So, if you want to know everything a program is doing on your computer, downloading x64dbg is sure to help considerably. Please log in to your account or sign up in order to add this asset to your watchlist.
Search code, repositories, users, issues, pull requests…
We also recorded our steps in a reliably reproducible way, opening the door for re-use, adaptation, and collaboration. We’ll start the demonstration with quick peek at a target sample. Examining it shows a malware family that embeds its payload in legitimate MSVC compiled binaries (in our case 7z.exe). Note the clobbered c-runtime _initterm callback used to deploy the rogue payload. Yesterday I was debugging some programs and after restarting I saw that the status label stayed stuck on Initializing.
Code of conduct
I like showing much more than talking though, so let’s see how automation can help us in each of these areas using some real-world inspired demonstrations. It is not possible to buy all cryptocurrencies with U.S. dollars. Bitcoin, Bitcoin Cash, Ethereum, Litecoin and other popular cryptocurrencies can be purchased with U.S. dollars using Coinbase. Once you have purchased Bitcoin using Coinbase, you can then transfer your Bitcoin to an exchange such as Binance to purchase other cryptocurrencies, including DigitalBits.
The exercise was very much geared towards Malware analysts, but the concepts within are applicable regardless of the specific discipline you’re operating in. Uptodown is a multi-platform app store specialized in Android. This is a community effort and we accept pull requests! See the CONTRIBUTING document for more information. If you have any questions you can always contact us or open an issue.
In this article I’ll be showcasing some of the thoughts and features behind x64dbg Automate, my automation solution for x64dbg. I designed this project with the goal of building on x64dbg’s command execution engine and plugin API to provide an expressive, modern, and easy to use Python client library. I use this project in a wide variety of malware analysis, reverse engineering, and vulnerability hunting tasks. This isn’t usually a problem, but in our case it will raise an exception. The reason is that we are currently in the .text section, which is executable code, and it cannot be overwritten!
For example, you can see what part of the memory map it’s using, as well as what part of the CPU the program is processing. We breakpoint directly on the CALL EAX, Run (F9), and step in once. Earlier we posed that we have many samples that may or may not be of the target family we’re concerned with.
Apart from all the programming and social fun I had, I also stumbled upon a daunting CTF challenge made by a team from Avast. In fact, it intrigued me so much that I took it home and finished it here. Among the puzzles there was a particularity interesting one – a binary that self-decrypted its code twice to reveal a secret message! We will solve that level today, with the help of x64dbg.
The result of this is a boon of helpful hints saved to our application database. The more samples in this family of malware we analyze, the greater the value of having analysis automated ends up being. Thanks to these debugging programs, it’s also possible to find bugs in the software.
About MarketBeat
X64dbg is a program for debugging apps and programs developed on both 32-bit and 64-bit architectures. This debugger is open source and makes it easy for you to check all the ins and outs of any Windows program. Its two main uses are malware analysis and reverse engineering of executables whenever the code is not available.
A 32-bit and 64-bit debugger for Windows
Copyright © 2025 FactSet Research Systems Inc.© 2025 TradingView, Inc. If you are interested in trying to reproduce this at home, you can use the handle_gamble branch. This started to smell more and more like bad WinAPI usage. Tools like Application Verifier exist to find these kind of issues, but I could not get it to work so I had to roll my own. In case you are wondering, this byte array translates to an SMS message which gives us the password for this level. We Run the program and land at the second breakpoint.
You can take a look at the good first issues to get started. If you came here because someone told you to read the manual, start by reading all sections of the introduction. See commands for an overview of the available commands and how they work (the arguments are comma separated).
- The automation brings us to a point where we can disconnect our client and do additional analysis on the payload itself.
- This debugger is open source and makes it easy for you to check all the ins and outs of any Windows program.
- I found that you can greatly increase the likelyhood of this happening when your PC has been on for a few days and you have 70k handles open.
- We scripted the entirety of our analysis, letting us access tricky execution states breezily.
The automation brings us to a point where we can disconnect our client and do additional analysis on the payload itself. With the heavy lifting of getting past the payload’s decryption out of the way we can debug fearlessly, knowing we’ll always be able to get back to important spots easily. Frequently I find myself in a situation where I’ve taken many steps to land in a certain execution state.
To fix this, we have to select the memory pages that correspond to this section and mark them all as FULL ACCESS, or at least give them WRITE ACCESS. Walking through this exercise showed us some powerful use-cases for x64dbg Automate. We scripted the entirety of our analysis, letting us access tricky execution states breezily.
Dynamic Analysis of a Malware Family
At first it didn’t seem to impact anything, but pretty soon after that other things started breaking as well. Step over to CALL EAX, change EAX to the address of the second block (7714EAE0), step in once to land at the second block, then step over until you come back in the first block. Next, we have to find ourselves some executable space. We start up x32dbg (not x64dbg, since we are working with x32 code), and open any 32-bit executable.
We read every piece of feedback, and take your input very seriously. Stepping through the payload at this point reveals two anti-debug measures. Let’s modify our script to seek past anti-debug checks in addition to decryption, so we can debug fully unencumbered.
- The more samples in this family of malware we analyze, the greater the value of having analysis automated ends up being.
- Note the clobbered c-runtime _initterm callback used to deploy the rogue payload.
- In fact, it intrigued me so much that I took it home and finished it here.
- To fix this, we have to select the memory pages that correspond to this section and mark them all as FULL ACCESS, or at least give them WRITE ACCESS.
As a first step let’s build a method to discover samples we’re interested in, using a basic yara rule. I’ll leave exploration of the sample up to readers, and focus on xdgb the automation aspects of the exercise from here out. If you want to debug a 32-bit program, use x32dbg.exe. If you want to debug a 64-bit program, on the other hand, then use x64dbg.exe. DigitalBits produces its own wallet software that is available for download on its website, which allows you to store DigitalBits on your computer.
This is common when I am unpacking an armored sample. When this is the case, I want to maximize the amount of analysis I can do at that specific point in execution. There are ways to tackle this, which I have varying success with (e.g. Time-Travel-Debugging). However, I usually find myself most productive when I script my steps and replay execution at-will. On x64dbg, you can see all the hardware and software elements that each program accesses.
.jpeg)
.jpeg)
.jpeg)
.jpeg)
.jpg)
.jpeg)
.jpeg)