg
3 votes

You get the “x/y patches applied” message when you try to patch at a virtual address that has no file offset associated with it. Generally this happens if you add code at the end of a section. In ...

View answer
Are there any OllyDbg anti-debug/anti-anti-debug plugins what work with Windows 7 / NT 6.x?
3 votes

You could try TitanHide. It is a kernel-mode hiding driver for both x86 and x64 OSses. It has the following features: - ProcessDebugFlags (NtQueryInformationProcess) - ProcessDebugPort (...

View answer
Recovering original PE sections after Themida merges them
Accepted answer
3 votes

Basically the best way to start doing this is to compile your own EXE (with the same compiler as the Themida protected file when possible) and try to merge the sections by yourself. I crafted an ...

View answer
Is it possible to view and modify process memory without attaching the debugger in x64dbg?
Accepted answer
2 votes

Yes, this is possible. You can replace TitanEngine.dll with https://github.com/mrexodia/StaticEngine and “attach” to a running process. There is however no way to switch debugging modes and ...

View answer
Print opcodes in trace - x64dbg
Accepted answer
2 votes

You can use {mem;dis.len(cip)@cip}. See http://help.x64dbg.com/en/latest/introduction/Formatting.html for the relevant documentation.

View answer
Missing kernel32.dll in import table
Accepted answer
2 votes

If you are not using any APIs from kernel32 it will not be added to the import table, simple as that. You were misinformed about kernel32 being required for all applications. It is even possible to ...

View answer
How can I define a struct in x64/x32Dbg?
2 votes

Right now it is not possible to label instructions in the disassembly as structure members. It is however possible to define structs and visit them in memory (similar to 010 editor). The main sources ...

View answer
What are all those instructions before the initally selected instruction in OllyDbg?
Accepted answer
2 votes

Probably you are talking about the "system breakpoint". This is the location that the OS uses to break so the debugger can do its work. In x64dbg you can get more information by loading symbols for ...

View answer
What syntax does OllyDbg follow in its dissassembly window?
Accepted answer
2 votes

OllyDbg uses the MASM/Intel syntax for disassembly. You can get the basic documentation at http://www.cs.virginia.edu/~evans/cs216/guides/x86.html. The Intel developer manuals can give you more detail ...

View answer
x64dbgpy: application unresponsive when trying to automate inside breakpoint callback
Accepted answer
1 votes

Currently it is not supported to do debug automation in callbacks. This is related to the threading model and is further explained at https://x64dbg.com/blog/2016/10/20/threading-model.html, which ...

View answer
What's ScyllaHide's PDBReaderx64.exe Doing?
1 votes

This is an application that used to be part of ScyllaHide. It was responsible for finding addresses of undocumented (and unexported) functions in ntdll by downloading the Microsoft symbols and finding ...

View answer
x64dbg "System" meaning
Accepted answer
1 votes

It simply means that the location of the module is inside a “system” directory (c:\windows). For example kernel32.dll is a system module and your debuggee is usually a user module.

View answer
x64Dbg view jumps to selected command
1 votes

To do this in x64dbg you can use the side bar on the left, which shows jump paths that are within the current view. You can also run the command “xanalyze” to do xref analysis, which will then show ...

View answer
Immunity debugger anti anti debug
Accepted answer
1 votes

You can try ScyllaHide. There is no plugin for Immunity Debugger, but there is one for OllyDbg and that should make it trivial to port. Alternatively you can see this answer on how to hide any process ...

View answer