#x64dbg

/

      • jmg
        dllmain doesnt appear
      • x64dbgbot
        <mrfearless> might have to choose another exported dll function to follow in disasm
      • jmg
        only dllloader64_a414.exe
      • x64dbgbot
        <mrfearless> click on that in left modules column
      • <mrfearless> right column should show functions imported and exported
      • jmg
        they are completely wrong
      • x64dbgbot
        <mrfearless> whats wrong?
      • jmg
        its showing me the function table for dllloader64_a414.exe instead of the dll i need to look at
      • hang on ill download latest, this one is a month old
      • x64dbgbot
        <mrfearless> sorry, yes your right, clicking exe is incorrect, should have your dll in the list of modules on left, so clicking on that will show the functions in the right
      • <mrfearless> also you can uncheck break on system checkpoint in options->preferences, and check entry breakpoint and dll entry
      • jmg
        dll isnt loaded as a module
      • x64dbgbot
        <mrfearless> then it should bring you closer to the entry point when it breaks
      • <mrfearless> thats strange, i tested with msobj120.dll and it shows in the mdoule list along with the dllloader32_323b.exe
      • jmg
        ok that works, but its offsets are completely wrong
      • x64dbgbot
        <mrfearless> well cant really load a dll directly, so the loader is a workaround to get it as close as is possible to show it
      • jmg
        do i change it to relative somehow?
      • x64dbgbot
        <mrfearless> other option is to debug main program that uses dll and check box for break on dll entry
      • jmg
        its IE :D
      • hmm
      • x64dbgbot
        <mrfearless> i know ida has a rebase option
      • roL
        also loadlib command might be helpful
      • x64dbgbot
        <mrexodia> jmg read the manual
      • <mrexodia> You will learn how to address by file offset and rva
      • roL
        is it by-design to have "follow in dump" use the tab index, rather than the tab title? If you detach and close a tab, it'll re-appear on the end, which screws up the ordering. If I then "follow in dump -> 1", it'll appear in "Dump 2", which is first by order.
      • (Apr 20 2017)
      • Hmm, might be related to #1540/ #1596
      • roL gets a fresh download
      • x64dbgbot
        [Github] rotateLeft opened an issue in x64dbg/x64dbg: Detached + Closed Dump tab causes "Follow in Dump" to fail. https://github.com/x64dbg/x64dbg/issues/1609
      • [Github] rotateLeft opened an issue in x64dbg/x64dbg: Dump tab names should be consistent in "Follow in Dump" submenu https://github.com/x64dbg/x64dbg/issues/1610
      • fevral has quit
      • m4v3rick joined the channel
      • m4v3ricks joined the channel
      • m4v3rick has quit
      • m4v3rick joined the channel
      • m4v3ricks has quit
      • m4v3ricks joined the channel
      • m4v3rick has quit
      • m4v3rick joined the channel
      • m4v3ricks has quit
      • m4v3ricks joined the channel
      • m4v3rick has quit
      • m4v3rick joined the channel
      • m4v3ricks has quit