x64dbg

[n00b]

I read somewhere that you can use commands based on the TitanEngine itself - does this include for instance DumpProcess by any chance?
I tried using Scylla's process dumper, but its no good for me as it keeps creating this messed up dump...

The best would be to have a proper dumper like OllyDumpEx, which produces a very good dumped executable on PE32

Anyways, back to my question; is there any chance I can use TitanEngine's DumpProcess within the x64_Dbg for this purpose?

[mr.exodia]

@n00b: currently i didnt implement this command, but take a look at the plugin engine. its easy to add a command.

greetingd

[Carbon]

Originally Posted by n00b

I tried using Scylla's process dumper, but its no good for me as it keeps creating this messed up dump...

messed up dump?

[n00b]

Yeah, it simply won't run when dumped - I also tried with another tool, which dumps the process aswell - and it ran, but the size increased exponentially to say the least... Went from 40mb to 70mb...

[mr.exodia]

@n00b: I'll create a small plugin for you to see if its working. Will do that after the new release of x64dbg

Greetings

[n00b]

Thank you so much mate, that would be really helpful indeed
@Carbon: The tool I used which managed to create a working dump, is VSD v1.0 x64

[n00b]

@mr.exodia: So, I'm trying to create my own plugin here - and I was curious, how do I get the current RIP of any process through a plugin?
I have checked both example plugin, and the TitanHide plugin for clues - even looked quickly at the headers which to include...

I'm not the most experienced coder of plugins, so I apoligize for looking too noobish - hehe

Big regards

[mr.exodia]

@n00b: Thanks for the interest. You can either use the Bridge export 'DbgValFromString' or you can use TitanEngine (just call GetContextData).

some example code:

//Bridge
//you can also use 'CIP' for an architecture-independent IP register
duint rip=DbgValFromString("RIP"); //"RIP" can be anything that's an expression
//TitanEngine
rip=GetContextData(UE_RIP);

Feel free to post here if you have feature requests.

@everyone:
V1.2ALPHA is out!

Changelog:
- many small crash fixes (stack overflows etc)
- many fixes regarding the Dump window
- different dump views
- bugs with valfromstring fixed (now much faster)
- latest development version of TitanEngine Community Edition (many, many, many fixes)
- simple thread view
- project design overview (x64_dbg_sceme.vsd), useful for plugin developers
- TLS callback support
- informative window title
- user preferences (eg on which events to break)
- bug with the recent file list fixed
- ignore exception ranges
- debug strings are now displayed (escaped)
- added 'xor' command
- many fixes in the script engine
- simple stack display

Download:
https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia

[mr.exodia]

Sorry, I could not edit my previous post anymore..

Attached an example plugin (DumpProcess), I tested it for a simple DLL + EXE and it appears to work fine. Feel free to (ab)use it however you like.

EDIT: @n00b, seems like I've misread your question. To get the RIP of any process, you should use the function GetThreadContext, enum the threads in a process using CreateToolhelp32Snapshot & Thread32Next and then get the RIP of the thread you're interested in...

Greetings,

Mr. eXoDia

[mr.exodia]

V1.3ALPHA is out!

Changelog:
- added reference searching 'ref value[,page]'
- added string reference searching (little button in the upper-right or the command 'strref [page]'
- fixed a bug when you removed all ignored exception ranges.

Download:
https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia

[mr.exodia]

V1.5ALPHA is out (lol, kinda spamming)

Changelog:
- fixed some bugs with references
- added the 'Previous (-)' and 'Next (+)' function (to get back to your previous address of interest). This has a maximum depth of 1024, but it's easy to change this to any other value, since I use dynamic arrays

Download:
https://bitbucket.org/mrexodia/x64_dbg/downloads

Greetings,

Mr. eXoDia

[mr.exodia]

@stev: ... ok thats the download link I provided.

[Insid3Code]

Hi mr.exodia,

I have a machine who has a hard disk more than one tera, partitioned into multiple disk drive (disk drive letter: c, d, e, f ... p)

x64_dbg display "error starting process (invalid pe?)!" when I try to debug something in disk drive (letter: M, N, O or P)

it works fine on (disk drive letter: C,D,E.......L)

[s0me0n3]

I have mutliple HDDs, too, all splitted into seperated partitions.

I have my x64_dbg on th C drive, so please explain what you do:
Where lays the debugger? Where do you try to debug? Did you tried running the debugger as admin to ensure you have the right to read and write on every path? Does it happens with ANY file you try to debug? Do you tried it over a network path or do you simply tried debugging a file from your normal windows from another partition?

Some more info will help finding and fixing the problem.

[mr.exodia]

Hi,

I have also noticed this problem, I think there is some bug with both TitanEngine (DLLLoader) and x64_dbg. Unfortunately I cannot reproduce the bug very well.

Greetings