Jump to content
Tuts 4 You
mrexodia

x64dbg

Recommended Posts

BHA

@Kurapica - The dialog opens for me just find, but no matter what application I patch it is always corrupt.

Share this post


Link to post
Share on other sites
BHA

@mrexodia - I'll check that differ out mate thanks. All I changed was x2 jne's to jmp's.

Share this post


Link to post
Share on other sites
JustAGuy

I have a few questions.

1. Why when I want dump memory to file x64dbg forces me to give the file name an extension, is it necessary?

2. Is it possible to see "all" the characters in dump view window, like in olly ? Majority of them are represented now just as dots in x64dbg

3. Is it possible to see in breakpoint tab the instruction to which breakpoint is set?

4. What happened to blog , last update was in december.

 

Edited by JustAGuy (see edit history)

Share this post


Link to post
Share on other sites
mrexodia

1. Yes.

2. Yes, select the right code page.

3. No, you can see it in the edit dialog.

4. Have been super busy recently, I will try to start updating it again soon.

If you have any feature requests or bug reports, please create individual issues at http://issues.x64dbg.com

Share this post


Link to post
Share on other sites
JustAGuy

regarding the code page

Changing codepage makes the right side of characters unaligned , I did not go thru all the codepages, there is dozens of them, but none of them(so far) except predefined 'ascii' and 'extended ascii'  aligns right side even if I pick same font as olly has. It's possible to have right side nicely aligned and at the same time have all the ASCII characters displayed? 

Noname.bmp

Share this post


Link to post
Share on other sites
Dinokavengeer

I want to change byte on memory address with x64dbg - Win10 x64

like this code

mov al,0x90

mov [address],al

and nothig happend

This code not execution? 

Some help how to write with x64dng on memory arddress? I want to iject code,why file do not wont execute if I change some code!

/plugin illuminate cloud/

 

 

  • Like 1

Share this post


Link to post
Share on other sites
mrexodia

It's not clear to me where exactly you wrote this code @Dinokavengeer

In the command bar:

byte:[address]=0x90

Should work...

Share this post


Link to post
Share on other sites
Dinokavengeer

sorry for my bad english...

I want to iject some code (must only 3 byte) on file TurboActivate.dll when execution (file winpty.dll function free) code . I understand that is not x32 system to iject (not very hard) on memory code. Yes, when I click on byte and use function on windows Binary edit - everything is OK.     I write (patch ) TurboActivate file and.... when load to execute file do not want to work (Thish is java code..load virtual mashine and perhaps check file in jar file first ) 

I want like with x64dbg when file load ,  check with getprocaddress where are address on function and know [address] ,byte which must be written. But there only  -- mov [address],al do not work---- I see thath  x64dbg on function bynary edit

call qt5core.dll->x64gui.dll->call <QbyteArray::begin>

                                                call ds:<Sleep> Window return rax=address writen byte

                                                call x64dbg.memcpy 

                                                call mscrt120.dll

and write on memory to be execute progrmam code

Untitled.jpg.2141c0e75fcef78541f370bc36fe2bd0.jpg 

I want when execute program on line to change byte ....on section code with assembler rule of course (on picture do no folow rule it is only for test)

 

Edited by Dinokavengeer (see edit history)

Share this post


Link to post
Share on other sites
Dinokavengeer

I thing I can write like program x64dbg in memory. I found function on x64dbg.dll Know is OK!

/Of course x64dbg is the best/

Share this post


Link to post
Share on other sites
evlncrn8

and how did you set the eip (rip for x64) to your injected code? (which also needs some way to jump back by the way

i dont think you really know what you're doing ..

and as for patching the file and it not loading - it most likely is checksummed or checked by the program

Edited by evlncrn8 (see edit history)

Share this post


Link to post
Share on other sites
Dinokavengeer

it easy (You can import any function with cff explorer to any file /exe or dll/ ) - first - getmodulehandle return address dll file in memory and getprocaddress return address function which you want change byte. Call x64dbg.dll on correct address and correct parameter /address, byte and value byte/ to change memory address with byte which you want! That work! /yes you must with cff explorer import some dll from x64dbg project /Yes checked summ or another parameter in jawa process file happened and i do not want to change this dll/

Share this post


Link to post
Share on other sites
mrexodia

I don't understand what's happening here. Can I helper with something @Dinokavengeer?

Share this post


Link to post
Share on other sites
Dinokavengeer

@mrexodia I shift for myself. Code and program x64dbg learn well!  10x!

   

Share this post


Link to post
Share on other sites
sstrato

Starting from the next snapshot at 3779, the data is displayed incorrectly.

snapshot 3779.

3779.png.194aa5a7a72235770ebdb9b81505c8fc.png

snapshot 3794.

3794.png.2c60d6aed2f3bae1811b1cac6820601d.png

Share this post


Link to post
Share on other sites
mrexodia

@sstrato Thanks, I found where the issue is and a fix will be out soon.

  • Like 2

Share this post


Link to post
Share on other sites
Olfert

Thank you for a great job. keep going on. x64 is the best. B) :rolleyes::D

 

Share this post


Link to post
Share on other sites
Mad Max
On 13.10.2017 at 8:35 PM, sstrato said:

Starting from the next snapshot at 3779, the data is displayed incorrectly.

snapshot 3779.

3779.png.194aa5a7a72235770ebdb9b81505c8fc.png

snapshot 3794.

3794.png.2c60d6aed2f3bae1811b1cac6820601d.png

 

Is this a plugin in your Screen with the Tools??

Mercy.

Share this post


Link to post
Share on other sites
LCF-AT

Hi,

I was playing a little with the x32dbg to check out the GUI / settings and handling etc and I have 2 questions.

1.) Is there no PE Header view?

2.) Why is the disassemly button in dump window disabled to show dump window also in disassembly style?No such view in dump window?

greetz

Share this post


Link to post
Share on other sites
JustAGuy

How can I increase 'Find Pattern' search limit , it is set to 5000.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×