Debugging Windows Internals with x64dbg!
Vložit
- čas přidán 23. 07. 2024
- Join me with my guest Duncan Ogilvie, developer of x64dbg, as he shows us around the tool and shares some Windows debugging techniques. x64dbg is the only actively maintained userland debugger outside of WinDbg, and aims to be much more intuitive and easy to use.
Files used: mrexodia.github.io/files/wicc...
Slides: mrexodia.github.io/files/wicc....
Join the Off By One Security Discord server: / discord
Consider becoming a member of the channel by clicking the "Join" link and selecting a membership option. Proceeds go towards tuition assistance for those who need it. - Zábava
Man... can't believe I got caught up at work and missed it!
Thank you very much Sir!!!!
I love you Stephen. You are my daily motivation
thanks a lot
can't believe I missed the stream.
epic stream!
Duncan, for the "trace coverage", what is the difference between bit/byte/word?
maybe unrelated to x64dbg, but in windows "context" structures have all the same information (like registers and stuff)? because alot of structures have a "context" field and i never know what the data means
I did a stream on recreating undocumented structs on Windows using IDA Pro. One of the reasons I bring this up is that during that stream, I had to deal with the context structure for a given thread during an exception handler. The thread caused an access violation to a Guard Page, and the handler needed some of the register values at the moment in time when the exception was triggered.. So, think of the context as a snapshot of the state of the processor registers at a given moment in time. Same thing when you context switch out of a process and to another one (e.g. Notepad to Calc). In order to continue where you left off, the state of all registers and such are stored in something called the Process Control Block (PCB).
@@OffByOneSecurity i see, thanks alot
You actually inspired me to create a short video, as this question has been asked quite a few times. Hope it helps... czcams.com/video/dz8CSaQRfzE/video.html