Jump to content
Tuts 4 You

Feature suggestions


Recommended Posts

On 31/1/2016 at 7:12 AM, Mr. eXoDia said:

I have been thinking about how to do that for quite some time now, but do you have an idea how to do this on x64 (where the arguments are mostly passed through registers)? 

What about a function like collapse when RSP point to a system call?

I have made a sample to make it clear. I think that can be one of the cleanest solution without wrongly show in the stack the first four parameters...


Hope you will like it :)


  • Like 3
Link to post
  • 3 weeks later...
  • Replies 180
  • Created
  • Last Reply

Top Posters In This Topic

  • mrexodia


  • sstrato


  • Artic


  • Hypnz


Top Posters In This Topic

Popular Posts

What about a function like collapse when RSP point to a system call? I have made a sample to make it clear. I think that can be one of the cleanest solution without wrongly show in the stack the

Search constant in the CPU window does not work. Possible solution change order of parameters in line CPUDisassembly.cpp: original: DbgCmdExec(QString("findref %1, %2, 0, %3").arg(addrT

Yea, there are problems with when you try to follow an address that is too far at the end, it will not display so I decided to solve it like this until I properly fix it.   Always use the late

Posted Images

  • 3 weeks later...

two suggestions:

Registers window -> copy all registers value to clipboard. (OllyDbg Feature)

Stack /Dump window ->  select addr 003EFE74 - 003EFEA4 . Right mouse menu -Copy - To Clipboard (OllyDbg Feature)

Link to post
  • 1 month later...

String in references to press F2 to enter a breakpoint could jump to the next line, as in olly.
It would be a way to introduce faster interruption point in a selection.

Link to post

@sstrato I removed that feature because it annoyed the shit out of me :D Might be a good idea to add an option for this though...

  • Like 1
Link to post
  • 2 months later...


With Olly when making a call to an API, on the stack Olly "translates" the arguments and saves you referring to MSDN. Is it possible to do the same with x64dbg?

Is it possible to add icons to the shortcut bar (not sure if this is correct description). Where restart / stop / go etc.


Link to post

@sstrato I tried on witcher3.exe (43mb with about 150k functions) this is the log (and no hang/crash):

INT3 breakpoint "entry breakpoint" at <witcher3.EntryPoint> ( 00007FF72EECA7B8 )!
Starting analysis...
Basic block starts in 9438ms!
0 functions from the exception directory...
1086925 basic blocks, 49649 function starts detected...
Basic blocks in 13015ms!
738030/1086925 delayed blocks...
312227/738030 delayed blocks resolved (425803/1086925 still left, probably unreferenced functions)
425803/1086925 unreferenced blocks
151649 functions found!
Functions in 1844ms!
Function ranges in 109ms!
Analysis finished!
141931 function(s) listed

Could you show me your log?

Link to post
4 hours ago, sstrato said:

Well, not what else to say, I send the minidump if it helps.


It says:

000007fe`ef2aef95 80781900        cmp     byte ptr [rax+19h],0

This appears to be in capstone_gui.cpp:199 which has something to do with an std::map. The only thing I can imagine is some multi-threading gone wrong so I removed the entire map and replaced it with an array.

EDIT: I also encountered the crash randomly now and the removal of the map should solve it. New snapshot should be available soon, thanks!

Edited by Mr. eXoDia (see edit history)
Link to post

@Mr. eXoDia At last snapshot i'm trying to debug a app at win 8.1 native not VM. I set my bp's the app breaks but the main window doesn't show the location of the break. Just the the main screen when the app loaded.

Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Create New...