Exetools - x64dbg conditional branches logger [Plugin]

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - x64dbg conditional branches logger [Plugin] (https://forum.exetools.com/showthread.php?t=17702)

x64dbg conditional branches logger [Plugin]

Hi

This is just a work in progress so don't expect too much.

Please test it and report if you find bugs.

I use it like this :

First you need 2 break points to trace between, Start and End.

1 - Throw your target in the debugger.

2 - The Start point should break.

3 - Start the plugin.

4 - Enter the name of the module you are interested in, the plugin will try to detect the name where RIP is now.

5 - Enter the target VA, i.e the point where logging should stop, It's your End point from above.

There will be single stepping into this module but if RIP goes out of this module then there will be stepping over

in those external modules unless there is a call back into the that target module then there will be a single step into the target module.

5 - stepping will continue until we hit the 2nd point.

6 - The plugin will show a message box telling we have ended tracing.

7 - now you can save the result to a log file which looks like this in the image below.

8 - you can use any diffing system to compare the results between 2 traces, here I used a plugin for Notepad++.

Bugs fixed and output improved ...

https://s31.postimg.org/9t4ixicy3/2016_07_01_141602.jpg

Hi Kurapica
this is from x64dbg src
do u have any solution for this :
vb.net Marshal List Of Compicated Structure and get Pointer for this List

Quote:

<StructLayout(LayoutKind.Sequential)> Structure ModuleInfo
Public base As Int64
Public size As Int64
Public entry As Int64
Public sectionCount As Integer
<MarshalAs(UnmanagedType.ByValTStr, SizeConst:=MAX_MODULE_SIZE)> Public name As String
<MarshalAs(UnmanagedType.ByValTStr, SizeConst:=MAX_PATH)> Public path As String
End Structure

Public Function cbModuleEnum(ByVal argc As Integer, ByVal argv() As String) As Boolean

Dim ModuleInfo_Strc As New List(Of ModuleInfo)
Dim modlist As IntPtr = Marshal.AllocHGlobal(Marshal.SizeOf(ModuleInfo_Strc)) ' New List(Of ModuleInfo) 'here is the error
Dim s As Boolean = GetList(ModuleInfo_Strc)
Marshal.PtrToStructure(modlist, ModuleInfo_Strc)
Return 1
End Function

Quote:

An unhandled exception of type 'System.ArgumentException' occurred in x.dll

Additional information: Type 'System.Collections.Generic.List`1[x.Script+ModuleInfo]' cannot be marshaled as an unmanaged structure; no meaningful size or offset can be computed.

so what the easy way to solve this problem

Send me a message in private to discuss this problem.