by

Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Repo info
Activity
  • May 31 16:26
    mrexodia commented #2354
  • May 31 16:26
    mrexodia closed #2354
  • May 31 15:45
    jackwolail opened #2354
  • May 30 16:55
    lupier commented #1456
  • May 30 16:03
    lupier commented #1456
  • May 30 14:45
    mrexodia commented #1456
  • May 30 13:20
    lupier commented #1456
  • May 29 14:02
    mrexodia commented #2353
  • May 29 14:01
    mrexodia closed #2353
  • May 29 12:53
    KRISHNA-KD opened #2353
  • May 28 12:45
    ricnar456 edited #2347
  • May 28 12:42
    ricnar456 edited #2347
  • May 28 12:41
    ricnar456 edited #2347
  • May 28 10:53
    mrexodia commented #2057
  • May 28 10:51
    mrexodia commented #2057
  • May 28 10:50
    mrexodia synchronize #2057
  • May 27 10:37
    jackreez opened #2352
  • May 27 06:40
    gyorokpeter commented #2310
  • May 27 04:08
    jackreez commented #2310
  • May 27 04:07
    jackreez commented #2310
x64dbgbot
@x64dbgbot
<mrexodia> works fine for me
Robin Lambertz
@roblabla
Weird. maybe my install is broken? I'll try reinstalling.
yup, reinstalling worked. Ah well :')
x64dbgbot
@x64dbgbot
<Aguml> Hello
<Aguml> Im from Spain and don't speak english
<Aguml> Sorry for muy write errors
x64dbgbot
@x64dbgbot
<Aguml> I am debugging an application which has an antidebug trick which uses RaiseException to send a message to the debugger
<Aguml> if there is a debugger the exception is not given and it catches me
<Aguml> if there is a debugger the exception is not given and it catches me
<Aguml> x64dbg does something because it doesn't get caught and the exception is usually thrown as if there was no debugger
<Aguml> the code that uses the trick is this
<Aguml> void stdcall _OutputDebugStringW(LPCWSTR lpOutputString)
{
char outputDebugStringBuffer[1000] = {0};
WideCharToMultiByte(CP_ACP, 0, lpOutputString, -1, outputDebugStringBuffer, sizeof(outputDebugStringBuffer), 0, 0);
ULONG_PTR args[4];
//unicode
args[0] = (ULONG_PTR)wcslen(lpOutputString) + 1;
args[1] = (ULONG_PTR)lpOutputString;
//ansi for compatibility
args[2] = (ULONG_PTR)wcslen(lpOutputString) + 1;
args[3] = (ULONG_PTR)outputDebugStringBuffer;
try
{
RaiseException(0x4001000A, 0, 4, args);//DBG_PRINTEXCEPTION_WIDE_C
ShowMessageBox("DBG_PRINTEXCEPTION_WIDE_C -> Debugger detected");
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
ShowMessageBox("DBG_PRINTEXCEPTION_WIDE_C -> Debugger NOT detected");
}
}
x64dbgbot
@x64dbgbot
<Aguml> I'm creating a class in c ++ builder and it does detect me in my debugger and I would like to know how I could make my debugger do the same as x64dbg and not be detected
<Aguml> I have thought about putting a breakpoint in RaiseException and from there sending the EXCEPTION_EXECUTE_HANDLER error
<Aguml> but I don't know if that error would return for me to handle my debugger or if the app would manage it
x64dbgbot
@x64dbgbot
<Aguml> can you help me?
x64dbgbot
@x64dbgbot
<ARCHANGEL_ahteam> the reason is that simple debugging loop (WaitForDebugEvent ... ContinueDebugEvent) should check were there some events that can potentially stop the debugger. For example, if you previously put breakpoint in your code you have to remember the address and check it any time breakpoint was occurred. So debugger can process exception or send it back to application for processing inside debuggee. In your simple case any exception processed inside your own debugger, but x64dbg is smarter and it doesn't start such processing. (re @Aguml: can you help me?)
x64dbgbot
@x64dbgbot
<Aguml> and how do i do that in my debugger?
x64dbgbot
@x64dbgbot
<Aguml> should I return EXCEPTION_NOT_HANDLER when I stop at that breakpoint and the condition I want is met? With that I return the exception to the app for her to control?
x64dbgbot
@x64dbgbot
<ARCHANGEL_ahteam> Yes, you should return DBG_EXCEPTION_NOT_HANDLED with ContinueDebugEvent api.
x64dbgbot
@x64dbgbot
<Aguml> Ok thanks
x64dbgbot
@x64dbgbot
<gand0lf> You can also check out the code for x64dbg. Might have your answer as well.
x64dbgbot
@x64dbgbot
<Aguml> Can I have the link?
<Aguml> but if it use titanengine I guess it depends on this
x64dbgbot
@x64dbgbot
<rollednet> Hello! I am trying to trace and log Send() buffer, however I get this?
https://cdn.discordapp.com/attachments/360907625837101067/716409888284344370/unknown.png
x64dbgbot
@x64dbgbot
<morsisko> are you using the newest version of x64dbg?
<rollednet> Yes
<morsisko> and what is in the Log tab when you try to start the trace?
<rollednet> Run trace started....
x64dbgbot
@x64dbgbot
<rollednet> However the created file is garbled
<morsisko> what version are you using? I had similar problem in the past
<morsisko> you can check it using Help->About
<morsisko> well it is not the newest one but i think it is new enough
<morsisko> no clue then
<rollednet> I'll try the last snapshot
x64dbgbot
@x64dbgbot
<mrexodia> You don’t have a condition
<mrexodia> I think that might be the issue
x64dbgbot
@x64dbgbot
<rollednet> A command condition?
x64dbgbot
@x64dbgbot
<mrexodia> It’s weird
<mrexodia> I cannot reproduce this
<mrexodia> For me it just traces without condition
<mrexodia> But you did a trace log file correct?
x64dbgbot
@x64dbgbot
<rollednet> Yes.
<rollednet> It works fine on the latest release
x64dbgbot
@x64dbgbot
<mrexodia> Well good then!
x64dbgbot
@x64dbgbot
<gand0lf> x64dbg - the debugger that fixes its own bugs with each snapshot
x64dbgbot
@x64dbgbot
<mrexodia> hahaha yeah
<mrexodia> although I'm thinking it might have been torusrxxx