X64dbg

x64dbg

Windows debugger for dynamic malware analysis, unpacking, and API tracing.

Installation

# Download from https://x64dbg.com or https://github.com/x64dbg/x64dbg/releases
# Extract → run x96dbg.exe (launcher auto-selects x32dbg/x64dbg)

# Essential plugins (copy to plugins/ directory):
# - ScyllaHide: anti-anti-debug (hide debugger from malware)
# - Scylla: import reconstruction for dumping
# - xAnalyzer: automatic API parameter annotation
# - SwissArmyKnife: assembler/label shortcuts
# - TitanHide: kernel-mode anti-anti-debug

Quick Start

1. File → Open → target executable
2. Program breaks at system entrypoint
3. Set breakpoints: F2 on instruction, or bp CreateRemoteThread in command bar
4. Run: F9 | Step over: F8 | Step into: F7

Key Panels

Keyboard Shortcuts

Command Bar Commands

Common Workflows

Unpack malware

1. Open sample → reaches system entrypoint
2. Look for unpacking patterns:
   a. VirtualAlloc with PAGE_EXECUTE_READWRITE (0x40)
   b. Large memcpy/memmove to allocated region
   c. Jump to allocated region (jmp reg / call reg / ret to new region)
3. Set breakpoint: bp VirtualAlloc → F9
4. When hit: check r8 (or stack arg) for 0x40 (RWX)
5. Execute till return (Ctrl+F9) → follow rax in dump
6. Set hardware execute breakpoint on new allocation: bphws rax, "x"
7. F9 → program jumps to unpacked code (OEP)
8. Plugins → Scylla → IAT Autosearch → Get Imports → Dump → Fix Dump

Find C2 communication

bp ws2_32.connect
bp ws2_32.send
bp ws2_32.recv
bp wininet.InternetConnectW
bp wininet.HttpSendRequestW
bp winhttp.WinHttpConnect
F9
# On hit: examine stack/registers for URLs, IPs, ports
# Follow buffer pointers in dump to see HTTP requests/responses

Anti-debug bypass (manual)

# PEB.BeingDebugged
# In dump: follow PEB address, set byte at offset +2 to 0
dump fs:[30]            # 32-bit: PEB address
# Or dump gs:[60]       # 64-bit

# NtGlobalFlag
# PEB offset +0x68 (32-bit) or +0xBC (64-bit) → set to 0

# Heap flags
# PEB → ProcessHeap → Flags/ForceFlags → set to expected values

# Better: use ScyllaHide plugin (Plugins → ScyllaHide → Options)
# Enable: PEB BeingDebugged, NtGlobalFlag, HeapFlags, NtQueryInformationProcess,
# GetTickCount, QueryPerformanceCounter, NtSetInformationThread

Trace execution

# Conditional trace: log all API calls
Trace → Trace Over → set stop condition
# Or use command bar:
TraceOverConditionalLog                 # Trace + log each instruction
TraceIntoConditionalLog                 # Step into + log

# Breakpoint logging (non-stop):
bp kernel32.CreateFileW
SetBreakpointCommand ADDR, "log \"CreateFile: {s:utf16@rcx}\"; run"

Memory patching

# Patch instruction at runtime:
1. Select instruction → Space → type new instruction → OK
2. Or: Ctrl+E on bytes → edit hex directly

# Patch jump condition:
# je → jmp: change 0x74 to 0xEB (short) or 0x0F84 to 0x0F85 (near)
# je → nop: fill with 0x90

# Save patches:
Patches → right-click → Export → save to file

Scripting (x64dbg script)

// x64dbg script language
bp VirtualAlloc
loop:
  run
  cmp r8, 0x40        // Check if PAGE_EXECUTE_READWRITE
  jne loop
  rtr                  // Run to return
  bphws rax, "x"      // HW execute BP on allocated memory
  run                  // Hit = OEP reached
  msg "OEP found"

Plugin Ecosystem

Resources