Jump to content
View in the app

A better way to browse. Learn more.

Tuts 4 You

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Feature suggestions

Featured Replies

  • Author

@sstrato: Maybe they are never hit?


 


Thanks for the string references report. I will look into it :)


  • Replies 180
  • Views 60.4k
  • Created
  • Last Reply

Top Posters In This Topic

Most Popular Posts

  • What about a function like collapse when RSP point to a system call? I have made a sample to make it clear. I think that can be one of the cleanest solution without wrongly show in the stack the

  • Not sure if these have been requested:   1. Ability to sort the symbols (exports) by name 2. Ability to search for binary strings 3. Ability to set a memory breakpoint in the memory map window 4.

  • Possibillity to write/edit script in script tab would be great.

Posted Images

(Call Stack) is not working. :sad2:


  • Author

@sstrato: the string bug was fixed... i will check the other bugs soon.


HI


it is desirable to make available the option to disable the log


 


because when a long job script problems

  • Author

@av999: sure, but do you have an example for this? I think it makes more sense to fix the log option instead of disabling it :)


I mean disable the system log when it is needed


  • Author

Yes I understand, but why would you want to disable the log exactly?

time is a pity


The Call Stack window displays nothing.


@Mr. eXoDia: hi, can you explain how to find pattern in memory? I mean, not only in a one  section, but all together, like in ollydbg.


  • Author

@Siarogak: Currently not implemented. Check here to track progress of the issue: https://github.com/x64dbg/x64dbg/issues/112

@Mr. eXoDia: when I start application I can Change Command line, for example,  program.exe -debug, but when I click button Restart, command line became  program.exe. Is it possible to save Command Line "program.exe -debug" even after debugger restarts?


  • 2 weeks later...
  • 2 months later...

Do you have plans to implement trace module? 

How to create a script for trace running process between two instructions address?

 

  • 1 month later...

stack search maybe?
improved HEX Dump search, sometimes i know it has to be in the dump, but i cant find it, a hex dump search would really help me.

  • Author

@Artic The hex dump search is fully implemented. Just hit ctrl+b and search away. Stack search is a good idea. I will try to implement that later.

On 1/12/2016 at 1:09 PM, Mr. eXoDia said:

@Artic The hex dump search is fully implemented. Just hit ctrl+b and search away. Stack search is a good idea. I will try to implement that later.

awsome, i always forget about how to hex search and thats its there.
another idea, is to maybe list all comments you done in the CPU window (the disasm window).

an option to maybe turn of searching in the other modules, as i always know that it has to be in that module.

  • Author

You can list all comments by clicking the appropriate icon in the top menu bar. For now it is not possible to restrict your search to one module, but you can sort by address so you can kind of do that already. I will add the module name in there so you can sort by module.

Searching (hex search) only searches in the page you are in. If you want to search all memory use ctrl+b in the memory map.

  • 2 weeks later...

I know you have this on TODO, but here's a friendly reminder :D

Stack Window with Parameters shown like in Olly:

DM3RcHN.png

Would be lovely!

Edited by 0xNOP

  • Author

@0xNOP: I have been thinking about how to do that for quite some time now, but do you have an idea how to do this on x64 (where the arguments are mostly passed through registers)? CreateProcessW on x64 would look something like:

   [rsp] call to CreateProcessW from X
   (rcx) ModuleFileName = X
   (rdx) CommandLine = X
    (r8) pProcessSecurity = X
    (r9) pThreadSecurity = X
 [rsp+8] InheritHandles = X
[rsp+10] CreationFlags = X
[rsp+18] pEnvironment = X
[rsp+20] CurrentDir = X
[rsp+28] pStartupInfo = X
[rsp+30] pProcessInfo = X

However, I'm against placing them on the stack (because they are not actually on the stack). Do you have an idea what to do with this?

Why it cannot be same as in Olly, since they're not on stack, last column in dissasembly window would not be fine ?

Edited by JustAGuy

  • Author

@JustAGuy Listing the 4 arguments as a comment in the disassembly windows wouldn't work for me...

  • 3 weeks later...

Since the last snapshot error in search memory map.

Before snapshot_2016-02-16_10-56.

snapshot_2016-02-16_10-56.png.b7ee926e60

After snapshot_2016-02-19_04-54.

snapshot_2016-02-19_04-54.png.025412312b

 

Edited by sstrato

Create an account or sign in to comment

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.