Jump to content
Tuts 4 You
Sign in to follow this  
mrexodia

Feature suggestions

Recommended Posts

crystalboy
On 31/1/2016 at 7:12 AM, Mr. eXoDia said:

I have been thinking about how to do that for quite some time now, but do you have an idea how to do this on x64 (where the arguments are mostly passed through registers)? 

What about a function like collapse when RSP point to a system call?

I have made a sample to make it clear. I think that can be one of the cleanest solution without wrongly show in the stack the first four parameters...

x64dbg_call_parameters.png

Hope you will like it :)

crystalboy

  • Like 3

Share this post


Link to post
sstrato

In the last (snapshot_2016-03-05_10-48.7z) breakpoints DLLs do not work.

Edited by sstrato (see edit history)

Share this post


Link to post
White

two suggestions:

Registers window -> copy all registers value to clipboard. (OllyDbg Feature)

Stack /Dump window ->  select addr 003EFE74 - 003EFEA4 . Right mouse menu -Copy - To Clipboard (OllyDbg Feature)

Share this post


Link to post
Hypnz

Suggestion: When u make a search for a constant for example, to put a bp at all references.

Share this post


Link to post
Hypnz

Thanks a lot mate for your efforts!!

Share this post


Link to post
sstrato

String in references to press F2 to enter a breakpoint could jump to the next line, as in olly.
It would be a way to introduce faster interruption point in a selection.

Share this post


Link to post
mrexodia

@sstrato I removed that feature because it annoyed the shit out of me :D Might be a good idea to add an option for this though...

  • Like 1

Share this post


Link to post
REAP

Hello

With Olly when making a call to an API, on the stack Olly "translates" the arguments and saves you referring to MSDN. Is it possible to do the same with x64dbg?

Is it possible to add icons to the shortcut bar (not sure if this is correct description). Where restart / stop / go etc.

Thanks

Share this post


Link to post
mrexodia

No and no :)

Share this post


Link to post
mrexodia

@sstrato I tried on witcher3.exe (43mb with about 150k functions) this is the log (and no hang/crash):

INT3 breakpoint "entry breakpoint" at <witcher3.EntryPoint> ( 00007FF72EECA7B8 )!
Starting analysis...
Basic block starts in 9438ms!
0 functions from the exception directory...
1086925 basic blocks, 49649 function starts detected...
Basic blocks in 13015ms!
738030/1086925 delayed blocks...
312227/738030 delayed blocks resolved (425803/1086925 still left, probably unreferenced functions)
425803/1086925 unreferenced blocks
151649 functions found!
Functions in 1844ms!
Function ranges in 109ms!
Analysis finished!
141931 function(s) listed

Could you show me your log?

Share this post


Link to post
mrexodia

Hm just tried, also works fine with the View -> Functions menu.

Share this post


Link to post
mrexodia
4 hours ago, sstrato said:

Well, not what else to say, I send the minidump if it helps.

dump-28082016_1407130971.dmp

It says:

x64gui+3ef95
000007fe`ef2aef95 80781900        cmp     byte ptr [rax+19h],0

This appears to be in capstone_gui.cpp:199 which has something to do with an std::map. The only thing I can imagine is some multi-threading gone wrong so I removed the entire map and replaced it with an array.

EDIT: I also encountered the crash randomly now and the removal of the map should solve it. New snapshot should be available soon, thanks!

Edited by Mr. eXoDia (see edit history)

Share this post


Link to post
sstrato

Works fine now, thanks.:D

Share this post


Link to post
Hypnz

@Mr. eXoDia At last snapshot i'm trying to debug a app at win 8.1 native not VM. I set my bp's the app breaks but the main window doesn't show the location of the break. Just the the main screen when the app loaded.

Share this post


Link to post
mrexodia

@Hypnz Could you provide a detailed guide on how to reproduce this?

Share this post


Link to post
Hypnz

@Mr. eXoDia Just load the app to the debugger. Put your breakpoints and run, should see the debugger breaks but main window doesn't go there. Neither responds if u double click to RIP.

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...