x64dbg/x64dbg

An open-source x64/x32 debugger for windows.

x64dbgbot

@x64dbgbot

<Atn> What are u trying to do ?

<SunBeam> to call that function with args passed in eax and esi registers

<SunBeam> the default behavior I get in MSVS is pushing to stack

<Atn> Inside the debugger !

<SunBeam> no, in visual studio 😄

<Atn> Lol

<SunBeam> so that the compiled code ends-up passing them in eax and esi

<SunBeam>
https://cdn.discordapp.com/attachments/360907625837101067/1027252857767993444/unknown.png

<SunBeam> don't think I can without a wrapper 😦

<Atn> Yah I think so too

x64dbgbot

@x64dbgbot

<Atn> Or inject a dll and set BP or hwpb depending on the checks ,stop at the call and change the address with what u need

<Atn> Of course dll will handle the exception handler

<Atn> Use AddVectoredExceptionHandler

x64dbgbot

@x64dbgbot

<SunBeam> solved it

<SunBeam> 😄

<SunBeam> ```
extern "C"
{
DWORD stdcall _GetFullName( class UObject const , char buffer );
DWORD UObjectGetFullName = NULL; // retrieved from a FindPattern
wchar_t szNull[] = L"None";
}

..
..

    char szOutBuffer[3 * sizeof(int)] = { 0 };
    fprintf( Log, "[%08i] %08X %S\n", i, UObject::GObjObjects()->Data[i], _GetFullName( UObject::GObjObjects()->Data[i], szOutBuffer ) );

..
..

.486
.model flat, stdcall
option casemap: none

PUBLIC _GetFullName
EXTERN szNull: dword
EXTERN UObject__GetFullName: dword

.data

.code

_GetFullName PROC uses esi a:dword, b:dword

mov eax,b
mov esi,a
call [UObject__GetFullName]
cmp dword ptr [eax+4],0
je short _L1
  mov eax,dword ptr [eax]
  jmp short _L2
_L1:
  mov eax,szNull
_L2:
ret

_GetFullName ENDP

align 10h

END
```

<SunBeam>
https://cdn.discordapp.com/attachments/360907625837101067/1027262740059934790/ObjectsDump.txt

<SunBeam> and a quick dump

x64dbgbot

@x64dbgbot

<thewh1teagle> Idk if it's offtopic but maybe someone can help
I found this x64dbg script

https://github.com/x64dbg/Scripts/blob/master/VMProtect%20v3.x.x%20OEP%20Finder.txt

It works and disable vmprotect completly
I want somehow patch the PE so I will get binary without vmprotect
Is that possible?

ektwr

@ektwr

Hi all. I have 2 files. One is the original and the second is the same protected with themida ver.2. Is it possible to dump the second one by attaching it to X64dbg 32bit when it is fully working and do a comparison with the first one? Can i use the OEP from second file to dump the first? TIA

x64dbgbot

@x64dbgbot

<mrexodia> Just try it (re @ektwr: Hi all. I have 2 files. One is the original and the second is the same protected with themida ver.2. Is it possible to dump the second one by attaching it to X64dbg 32bit when it is fully working and do a comparison with the first one? Can i use the OEP from second file to dump the first? TIA)

ektwr

@ektwr

Is it possible to select only hex opcodes and copy them to clipboard? Any chance to see that in future release?

x64dbgbot

@x64dbgbot

<mrfearless> Right click->Binary-Copy (re @ektwr: Is it possible to select only hex opcodes and copy them to clipboard? Any chance to see that in future release?)

ektwr

@ektwr

I did that but i want to select only hex opcodes for hex comparison with program hexworkshop. I know it's difficult but just asked.

x64dbgbot

@x64dbgbot

<mrfearless> result in clipboard is E8 57 D7 00 00

<mrfearless> which is the hex opcodes

ektwr

@ektwr

Exactly what i want. How you did that?

I mean if its possible to select 3 or more lines and do copy only the hex opcodes.

x64dbgbot

@x64dbgbot

<T4rr4g4> Hi group!, you know how to "restart" from a script.

x64dbgbot

@x64dbgbot

<antipatico> hi everybody, I am trying to animate tracing only inside user-modules using the Tracing => Animate command

<antipatico> I'm trying by using the command ticnd (mod.party(dis.branchdest(cip)) == 0) but without success, the step into is always executed, no matter the result of the condition

x64dbgbot

@x64dbgbot

<Atn> Use script

x64dbgbot

@x64dbgbot

<antipatico> could you explain further

x64dbgbot

@x64dbgbot

<mrexodia> The condition is the stop condition (re @antipatico: I'm trying by using the command ticnd (mod.party(dis.branchdest(cip)) == 0) but without success, the step into is always executed, no matter the result of the condition)

<mrexodia> So it will stop when the condition is true

<mrexodia> Try evaluating it on the command line

<mrexodia> To see if it does what you expect

x64dbgbot

@x64dbgbot

<antipatico> Okay thanks, is using ticnd okay in animate command?

x64dbgbot

@x64dbgbot

<mrexodia> No

<mrexodia> The animate command has no purpose in my opinion

<mrexodia> It’s just to hold f7 without holding the button

x64dbgbot

@x64dbgbot

<antipatico> ok, thanks for the clarification

x64dbgbot

@x64dbgbot

<Atn> I meant make script with loop step over or in depending on the condition u want

<Atn> Set begin and end address

<Atn> And log what u want

<Atn> U can build ur own log

<Atn> With the details u want

Where communities thrive

People

Repo info

Activity