x64dbg

[mr.exodia]

Originally Posted by Carbon

Please remove the poll, because it is useless. With further improvements more and more users will use this debugger.

Have you thought about supporting more OS? Like linux x86/x64? I don't know how good the win code separation is but supporting another OS will be a killer. If your code is good you only need to replace titanengine, because qt is platform independent anyway.

Creating the basic linux debugger functions is as easy as in windows.
e.g. https://github.com/tuco86/edb-debugger/blob/master/plugins/DebuggerCore/unix/linux/DebuggerCore.cpp

PS: Please create a new snapshot with the new plugin icon stuff

I like the poll myself And yea, there have been thoughts, but the code is not portable (the dbg part that is). It would probably be possible to make the GUI generic so people can plugin their own debug engines in, but that's really far away right now.

My jenkins server is down so I cannot do any snapshots right now. You could compile it yourself (should be really easy with the supplied batch files).

Greetings

[cybercoder]

Just a quick question. I have just compiled the updated x64_dbg and now the plugins dont seem to work anymore.. is this because the files have the '_' taken out.. i.e. x64_dbg.exe to x64dbg.exe, x64_dbg.dll..x64dbg.dll?

[cybercoder]

Just checked seems the name change does affect the plugins.. can be fixed by editing the filenames in the plugins

[mr.exodia]

I created a forwarder for backwards compatibility: https://github.com/x64dbg/x64dbg_forwarder

If you want the latest x64dbg version I encourage you to use the builds at http://snapshots.x64dbg.com they are mostly up to date with the latest master (except when the change is so minimal it doesn't affect anything)

[mak]

Hi mr.exodia,

Do you have tested the x64dbg debugger in win 8.1 ?! Do you plan to do the optimization of code execution? Implementation of the code execution by F8 for example, I think it is too slow. Generally tracing in the code is fairly slow.

On my system, this message comes out -

---------------------------
ERROR
---------------------------
NT APIs missing

section

060200000109_x86_000169B0

file

Z:\x64_Debug\x32\plugins\NtApiCollection.ini
---------------------------
§°§¬
---------------------------

But I think it is a problem of plug-ins. After completion of debugging on Win 8.1, the debugging file looks like remain busy until you restart the debugger.

Do you plan to add the search for a set of assembly instructions?

Thank you for your great project!

[mr.exodia]

@mak: x64dbg is developed on Windows 8.1 x64. There are indeed many plans to improve the performance of these kind of things, but it is really hard to benchmark and even harder to improve. Feel free to improve things and send a pull request.

That error message is from ScyllaHide. In their readme file they explain why it happens and how to fix it.

And until now there were no plans. Feel free to report if you have ideas or made anything here.

[Debugger]

Hi Mr.exodia , I am using x64dbg for x86 binary.

http://reverseengineeringtips.blogspot.in/2015/02/the-exagerated-promises-of-clicklocker.html#comment-form

I was reading this and thought i could give it try using x64dbg.But I'm not able to search for strings within program(shows ntdll strings ? not demo app strings or am i missing something ?)

btw I love tabs better than toolbar of olly Great work keep it up.

[mr.exodia]

Hey,

If you want to search for strings somewhere, you have to go there in the cpu first. Just go in the memory map and double click the code region of the module you want to see the strings of. Then find strings again.

[Debugger]

Sorry for trouble, i got that after i posted this message

[deroko]

Just a small feature request. In dump windows it would be useful if selecting dword/qword you would add "Follow in dump" option in context menu thus pointers in dump can be easier tracked or I missed this feature somehow

[mr.exodia]

@deroko: I plan on working on x64dbg today, I will implement your feature request as I missed it myself a couple of times too!

[deroko]

Great, this will be very useful

[mr.exodia]

I implemented your feature request, download the latest snapshot from here

[deroko]

Wow that was fast work like a charm

Some more suggestions, would be also good to have same option to follow dword/qword in dump, and to be able to use '-' like in disassembler to go back to previous address in dump. Would be very useful for quick inspection of struct/object members which are pointing to some address without need to type address in dump

[Storm Shadow]

I have tested the new build with decompiler.It really adds so much more to the whole debugger.
Seems more complete now.

Good work Devs

Changelog

BRIDGE: show cpu gui function
PROJECT+GUI: snowman decompiler

http://sourceforge.net/projects/x64dbg/files/snapshots/