x64dbg

[metal]

I will send you a PM, I don't want to reveal what software tbh.

[mr.exodia]

V2.3ALPHA is out!

Changelog:
http://x64dbg.com/changelog

Website:
http://x64dbg.com

Greetings,

Mr. eXoDia

1. didn't you see, when we click on next asm code of jump xxxxxx, the red arrow jump line will automaticlly showed on OllyDBG, but none in x32dbg.



eg:



00401000 jnz 004010004

00401001 xxxxxxxxxx

00401002 xxxxxxxxxx

00401003 jmp 00401005

00401004 xxxxxxxxxxxxxxxxxx <----------- If you click here, the red jump line will automatic showed in OllyDBG jump from 00401000, but none in x32dbg, will this implement?

00401005 xxxxxxxxxxxxxx



2. didn't you see, when we search something, will result many, at current, we need set each breakpoint by press F2 many times one by one, so if I find thousand times of mov al, 1, should I need press F2 shousand times to set breakpoint on it? do you even think make a option or sub-menu called set all breakpoint or set bulk breakpoint on all of them? so in OllyDBG is have this feature on set all breakpoint on them or cancel breakpoint on them.



eg find result:



00401000 mov [EAX + 12], 1

00402000 sub 2, [EAX + 12]

00403000 mov EBX, [EAX + 12]

00404000 imul EAX, [EAX + 12]



3. at currently, we set API any breakpoint through command line box, that is inconvenience for user and me, did you even think make a API breakpoint Plugin or API Breakpoint menu option? in OllyDBG there is many such plugins, that is good, but none available yet in x32dbg.



eg:



bp MessageBoxA/W

bp ExitProcess



4. at currentlly, we set each windows eg: infobox window, stack window, hex window width & lenth, but exit debugger process, next time relauched, it can't saved into config.ini file, so need reset again, didn't you even think let it can be saved, so next time relauched I don't need set it again and again, I really hate it.



5. still against, when unicode string searching will be supportted? maybe there is some source code open Plugins on OllyDBG, If I can find for you. thanks.

[chessgod101]

I just published a definitive tutorial for x64_dbg. It documents its settings and features and shows you how to use the tool to effectively debug a 64-bit application.

http://reverseengineeringtips.blogsp...to-x64dbg.html

[mr.exodia]

V2.4ALPHA Released!

Changelog:
- resolved a crash when scrolling up in the dump
- resolved reference view not following in disasm correctly
- resolved losing settings
- fixed a crash with a critical section initialized multiple times
- added secret option to disable database compression
- various ui improvements
- allow 'jmp short'
- fixed hardware breakpoints
- disasm/dump/stack plugin menu api
- display the number of bytes selected and the module in dump
- added topmost option
- fixed TLS callbacks on DLLs
- show reference count in reference window
- fixed possible buffer overflows
- added a close all button in the reference view to close all tabs
- fixed a bug with a non-refreshed memory map on start
- report bug button
- update hex when editing ascii/unicode in HexEditDialog
- settings dialog now scales
- fixed importing patches
- thread-safe dbghelp access (could fix some crashes)
- Yara pattern finding support
- resolved an issue where toggling patches did not toggle the actual bytes
- data copy dialog in various formats (C byte/word/dword/string/unicode)
- dynamic 'Find references to' menu in disassembler (auto-detects constants)
- added find references option to the dump (also works with a range selection)
- show what was searched for in reference tab title
- RegEx support in SearchListView

Download:
http://snapshots.x64dbg.com

Donate:
http://donate.x64dbg.com

Greetings,

Mr. eXoDia

[ahmadmansoor]

Nice news

disasm/dump/stack plugin menu api

[Conquest]

can you implement some type of compatibility with olly plugins. The sheer amount of olly plugins is main reason why i still cannot use it as my default debugger.(i understand the fact that most plugins on the wild is to fix and hide olly, but some of them has other purposes as you can already guess, ex- ollyscript, oreans unvmer etc.)

[Carbon]

@Conquest
That is too much work and wasted time.

Maybe you should become active?
- Create feature requests: https://bitbucket.org/mrexodia/x64_dbg
- Ask plugin authors for a x64dbg version.

x64dbg has already more than enough hide plugins.

[Conquest]

Originally Posted by Carbon

Maybe you should become active?
- Create feature requests: https://bitbucket.org/mrexodia/x64_dbg
- Ask plugin authors for a x64dbg version.

You misunderstood me, i am not looking for hiding features, some of the pluigns for olly like oreans unvmer and zeus are very important and unfortunately ,deathway isnt active recently(and i doubt with his busy schedule he will be interested in learning x64dbg) and i dont know ximo personally or how to contact him. I can write 1 or 2 small plugins may be but i am far less capable of creating something as good as theirs(or just too lazy).

But i got your point, it will be really cumbersome to provide olly compatibility .
Thanks for considering my advice though. Appreciate it.

[mr.exodia]

Compatibility with OllyDbg plugins is not possible, just because the architecture is completely different. Maybe I could do some exports ollydbg has, but those would already require plugin patching or some weird dll called 'OllyDbg.exe' that was somehow loaded in x64dbg and the plugin at the same time (first load OllyDbg.exe in x64_dbg and then load the plugin in x64_dbg?).

Feel free to give it a shot.

For plugins that only use a few APIs it might be possible to do with some hacks, but apart from that I doubt it is possible.

[Carbon]

Olly has 188 exported functions. That is insane.

Oreans UnVirtualizer 1.8 uses 27 functions. Emulation is possible. But some APIs are really difficult to emulate (in my opinion).

_Addsorteddata (hard)
_Addtolist (easy)
_Createsorteddata (hard)
_Deletesorteddata (hard)   
_Deletesorteddatarange (hard)
_Destroysorteddata (easy)      
_Disasm (easy)                  
_Finddecode (hard)             
_Findmemory (easy)             
_Findmodule (easy)             
_Findname (hard)             
_Flash (easy)                  
_Getsortedbyselection (hard) 
_Infoline (easy)               
_Painttable (hard)          
_Plugingetvalue (easy)         
_Pluginreadintfromini (easy)   
_Pluginreadstringfromini (easy)
_Pluginwriteinttoini (easy)    
_Progress (easy)               
_Quicktablewindow (hard)
_Readmemory (easy)            
_Registerpluginclass (easy)    
_Setcpu (hard)              
_Tablefunction (hard)         
_Unregisterpluginclass (easy)  
_Writememory (easy)

[Jupiter]

Please, update poll options. Currently there are only 3 options excluding the most important one: "Yes, as x64 debugger"

Would you use this debugger?

• Yes, as x64 debugger
• Yes (mainly x32)
• Not at all
• Yes, if it gets better (please post feature suggestions)

[Hypnz]

U can also add another one. -Yes, As x32 and x64 debugger.

[mr.exodia]

When i made the poll I meant to make the "Yes (mainly x32)" "Yes (mainly x64)" the typo was never fixed now added the option.

[Carbon]

Please remove the poll, because it is useless. With further improvements more and more users will use this debugger.

Have you thought about supporting more OS? Like linux x86/x64? I don't know how good the win code separation is but supporting another OS will be a killer. If your code is good you only need to replace titanengine, because qt is platform independent anyway.

Creating the basic linux debugger functions is as easy as in windows.
e.g. https://github.com/tuco86/edb-debugger/blob/master/plugins/DebuggerCore/unix/linux/DebuggerCore.cpp

PS: Please create a new snapshot with the new plugin icon stuff