Quote

 

 gru 13 2017 14:02
<Raichiman> Hi is there a create backup(from olly) functionality in x64dbg where it would highlight byte changes. I tried tinkering with the setting but it only highlights bytes modified by the user.

gru 13 2017 14:09
<mrexodia> there is no such feature at present

 

Hello, has something changed during past 4 years? In Olly a was using this feature often and now I am looking something similar in x64/x32dbg

Ok nevermind I have written my own plugin for x64dbg

Do you mind sharing it?

From context menu choose CreateBackup then "Make Snapshot" and run program then to see differences choose "Compare Snapshot". Before make new snaphot choose "Clear Snapshot" for cleaning changes that plugin made. For bigger targets and with many changes can be plugin laggy.

CreateBackup.dp64

On 12/14/2021 at 8:56 PM, Priboi said:

From context menu choose CreateBackup then "Make Snapshot" and run program then to see differences choose "Compare Snapshot". Before make new snaphot choose "Clear Snapshot" for cleaning changes that plugin made. For bigger targets and with many changes can be plugin laggy.

CreateBackup.dp64 21 kB · 5 downloads

Hello, can you share a 32 bit version of this plugin, thank you.

On 1/23/2022 at 12:22 PM, Darth Blue said:

Hello, can you share a 32 bit version of this plugin, thank you.

 

CreateBackup plugin for x64dbg and x32dbg by Priboi.rar

Does these plugins still work?

Regards.

sean.

Edited April 17, 20241 yr by Sean Park - Lovejoy

what have you tried

what errors (if any) you've encountered?

this forum is not chatGPT
 

On 12/15/2021 at 2:56 AM, Priboi said:

From context menu choose CreateBackup then "Make Snapshot" and run program then to see differences choose "Compare Snapshot". Before make new snaphot choose "Clear Snapshot" for cleaning changes that plugin made. For bigger targets and with many changes can be plugin laggy.

CreateBackup.dp64 21 kB · 550 downloads

Where can I see the differences when choosing "Compare Snapshot"?

I clicked the menu of "Make Snapshot" before changing anything.

Then as @Priboi said, started an application. after it, I changed some bytes. then clicked the "Compare Snapshot" menu. however I cannot notice anything to show the differences in the disassembly pane of the x64dbg.

Thanks.

Regards.

sean.

Edited April 18, 20241 yr by Sean Park - Lovejoy

You dont have to do changes on yourself its not the purpose of this plugin because you know what you have changed. The code/data should be changed by program itself.

3 hours ago, Priboi said:

You dont have to do changes on yourself its not the purpose of this plugin because you know what you have changed. The code/data should be changed by program itself.

@Priboi when does the code/data change by your plugin?

I did not use the feature of the ollydbg, also I did not know it is. Now I check it out in ollydbg. It is a good feature.

In ollydbg, If I create backup, then I change some codes. by using view backup, I can view the backed up data. after it, again If I click view actual data, I can view the current modified code/data.

But with your plugin, what should I do to check what is the backed up code/data and what is the current modified or actual code/data?

Many thanks in advance.

Regards.

sean.

1 hour ago, Sean Park - Lovejoy said:

The code/data should be changed by program itself.

I said program not plugin. Debugged program makes changes in code/data for example while unpacking and you are able to see where these changes are when using my plugin.

14 minutes ago, Priboi said:

I said program not plugin. Debugged program makes changes in code/data for example while unpacking and you are able to see where these changes are when using my plugin.

@Priboi Many thanks for the video presentation.

Now I get it.

Your plugin would be helpful.

Regards.

sean.