Exetools - x64dbg

Page 15 of 23

« First

Last »

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- Developer Section (https://forum.exetools.com/forumdisplay.php?f=48)

- - x64dbg (https://forum.exetools.com/showthread.php?t=15328)

Syoma

07-23-2015 01:35

I am not olly pro, so let me ask few questions about x64dbg?
1. Minor. Does it have sync option between tabs. So, if I stopped at some EIP I can switch to memory map and see synced memory region line active, not the top one.
Example: I stopped at 18001234 switch to Memory Map and see 18000000 active and it is .text of test.dll

2. Minor. Is there an option show Export names in comments?
Example: I stopped at 18001234 and see in comments column: test.dll!DllMain

3. Major. How can I point DLL of interest, but start test.exe instead of DLLLoaderXXX.exe? I changed the command line and restarted debug, but the command line reset as well. I suppose it changes only environment data, not the .exe.

4. Crit. Extend the Q3. Is it possible to debug 64-bit DLL and use .net .exe as loader? If I try to point .exe as target x64dbg says "Use 32-bit debugger". I think it is not my case.

5. Idea. Any plans to make it interactive like IDA? Or at least split the code flow blocks with empty lines.

rcer	07-26-2015 09:38

I am trying find the encryption seeds from a 64bit daemon, and have only experience using Ollydbg, which doesn't debug x64 binaries.

So I started using x64_dbg, but this debugger does not have a field where you can input any arguments such as "-t computer-name 4 –c license.lic"

I tried

x64_dgb "C:\FullPathTo\File.exe" parm1 parm2 -3 -4 -debug

x64_dgb "C:\FullPathTo\File.exe" -t computer-name 4 –c license.lic

and using InitDebug & setcommandline, but none of these pass the arguments -t computer_name 4 -c license.lic to the debugger

Can anybody tell me how to pass on arguments to this debugger?

rgds

rcer	07-28-2015 08:36

Any help please?

NytroRST

07-29-2015 04:57

Just tested it on x64 - Google Chrome. Immunity crashed for some reason, but this helped me a lot!

yoza	09-03-2015 12:05

I always use your x64_dbg.
It helped me a lot! It's a great and a masterpiece creation.

Thank you mr.exodia...

Best regards,
-=yoza=-

TechLord

09-03-2015 12:12

Quote:

I always use your x64_dbg.
It helped me a lot! It's a great and a masterpiece creation.

Yes, I also use it a lot, especially on 64-bit systems along with ScyllaHide and it works like a charm !

Certainly helps a lot , with newer programs whose anti-debugging mechanisms simply check for OLLY , but don't check for this debugger :)

Please continue your development on this mr.exodia ...

Hero	09-22-2015 01:55

I wonder if it is possible to call a dll export when we load dll in x64dbg(similar to olly).
Does anyone know if this is possible? I were not able to find this myself.

Syoma

09-22-2015 03:08

May be use "Set origin here" to change EIP after break on retn in DllMain.

mr.exodia

09-22-2015 07:13

Hello,

Syoma is right, you can do something like setting the EIP. Another method is to simply code a small DLL loader that does something like this:

Code:

#include <windows.h>



int main() {

    HINSTANCE hInst = LoadLibraryA("x32gui.dll");

    typedef int (*GUIGUIINIT)(int, char**);

    GUIGUIINIT _gui_guiinit = (GUIGUIINIT)GetProcAddress(hInst, "_gui_guiinit");

    int result = _gui_guiinit(0, nullptr);

    return 0;

}

Hope this helps,

Mr. eXoDia

Hero	09-22-2015 17:00

Quote:

Originally Posted by mr.exodia (Post 101919)

Hello,

Syoma is right, you can do something like setting the EIP. Another method is to simply code a small DLL loader that does something like this:

Code:

#include <windows.h>



int main() {

    HINSTANCE hInst = LoadLibraryA("x32gui.dll");

    typedef int (*GUIGUIINIT)(int, char**);

    GUIGUIINIT _gui_guiinit = (GUIGUIINIT)GetProcAddress(hInst, "_gui_guiinit");

    int result = _gui_guiinit(0, nullptr);

    return 0;

}

Hope this helps,

Mr. eXoDia

Hi

Thanks for reply.
These 2 ways were somehow obvious and I already have done it this way.
But I thought there may be an easy for it like olly, because it somehow a useful option for debugging DLLs.
Maybe I write its plugin my own.

Regards

mr.exodia

09-23-2015 07:11

Yea, a plugin sounds cool. Feel free to drop me a message if you need help.

deroko

10-16-2015 16:37

Just a quick q, why not implementing python as script instead of developing own scripting language? :)

mr.exodia

10-16-2015 23:03

At the time it seemed more logical to do an olly script like language. Right now there is someone working on python.

u_f_o

10-18-2015 19:32

Quote:

Originally Posted by rcer (Post 100834)

...
Can anybody tell me how to pass on arguments to this debugger?

i need an answer too.
as i think it is impossible to pass arguments now,
but maybe are some plans to add this possibility to x64_dbg?
or advise other debugger for x64.

Syoma

10-18-2015 19:58

IDA Pro is also nice for x64.

All times are GMT +8. The time now is 10:36.

Page 15 of 23

« First

Last »

Show 40 post(s) from this thread on one page