5 ms·

x64dbg: An open-source x64/x32 debugger for Windows

73 points by donutloop 9y ago

ndh2 9y ago
> C-like expression parser What does that mean? What can you do with that? > Source code view Does it understand programming languages? Can you inspect the contents of variables like in VS? My impression is that the focus is on debugging executables where source level access is unavailable. Cracking, reverse engineering. Are there people who use it for development?
- mrexodia 9y ago
  > What does that mean? What can you do with that? That you can use c-like expressions in various places (the command bar, goto dialog, calculator, conditional breakpoints) > Does it understand programming languages? Can you inspect the contents of variables like in VS? No and not yet, it just uses the symbols of an executable to display a source code listing. I only know of a few asm developers that use it for development but the main use case is reverse engineering and malware analysis.
kamranahmed_se 9y ago
Spam!!!! Almost all the stars are from the throwaway/spam accounts!
- exikyut 9y ago
  This is being downvoted, but in the process of trying to disprove this I actually discovered it could be true. Two recent stargazers are http://archive.is/cbPm1 http://archive.is/cbPm1 and http://archive.is/o0uzH; http://archive.is/o0uzH; both accounts are in "cn" and use an email address with an invalid TLD. Another two, http://archive.is/x5IBA http://archive.is/x5IBA and http://archive.is/KUnOg http://archive.is/KUnOg, have less "definitely spam" indicators; the only thing they have in common is that x64dbg is the only repo they've starred, that they have no other activity, and that they were created ~two days ago. Have fun poking through the stargazer list. I'm very curious as to explanations. Right now I'm not sure whether to wonder if this HN submission is a stargazer-generating demonstration or if I'm just seeing normal github activity (where "normal" means "spammers doing their weird thing").
  - donutloop 9y ago
    i don't know, i like this debugger
    - exikyut 9y ago
      Note that I have no issue with x64dbg and don't suspect the project. See the other very strange comments elsewhere in this subthread
  - ribosometronome 9y ago
    I think there might actually be something going on weird with this project on Github's end. I've never heard of this project but started getting alerts in my email for it this morning. My account has apparently stared and watched this project. I hadn't used that account for awhile and the security page for my account doesn't show any logins for my account except from this morning, which leads me to believe that it probably wasn't compromised.
    - wisp2 9y ago
      The same happened with my Github account.
    - hdougie 9y ago
      Same here, been getting lots of emails regarding issues I've supposedly followed for the past few hours. It's got me worried a bit as security audit log shows nothing. Something stinks so think I'll change my password to be safe.
      - abdullahi1 9y ago
        Same with me as well, nothing in the security log. Something is definitely wrong here, how could I get subscribed to issues on a project I've never heard of. Was my account compromised? I've even had 2 Factor Authentication enabled since July 2017.
        9y ago
- mrexodia 9y ago
  Main author of x64dbg here. This is very probably the case and I contacted Github support to figure out what is going on. Before today we had around 3k (legit) stars.
  - ribosometronome 9y ago
    I've never heard of your project but woke up this morning when my phone started buzzing with alerts from issue #1864. Looks like my account somehow has ended up starring and watching your project. That probably explains why you have replies to that issue saying "Unsubscribe" and "what?"
  - 0x4a42 9y ago
    Whatever the fake stars: thank you for your great tool Mr Exodia. ;)
  - exikyut 9y ago
    Wow. I am very very curious to learn what happened with this. Have GitHub told you anything yet?
- Andoryuuta 9y ago
  I agree that something is up with the stars. It was <10k some weeks ago, which was the last time I was on the GitHub page. Also, it seem that new issues on the tracker are being flooded with spam (https://github.com/x64dbg/x64dbg/issues/1864 https://github.com/x64dbg/x64dbg/issues/1864). With that being said, the x64dbg project itself is definitely not just some spam project. I've been using it in place of OllyDbg for about 2 years now and I like it alot. IMO, it's basically a modern open-source successor to OllyDbg. Also, the project blog has some really neat posts like weekly digests of what has changed in the project (Though, I think these might have stopped sadly), unpacking windows kernel drivers, and a lot of design problems & solutions.
PhilWright 9y ago
Not a single screenshot of the debugger in action.
- kuroguro 9y ago
  Just go to their website... https://x64dbg.com/ https://x64dbg.com/ It's pretty good, actually
SCHiM 9y ago
Absolutely love this debugger. Feels like an improved ollydbg.
- ndh2 9y ago
  Why do you like it? What do you use it for?
  - SCHiM 9y ago
    I use it whenever I need to debug a piece of code. For example I like to play with fuzzers, so when one of my fuzzers finds a crash in whatever software I'm fuzzing I'll re-run it in a x64dbg and see what's happening. I'll also use it to debug my own assembly code if I'm working on a low-level project. Projects include trainers for offline games, low-level system inspection tools and/or security tools (such as monitoring which process opens which files etc). Sometimes I need to reverse malware for my job, I'll use both IDA (for static analysis/keeping notes) and x96dbg for dynamic analysis.
grkevin 9y ago
That would be cool!
ckein366 9y ago
Hi
lostmsu 9y ago
x32 is not the correct name for 32 bit Windows. It is confusing, because it crashes with the new Linux kernel x32 ABI.
stevemk14ebr 9y ago
I've used this debugger for quite a while. It's excellent. Clean UI, feature rich, and all around stable. The UI is familiar (kinda like olly), but also new fealing. Highly recommend
Graziano_M 9y ago
Other than the stupid name, this is a great debugger, completely replaced OllyDBG for me.

73 points by donutloop 9y ago

ndh2 9y ago

> C-like expression parser What does that mean? What can you do with that? > Source code view Does it understand programming languages? Can you inspect the contents of variables like in VS? My impression is that the focus is on debugging executables where source level access is unavailable. Cracking, reverse engineering. Are there people who use it for development?

mrexodia 9y ago
> What does that mean? What can you do with that? That you can use c-like expressions in various places (the command bar, goto dialog, calculator, conditional breakpoints) > Does it understand programming languages? Can you inspect the contents of variables like in VS? No and not yet, it just uses the symbols of an executable to display a source code listing. I only know of a few asm developers that use it for development but the main use case is reverse engineering and malware analysis.

kamranahmed_se 9y ago

Spam!!!! Almost all the stars are from the throwaway/spam accounts!

exikyut 9y ago
This is being downvoted, but in the process of trying to disprove this I actually discovered it could be true. Two recent stargazers are http://archive.is/cbPm1 http://archive.is/cbPm1 and http://archive.is/o0uzH; http://archive.is/o0uzH; both accounts are in "cn" and use an email address with an invalid TLD. Another two, http://archive.is/x5IBA http://archive.is/x5IBA and http://archive.is/KUnOg http://archive.is/KUnOg, have less "definitely spam" indicators; the only thing they have in common is that x64dbg is the only repo they've starred, that they have no other activity, and that they were created ~two days ago. Have fun poking through the stargazer list. I'm very curious as to explanations. Right now I'm not sure whether to wonder if this HN submission is a stargazer-generating demonstration or if I'm just seeing normal github activity (where "normal" means "spammers doing their weird thing").
- donutloop 9y ago
  i don't know, i like this debugger
  - exikyut 9y ago
    Note that I have no issue with x64dbg and don't suspect the project. See the other very strange comments elsewhere in this subthread
- ribosometronome 9y ago
  I think there might actually be something going on weird with this project on Github's end. I've never heard of this project but started getting alerts in my email for it this morning. My account has apparently stared and watched this project. I hadn't used that account for awhile and the security page for my account doesn't show any logins for my account except from this morning, which leads me to believe that it probably wasn't compromised.
  - wisp2 9y ago
    The same happened with my Github account.
  - hdougie 9y ago
    Same here, been getting lots of emails regarding issues I've supposedly followed for the past few hours. It's got me worried a bit as security audit log shows nothing. Something stinks so think I'll change my password to be safe.
    - abdullahi1 9y ago
      Same with me as well, nothing in the security log. Something is definitely wrong here, how could I get subscribed to issues on a project I've never heard of. Was my account compromised? I've even had 2 Factor Authentication enabled since July 2017.
      - 9y ago
mrexodia 9y ago
Main author of x64dbg here. This is very probably the case and I contacted Github support to figure out what is going on. Before today we had around 3k (legit) stars.
- ribosometronome 9y ago
  I've never heard of your project but woke up this morning when my phone started buzzing with alerts from issue #1864. Looks like my account somehow has ended up starring and watching your project. That probably explains why you have replies to that issue saying "Unsubscribe" and "what?"
- 0x4a42 9y ago
  Whatever the fake stars: thank you for your great tool Mr Exodia. ;)
- exikyut 9y ago
  Wow. I am very very curious to learn what happened with this. Have GitHub told you anything yet?
Andoryuuta 9y ago
I agree that something is up with the stars. It was <10k some weeks ago, which was the last time I was on the GitHub page. Also, it seem that new issues on the tracker are being flooded with spam (https://github.com/x64dbg/x64dbg/issues/1864 https://github.com/x64dbg/x64dbg/issues/1864). With that being said, the x64dbg project itself is definitely not just some spam project. I've been using it in place of OllyDbg for about 2 years now and I like it alot. IMO, it's basically a modern open-source successor to OllyDbg. Also, the project blog has some really neat posts like weekly digests of what has changed in the project (Though, I think these might have stopped sadly), unpacking windows kernel drivers, and a lot of design problems & solutions.

PhilWright 9y ago

Not a single screenshot of the debugger in action.

kuroguro 9y ago
Just go to their website... https://x64dbg.com/ https://x64dbg.com/ It's pretty good, actually

SCHiM 9y ago

Absolutely love this debugger. Feels like an improved ollydbg.

ndh2 9y ago
Why do you like it? What do you use it for?
- SCHiM 9y ago
  I use it whenever I need to debug a piece of code. For example I like to play with fuzzers, so when one of my fuzzers finds a crash in whatever software I'm fuzzing I'll re-run it in a x64dbg and see what's happening. I'll also use it to debug my own assembly code if I'm working on a low-level project. Projects include trainers for offline games, low-level system inspection tools and/or security tools (such as monitoring which process opens which files etc). Sometimes I need to reverse malware for my job, I'll use both IDA (for static analysis/keeping notes) and x96dbg for dynamic analysis.

grkevin 9y ago

That would be cool!

ckein366 9y ago

lostmsu 9y ago

x32 is not the correct name for 32 bit Windows. It is confusing, because it crashes with the new Linux kernel x32 ABI.

stevemk14ebr 9y ago

I've used this debugger for quite a while. It's excellent. Clean UI, feature rich, and all around stable. The UI is familiar (kinda like olly), but also new fealing. Highly recommend

Graziano_M 9y ago

Other than the stupid name, this is a great debugger, completely replaced OllyDBG for me.