Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Repo info
Activity
  • 13:02
    mrexodia closed #2950
  • 13:02
    mrexodia commented #2950
  • 11:35
    i2a35oy0x6 commented #2950
  • 11:33
    i2a35oy0x6 commented #2950
  • 11:16
    mrexodia commented #2950
  • 10:36
    i2a35oy0x6 labeled #2950
  • 10:36
    i2a35oy0x6 opened #2950
  • 03:20
    a627414850 commented #2945
  • Oct 06 23:59
    ax1ne opened #2949
  • Oct 06 23:59
    ax1ne labeled #2949
  • Oct 06 23:05
    pmeerw labeled #2948
  • Oct 06 23:05
    pmeerw opened #2948
  • Oct 06 22:56
    pmeerw commented #2252
  • Oct 06 22:52
    pmeerw commented #2355
  • Oct 06 22:34
    pmeerw commented #2782
  • Oct 06 22:33
    pmeerw commented #2782
  • Oct 06 17:26
    not6 commented #2947
  • Oct 06 16:20
    mrexodia commented #2947
  • Oct 06 16:10
    not6 commented #2947
  • Oct 06 15:54
    mrexodia commented #2947
x64dbgbot
@x64dbgbot
<Atn> What are u trying to do ?
<SunBeam> to call that function with args passed in eax and esi registers
<SunBeam> the default behavior I get in MSVS is pushing to stack
<Atn> Inside the debugger !
<SunBeam> no, in visual studio πŸ˜„
<Atn> Lol
<SunBeam> so that the compiled code ends-up passing them in eax and esi
<SunBeam> don't think I can without a wrapper 😦
<Atn> Yah I think so too
x64dbgbot
@x64dbgbot
<Atn> Or inject a dll and set BP or hwpb depending on the checks ,stop at the call and change the address with what u need
<Atn> Of course dll will handle the exception handler
<Atn> Use AddVectoredExceptionHandler
x64dbgbot
@x64dbgbot
<SunBeam> solved it
<SunBeam> πŸ˜„

<SunBeam> ```
extern "C"
{
DWORD stdcall _GetFullName( class UObject const , char buffer );
DWORD UObject
GetFullName = NULL; // retrieved from a FindPattern
wchar_t szNull[] = L"None";
}

..
..

    char szOutBuffer[3 * sizeof(int)] = { 0 };
    fprintf( Log, "[%08i] %08X %S\n", i, UObject::GObjObjects()->Data[i], _GetFullName( UObject::GObjObjects()->Data[i], szOutBuffer ) );

..
..

.486
.model flat, stdcall
option casemap: none

PUBLIC _GetFullName
EXTERN szNull: dword
EXTERN UObject__GetFullName: dword

.data

.code

_GetFullName PROC uses esi a:dword, b:dword

mov eax,b
mov esi,a
call [UObject__GetFullName]
cmp dword ptr [eax+4],0
je short _L1
  mov eax,dword ptr [eax]
  jmp short _L2
_L1:
  mov eax,szNull
_L2:
ret

_GetFullName ENDP

align 10h

END
```

<SunBeam> and a quick dump
<SunBeam> << again, if super off-topic, I'll clean-up the above >>
x64dbgbot
@x64dbgbot

<thewh1teagle> Idk if it's offtopic but maybe someone can help
I found this x64dbg script

https://github.com/x64dbg/Scripts/blob/master/VMProtect%20v3.x.x%20OEP%20Finder.txt

It works and disable vmprotect completly
I want somehow patch the PE so I will get binary without vmprotect
Is that possible?

ektwr
@ektwr
Hi all. I have 2 files. One is the original and the second is the same protected with themida ver.2. Is it possible to dump the second one by attaching it to X64dbg 32bit when it is fully working and do a comparison with the first one? Can i use the OEP from second file to dump the first? TIA
x64dbgbot
@x64dbgbot
<mrexodia> Just try it (re @ektwr: Hi all. I have 2 files. One is the original and the second is the same protected with themida ver.2. Is it possible to dump the second one by attaching it to X64dbg 32bit when it is fully working and do a comparison with the first one? Can i use the OEP from second file to dump the first? TIA)
ektwr
@ektwr
Is it possible to select only hex opcodes and copy them to clipboard? Any chance to see that in future release?
x64dbgbot
@x64dbgbot
<mrfearless> Right click->Binary-Copy (re @ektwr: Is it possible to select only hex opcodes and copy them to clipboard? Any chance to see that in future release?)
ektwr
@ektwr
I did that but i want to select only hex opcodes for hex comparison with program hexworkshop. I know it's difficult but just asked.
x64dbgbot
@x64dbgbot
<mrfearless>
<mrfearless> result in clipboard is E8 57 D7 00 00
<mrfearless> which is the hex opcodes
ektwr
@ektwr
Exactly what i want. How you did that?
I mean if its possible to select 3 or more lines and do copy only the hex opcodes.
x64dbgbot
@x64dbgbot
<mrfearless>
<T4rr4g4> Hi group!, you know how to "restart" from a script.
x64dbgbot
@x64dbgbot
<antipatico> hi everybody, I am trying to animate tracing only inside user-modules using the Tracing => Animate command
<antipatico> I'm trying by using the command ticnd (mod.party(dis.branchdest(cip)) == 0) but without success, the step into is always executed, no matter the result of the condition
x64dbgbot
@x64dbgbot
<Atn> Use script
x64dbgbot
@x64dbgbot
<antipatico> could you explain further
x64dbgbot
@x64dbgbot
<mrexodia> The condition is the stop condition (re @antipatico: I'm trying by using the command ticnd (mod.party(dis.branchdest(cip)) == 0) but without success, the step into is always executed, no matter the result of the condition)
<mrexodia> So it will stop when the condition is true
<mrexodia> Try evaluating it on the command line
<mrexodia> To see if it does what you expect
x64dbgbot
@x64dbgbot
<antipatico> Okay thanks, is using ticnd okay in animate command?
x64dbgbot
@x64dbgbot
<mrexodia> No
<mrexodia> The animate command has no purpose in my opinion
<mrexodia> It’s just to hold f7 without holding the button
x64dbgbot
@x64dbgbot
<antipatico> ok, thanks for the clarification
x64dbgbot
@x64dbgbot
<Atn> I meant make script with loop step over or in depending on the condition u want
<Atn> Set begin and end address
<Atn> And log what u want
<Atn> U can build ur own log
<Atn> With the details u want