Jump to content
Tuts 4 You
Sign in to follow this  
samoray

I need some explanation for X32dbg -SEH- & -Watch-

Recommended Posts

samoray

Dear members,

my question is about the use of X64dbg (32 or 64 bit any of them)

1- Can anyone, please help me understand the concept behind SEH (structured exception handler) and whether we can use it to reverse an application?

2- and how to use the "watch" feature in x32dbg, I tried it in many ways without prevail...

A video tut would be very much appreciated.

 

  • Like 1

Share this post


Link to post
Nemo

Try googling took me less than a second to find this out.. don't be lazy.. i only googled "structured exception handler" and found plenty of info..

Share this post


Link to post
samoray

Thanks for your reply , 

I searched many times and read many papers but my question is limited to using SEH in reversing applications . 

Share this post


Link to post
kao

Googling gives lots of useful resources for that one too: https://www.google.com/search?q=SEH+reversing

Perhaps you should ask a more specific question, not just "Can I use chip tuning to make my car go faster? My question is limited to petrol engines." :)

 

  • Like 3

Share this post


Link to post
samoray
3 hours ago, kao said:

Googling gives lots of useful resources for that one too: https://www.google.com/search?q=SEH+reversing

Perhaps you should ask a more specific question, not just "Can I use chip tuning to make my car go faster? My question is limited to petrol engines." :)

 

:lol::lol:, "kao" you're very funny.

thank you for passing by, let me google little more and post my question more specifically.

anyway can give me any hints for my second question?

Share this post


Link to post
mrexodia

The watch view allows you to watch changes to the value of an expression. See http://help.x64dbg.com

As an example you can set a watch on [402030] and it will watch the dword at 402030 you also have a watchdog feature that will log changes to the expression. Usage should be pretty easy, just add the expression you want to watch and enable the watchdog. Combined with tracing you can see various values in memory and how they change during the trace.

As for SEH (not enabled in 64 bit because that uses static SEH) you can see the current exception handler value. You can also see this in the stack this is for example used with try/catch in C/C++

Edited by mrexodia (see edit history)
  • Like 3

Share this post


Link to post
abhi93696

@samoray u can also use the manual available in x64 debugger-: "x64dbg_manual.chm"

     for full details see "watch control" in "commands".

  • Like 2

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
×
×
  • Create New...