EXETOOLS FORUM  

Go Back   EXETOOLS FORUM > General > Developer Section

Notices

View Poll Results: Would you use this debugger?
Yes (mainly x32) 64 30.77%
Not at all 21 10.10%
Yes, if it gets better (please post feature suggestions) 76 36.54%
Yes (mainly x64) 47 22.60%
Voters: 208. You may not vote on this poll

Reply
 
Thread Tools Display Modes
  #61  
Old 03-28-2014, 16:13
n00b n00b is offline
Friend
 
Join Date: Mar 2009
Posts: 41
Rept. Given: 18
Rept. Rcvd 25 Times in 14 Posts
Thanks Given: 8
Thanks Rcvd at 42 Times in 10 Posts
n00b Reputation: 25
I read somewhere that you can use commands based on the TitanEngine itself - does this include for instance DumpProcess by any chance?
I tried using Scylla's process dumper, but its no good for me as it keeps creating this messed up dump...

The best would be to have a proper dumper like OllyDumpEx, which produces a very good dumped executable on PE32

Anyways, back to my question; is there any chance I can use TitanEngine's DumpProcess within the x64_Dbg for this purpose?
Reply With Quote
  #62  
Old 03-28-2014, 17:42
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 817
Rept. Given: 475
Rept. Rcvd 1,149 Times in 307 Posts
Thanks Given: 72
Thanks Rcvd at 414 Times in 166 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
@n00b: currently i didnt implement this command, but take a look at the plugin engine. its easy to add a command.

greetingd
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
The Following User Gave Reputation+1 to mr.exodia For This Useful Post:
n00b (03-28-2014)
  #63  
Old 03-28-2014, 19:38
Carbon Carbon is offline
VIP
 
Join Date: Sep 2013
Posts: 113
Rept. Given: 7
Rept. Rcvd 189 Times in 48 Posts
Thanks Given: 0
Thanks Rcvd at 51 Times in 15 Posts
Carbon Reputation: 100-199 Carbon Reputation: 100-199
Quote:
Originally Posted by n00b View Post
I tried using Scylla's process dumper, but its no good for me as it keeps creating this messed up dump...
messed up dump?
Reply With Quote
  #64  
Old 03-29-2014, 02:18
n00b n00b is offline
Friend
 
Join Date: Mar 2009
Posts: 41
Rept. Given: 18
Rept. Rcvd 25 Times in 14 Posts
Thanks Given: 8
Thanks Rcvd at 42 Times in 10 Posts
n00b Reputation: 25
Yeah, it simply won't run when dumped - I also tried with another tool, which dumps the process aswell - and it ran, but the size increased exponentially to say the least... Went from 40mb to 70mb...
Reply With Quote
  #65  
Old 03-29-2014, 07:41
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 817
Rept. Given: 475
Rept. Rcvd 1,149 Times in 307 Posts
Thanks Given: 72
Thanks Rcvd at 414 Times in 166 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
@n00b: I'll create a small plugin for you to see if its working. Will do that after the new release of x64dbg

Greetings
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
The Following User Gave Reputation+1 to mr.exodia For This Useful Post:
n00b (03-29-2014)
  #66  
Old 03-29-2014, 15:24
n00b n00b is offline
Friend
 
Join Date: Mar 2009
Posts: 41
Rept. Given: 18
Rept. Rcvd 25 Times in 14 Posts
Thanks Given: 8
Thanks Rcvd at 42 Times in 10 Posts
n00b Reputation: 25
Thank you so much mate, that would be really helpful indeed
@Carbon: The tool I used which managed to create a working dump, is VSD v1.0 x64
Reply With Quote
  #67  
Old 03-30-2014, 16:14
n00b n00b is offline
Friend
 
Join Date: Mar 2009
Posts: 41
Rept. Given: 18
Rept. Rcvd 25 Times in 14 Posts
Thanks Given: 8
Thanks Rcvd at 42 Times in 10 Posts
n00b Reputation: 25
@mr.exodia: So, I'm trying to create my own plugin here - and I was curious, how do I get the current RIP of any process through a plugin?
I have checked both example plugin, and the TitanHide plugin for clues - even looked quickly at the headers which to include...

I'm not the most experienced coder of plugins, so I apoligize for looking too noobish - hehe

Big regards
Reply With Quote
  #68  
Old 03-31-2014, 04:56
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 817
Rept. Given: 475
Rept. Rcvd 1,149 Times in 307 Posts
Thanks Given: 72
Thanks Rcvd at 414 Times in 166 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
@n00b: Thanks for the interest. You can either use the Bridge export 'DbgValFromString' or you can use TitanEngine (just call GetContextData).

some example code:
Code:
//Bridge
//you can also use 'CIP' for an architecture-independent IP register
duint rip=DbgValFromString("RIP"); //"RIP" can be anything that's an expression
//TitanEngine
rip=GetContextData(UE_RIP);
Feel free to post here if you have feature requests.

@everyone:
V1.2ALPHA is out!

Changelog:
- many small crash fixes (stack overflows etc)
- many fixes regarding the Dump window
- different dump views
- bugs with valfromstring fixed (now much faster)
- latest development version of TitanEngine Community Edition (many, many, many fixes)
- simple thread view
- project design overview (x64_dbg_sceme.vsd), useful for plugin developers
- TLS callback support
- informative window title
- user preferences (eg on which events to break)
- bug with the recent file list fixed
- ignore exception ranges
- debug strings are now displayed (escaped)
- added 'xor' command
- many fixes in the script engine
- simple stack display

Download:
https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
The Following 4 Users Gave Reputation+1 to mr.exodia For This Useful Post:
besoeso (03-31-2014), MarcElBichon (03-31-2014), n00b (03-31-2014), winndy (03-31-2014)
  #69  
Old 03-31-2014, 06:21
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 817
Rept. Given: 475
Rept. Rcvd 1,149 Times in 307 Posts
Thanks Given: 72
Thanks Rcvd at 414 Times in 166 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
Sorry, I could not edit my previous post anymore..

Attached an example plugin (DumpProcess), I tested it for a simple DLL + EXE and it appears to work fine. Feel free to (ab)use it however you like.

EDIT: @n00b, seems like I've misread your question. To get the RIP of any process, you should use the function GetThreadContext, enum the threads in a process using CreateToolhelp32Snapshot & Thread32Next and then get the RIP of the thread you're interested in...

Greetings,

Mr. eXoDia
Attached Files
File Type: rar testplugin_002.rar‎ (249.7 KB, 30 views)
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
The Following 2 Users Gave Reputation+1 to mr.exodia For This Useful Post:
ali56s (04-02-2014), n00b (03-31-2014)
  #70  
Old 04-05-2014, 06:36
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 817
Rept. Given: 475
Rept. Rcvd 1,149 Times in 307 Posts
Thanks Given: 72
Thanks Rcvd at 414 Times in 166 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
V1.3ALPHA is out!

Changelog:
- added reference searching 'ref value[,page]'
- added string reference searching (little button in the upper-right or the command 'strref [page]'
- fixed a bug when you removed all ignored exception ranges.

Download:
https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
The Following 4 Users Gave Reputation+1 to mr.exodia For This Useful Post:
ahmadmansoor (04-06-2014), chessgod101 (04-06-2014), Wannabe (04-05-2014), winndy (04-05-2014)
  #71  
Old 04-08-2014, 06:27
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 817
Rept. Given: 475
Rept. Rcvd 1,149 Times in 307 Posts
Thanks Given: 72
Thanks Rcvd at 414 Times in 166 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
V1.5ALPHA is out (lol, kinda spamming)

Changelog:
- fixed some bugs with references
- added the 'Previous (-)' and 'Next (+)' function (to get back to your previous address of interest). This has a maximum depth of 1024, but it's easy to change this to any other value, since I use dynamic arrays

Download:
https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
The Following 5 Users Gave Reputation+1 to mr.exodia For This Useful Post:
ahmadmansoor (04-09-2014), chessgod101 (04-11-2014), cjack (04-08-2014), Sir.V65j (04-17-2014), uranus64 (04-09-2014)
  #72  
Old 04-09-2014, 20:22
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 817
Rept. Given: 475
Rept. Rcvd 1,149 Times in 307 Posts
Thanks Given: 72
Thanks Rcvd at 414 Times in 166 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
@stev: ... ok thats the download link I provided.
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
  #73  
Old 04-12-2014, 02:08
Insid3Code's Avatar
Insid3Code Insid3Code is offline
Family
 
Join Date: May 2013
Location: Antartica
Posts: 71
Rept. Given: 36
Rept. Rcvd 60 Times in 30 Posts
Thanks Given: 11
Thanks Rcvd at 45 Times in 21 Posts
Insid3Code Reputation: 60
Hi mr.exodia,

I have a machine who has a hard disk more than one tera, partitioned into multiple disk drive (disk drive letter: c, d, e, f ... p)

x64_dbg display "error starting process (invalid pe?)!" when I try to debug something in disk drive (letter: M, N, O or P)

it works fine on (disk drive letter: C,D,E.......L)
__________________
Computer Forensics
Reply With Quote
  #74  
Old 04-16-2014, 16:57
s0me0n3 s0me0n3 is offline
Family
 
Join Date: Mar 2012
Posts: 126
Rept. Given: 43
Rept. Rcvd 95 Times in 33 Posts
Thanks Given: 10
Thanks Rcvd at 23 Times in 10 Posts
s0me0n3 Reputation: 95
I have mutliple HDDs, too, all splitted into seperated partitions.

I have my x64_dbg on th C drive, so please explain what you do:
Where lays the debugger? Where do you try to debug? Did you tried running the debugger as admin to ensure you have the right to read and write on every path? Does it happens with ANY file you try to debug? Do you tried it over a network path or do you simply tried debugging a file from your normal windows from another partition?

Some more info will help finding and fixing the problem.
Reply With Quote
  #75  
Old 04-16-2014, 21:29
mr.exodia's Avatar
mr.exodia mr.exodia is offline
Super Moderator
 
Join Date: Nov 2011
Posts: 817
Rept. Given: 475
Rept. Rcvd 1,149 Times in 307 Posts
Thanks Given: 72
Thanks Rcvd at 414 Times in 166 Posts
mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299 mr.exodia Reputation: 1100-1299
Hi,

I have also noticed this problem, I think there is some bug with both TitanEngine (DLLLoader) and x64_dbg. Unfortunately I cannot reproduce the bug very well.

Greetings
__________________
x64dbg: http://x64dbg.com
My Blog: http://mrexodia.cf
Reply With Quote
Reply

Tags
bit, debugger, x32, x64, x64_dbg

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
x64dbg python Storm Shadow Developer Section 5 11-15-2016 20:45
x64dbg conditional branches logger [Plugin] Kurapica Community Tools 3 09-16-2016 01:58


All times are GMT +8. The time now is 07:43.


ICP05004977
vBulletin Security provided by vBSecurity v2.2.0 (Lite) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX