AbstractTableView Edit columns AppearanceDialog Appearance Colors Color #FFFFFF Background Color X Properties Font General Tables: Disassembly: HexDump: Stack: Registers: HexEdit: &Application Font* Courier New &Defaults Normal Bold Italic Bold + Italic 6 7 8 9 10 11 12 14 16 18 20 22 Log: &Cancel &Save Select Color Settings saved! Text Header Text Background Selection Separators Bytes Modified Bytes Restored Bytes RIP EIP Breakpoints Hardware Breakpoints Bookmarks Comments Automatic Comments Mnemonic Brief Comments Labels Addresses Selected Addresses Conditional Jump Lines (jump) Conditional Jump Lines (no jump) Unconditional Jump Lines Traced line Function Lines Loop Lines SideBar: Register Labels Bullets Disabled Breakpoints Unconditional Jump Lines (jump) Unconditional Jump Lines (no jump) Jump Lines (executing) Code Folding Checkbox Color Modified Registers Register Names Argument Register Names Extra Information Instructions: Highlighting Commas Prefixes Values Mnemonics Push/Pops Calls Returns Conditional Jumps Unconditional Jumps NOPs FAR INT3s Unusual Instructions General Registers FPU Registers MMX Registers XMM Registers YMM Registers ZMM Registers Memory Sizes Memory Segments Memory Brackets Memory Stack Brackets Memory Base Registers Memory Index Registers Memory Scales Memory Operators (+/-/*) Inactive Text RSP ESP Return To Comment SEH Chain Comment User Stack Frame Line System Stack Frame Line Wildcards Graph Unconditional branch line True branch line False branch line Terminal node shadow Other: Current Thread Watch (When Watchdog is Triggered) Memory Map Breakpoint Memory Map %1 Memory Map Section Text Search Highlight Color NOT FOUND IN CONFIG! &Default Value &Current Setting AssembleDialog 0 Keep &Size &Fill with NOP's &XEDParse &Keystone &asmjit OK Cancel <font color='orange'><b>Instruction decoding error</b></font> empty instruction <font color='orange'><b>Instruction encoding error: %1</b></font> <font color='red'><b>Instruction bigger by %1 %2...</b></font> byte bytes <font color='#00cc00'><b>Instruction smaller by %1 %2...</b></font> <font color='#00cc00'><b>Instruction is same size!</b></font> <font color='#00cc00'><b>Instruction encoded successfully!</b></font> AttachDialog Attach <a href="http://faq.x64dbg.com">Why is process X not shown?</a> Refresh &Attach &Cancel PID Path Command Line Arguments BreakpointsView Software Address Name Module/Label State Hit count Log text Condition Fast resume Command on hit Comment Hardware Memory Module Software breakpoint Hardware breakpoint Memory breakpoint DLL breakpoint Inactive Enabled Disabled &Edit &Remove E&nable &Disable &Add Enter the module name Example: mydll.dll Remove All Reset hit count Enable All Disable All &Copy Bridge References BrowseDialog Dialog Please input the file path. Path: &Browse... &OK &Cancel CPUArgumentWidget Form Unlocked [Formatting Error] Follow %1 in %2 Disassembler Dump Stack &Copy Default (x64 fastcall) Default (stdcall) Default (stdcall, EBP stack) thiscall Delphi (Borland fastcall) Locked Calls CPUDisassembly &Selected Address &Address: &Constant: &Value: Address: Constant: &Edit &Fill... Fill with &NOPs &Copy &Paste Paste (&Ignore Size) &Binary &Selection Selection (&No Bytes) &Address &RVA Disassembly &Restore selection Toggle Edit Set Hardware on Execution Remove Hardware Replace Slot 0 (Free) Replace Slot 1 (Free) Replace Slot 2 (Free) Replace Slot 3 (Free) Breakpoint Replace Slot %1 (0x%2) &Follow in Dump &Follow in Disassembler Open Source File Selection Function Decompile Graph Help on Symbolic Name Help on mnemonic Show mnemonic brief Hide mnemonic brief &Highlighting mode Disable Branch Destination Preview Enable Branch Destination Preview Label Current Address Label Disable Bit Byte Word Trace record Comment Toggle Bookmark Analyze module Add function Delete function Argument Add argument Delete argument Analyze single function Remove analysis from module Remove analysis from selection Treat selection &head as Treat from &selection as Analysis Assemble Patches &Yara... Set New Origin Here Create New Thread Here Origin Previous Next Expression File Offset Start of Page End of Page Start of Function End of Function Go to xrefs... C&ommand &Constant &String references &Intermodular calls &Pattern Current Region Current Module All Modules &Search for &Selected Address(es) Find &references to Current address is not executable Setting software breakpoint here may result in crash. Do you really want to continue? Add label at Error! DbgSetLabelAt failed! Add comment at DbgSetCommentAt failed! DbgSetBookmarkAt failed! Assemble at %1 Failed to assemble instruction " %1 " (%2) Not inside a module... Goto File Offset in Enter Constant Find Pattern... Edit code at %1 Fill code at %1 Selection not in a module... Failed to assemble instruction " Failed to set trace record. Argument for the new thread Size CPUDump B&inary &Edit &Fill... &Copy Paste (&Ignore Size) Save To a File &Restore selection Follow in Stack Follow in Disassembler &Follow QWORD in Disassembler &Follow DWORD in Disassembler &Follow QWORD in Current Dump &Follow DWORD in Current Dump &Follow QWORD in Dump &Follow DWORD in Dump &Sync with expression Entrop&y... Set &Label &Modify Value &Breakpoint Hardware, &Access &Byte &Word &Dword &Qword Hardware, &Write Hardware, &Execute Remove &Hardware Memory, Access &Singleshoot &Restore on hit Memory, Write Memory, Execute Remove &Memory &Find Pattern... &Yara... Data co&py... Find &References &Go to &Expression File Offset Start of Page End of Page Previous Next &Hex &Extended ASCII &Codepage... &Text &ASCII &Integer &Float &Address &Disassembly Add label at Error! DbgSetLabelAt failed! Modify value Enter expression to follow in Dump... Not inside a module... Goto File Offset in %1 Hex ASCII UNICODE Signed short (16-bit) &Paste Watch QWORD Watch DWORD Allocate Memory Signed byte (8-bit) Signed long (32-bit) Signed long long (64-bit) Unsigned byte (8-bit) Unsigned short (16-bit) Unsigned long (32-bit) Unsigned long long (64-bit) Hex short (16-bit) Hex long (32-bit) Hex long long (64-bit) &Float (32-bit) &Double (64-bit) &Long double (80-bit) Float (32-bit) Double (64-bit) Long double (80-bit) Address Comments Not yet supported! Edit data at %1 Fill data at %1 Save to file All files (*.*) Find Pattern... Dump Entropy (Address: %1, Size: %2) Enter expression to sync with... Size Warning You're trying to allocate a zero-sized buffer just now. Error The size of buffer you're trying to allocate exceeds 1GB. Please check your expression to ensure nothing is wrong. Memory allocation failed! CPUInfoBox Address RVA File Offset Jump is taken Jump is not taken &Selected Address &Address: &Constant: &Value: &Follow in Dump &Copy CPUMultiDump Dump Watch Change Tab %1 Name Tab Name CPUSideBar Cannot fold selection. Breakpoint Enabled Breakpoint Disabled Breakpoint Not Set CPUStack Comments P&ush DWORD... P&ush QWORD... P&op DWORD P&op QWORD Align Stack Pointer B&inary &Edit &Fill... &Copy &Paste Paste (&Ignore Size) Brea&kpoint Hardware, Access &Byte &Word &Dword &Qword Hardware, Write Remove &Hardware Memory, Access Memory, Write &Singleshoot &Restore on hit Remove &Memory &Restore selection Modify Follow R&SP Follow R&BP Follow E&SP Follow E&BP Freeze the stack &Find Pattern... Go to &Expression Go to Previous Go to Next Go to Base of Stack Frame Follow DWORD in Dump Follow QWORD in Dump &Watch DWORD &Watch QWORD Push DWORD Push QWORD Go to Next Stack Frame Go to Previous Stack Frame &Follow in Disassembler Follow DWORD in &Dump Follow QWORD in &Dump Dump %1 Follow DWORD in &Stack Follow QWORD in &Stack Unfreeze the stack Enter expression to follow in Stack... Edit data at %1 Fill data at %1 Find Pattern... CPUWidget Form Goto Ctrl+G CalculatorDialog Calculator &Follow in Disassembler XXXX Expression: Octal: Unsigned: Hexadecimal: ASCII: 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0001 0010 Binary: XXX Unicode: Signed: &Close Follow in &Dump CallStackView Address To From Comment Follow &Address Follow &To Follow &From &Copy CloseDialog Closing Debugger... CodepageSelectionDialog Select Codepage... &OK &Cancel ColumnReorderDialog Dialog Displayed <- &Add &Hide -> &Up &Down << A&dd all Available &Ok &Cancel Error There isn't anything to display yet! CommandHelpView Form Module Command Initialize debugging a file. Example: InitDebug "C:\test.exe", commandline, "C:\homeDir" Stop debugging (terminate the target). Example: StopDebug Resume debugging. Example: run Configuration File -> Open File -> Attach File -> Detach File -> Exit View -> CPU View -> Log View -> Breakpoints View -> Memory Map View -> Call Stack View -> Notes View -> SEH View -> Script View -> Symbol Info View -> Source View -> References View -> Threads View -> Patches View -> Comments View -> Labels View -> Bookmarks View -> Functions View -> Snowman View -> Handles View -> Graph Debug -> Run Debug -> Run until selection Debug -> Run until expression Debug -> Pause Debug -> Restart Debug -> Close Debug -> Step into Debug -> Step into (source) Debug -> Step over Debug -> Step over (source) Debug -> Execute till return Debug -> Run (pass exceptions) Debug -> Run (swallow exception) Debug -> Step into (pass execptions) Debug -> Step into (swallow exception) Debug -> Step over (pass execptions) Debug -> Step over (swallow exception) Debug -> Execute till return (pass exceptions) Debug -> Run to user code Debug -> Skip next instruction Debug -> Command Debug -> Trace Into Conditional Debug -> Trace Over Conditional Debug -> Trace Record -> Bit Debug -> Trace Record -> None Debug -> Undo instruction Debug -> Animate into Debug -> Animate over Debug -> Animate command Plugins -> Scylla Favourites -> Manage Favourite Tools Options -> Preferences Options -> Appearance Options -> Shortcuts Options -> Topmost Options -> Reload style.css Help -> About Help -> Donate Help -> Check for Updates Help -> Calculator Help -> Report Bug Help -> Manual Help -> Generate Crash Dump Actions -> Find Strings Actions -> Find Intermodular Calls Actions -> Toggle Breakpoint Actions -> Toggle Bookmark Actions -> Delete Breakpoint Actions -> Enable/Disable Breakpoint Actions -> Binary Edit Actions -> Binary Fill Actions -> Binary Fill NOPs Actions -> Binary Copy Actions -> Binary Paste Actions -> Binary Paste (Ignore Size) Actions -> Undo Selection Actions -> Set Label Actions -> Set Comment Actions -> Toggle Function Actions -> Toggle Argument Actions -> Assemble Actions -> Yara Actions -> Set New Origin Here Actions -> Goto Origin Actions -> Goto Previous Actions -> Goto Next Actions -> Goto Expression Actions -> Goto Start of Page Actions -> Goto End of Page Actions -> Goto Start of Function Actions -> Goto End of Function Actions -> Goto File Offset Actions -> Find References to Selected Address Actions -> Find Pattern Actions -> Find References Actions -> xrefs... Actions -> Analyze Single Function Actions -> Analyze Module Actions -> Help on Mnemonic Actions -> Toggle Mnemonic Brief Actions -> Highlighting Mode Actions -> Enable/Disable Branch Destination Preview Actions -> Find Actions -> Decompile Function Actions -> Decompile Selection Actions -> Edit breakpoint Actions -> Enable/Disable Logging Actions -> Allocate Memory Actions -> Free Memory Actions -> Sync With Expression Actions -> Entropy Actions -> Copy All Registers Actions -> Mark As User Module Actions -> Mark As System Module Actions -> Mark As Party Actions -> Set Hardware Breakpoint (Execute) Actions -> Remove Hardware Breakpoint Actions -> Remove Analysis From Module Actions -> Remove Analysis From Selection Actions -> Treat Selection As Code Actions -> Treat Selection As Byte Actions -> Treat Selection As Word Actions -> Treat Selection As Dword Actions -> Treat Selection As Fword Actions -> Treat Selection As Qword Actions -> Treat Selection As Tbyte Actions -> Treat Selection As Oword Actions -> Treat Selection As Float Actions -> Treat Selection As Double Actions -> Treat Selection As LongDouble Actions -> Treat Selection As ASCII Actions -> Treat Selection As UNICODE Actions -> Treat Selection As MMWord Actions -> Treat Selection As XMMWord Actions -> Treat Selection As YMMWord Actions -> Increase Register Actions -> Decrease Register Actions -> Increase Register by Actions -> Decrease Register by Actions -> Zero Register Actions -> Set Register to One Actions -> Toggle Register Value Actions -> Copy Actions -> Copy Address Actions -> Copy Symbol Actions -> Load Script Actions -> Reload Script Actions -> Unload Script Actions -> Run Script Actions -> Toggle Script Breakpoint Actions -> Run Script to Cursor Actions -> Step Script Actions -> Abort Script Actions -> Execute Script Command Actions -> Refresh Actions -> Graph Actions -> Graph -> Toggle overview Actions -> Increment x87 Stack Actions -> Decrement x87 Stack Actions -> Push Actions -> Pop Actions -> Redirect Log Actions -> Browse in Explorer Actions -> Download Symbols for This Module Actions -> Download Symbols for All Modules Actions -> Create New Thread Here NOT FOUND IN CONFIG! DBG %u functions Indirect pointer: 0x%p 0x%p %u functions discovered! This kind of analysis doesn't work on x32 executables... this command is debug-only Saving database... Failed to write database file! Loading commandline... Loading database... Invalid database file! Failed to read database file! Invalid database file (JSON)! Warning: Failed to create database folder '%s'. Path may be read only. Database file: %s missing operand failed to convert operand operand value too big invalid operand (FromHex failed) invalid size (expected %llu, got %llu) invalid size (expected %u, got %u) 80bit extended float is not supported invalid string literal string too long dest buffer too small Thread switched from %X to %X ! Module: %s - (switched from %s) File: %s - PID: %X - %sThread: %s%s %s breakpoint "%s" at %s (%p)! %s breakpoint at %s (%p)! %s breakpoint "%s" at %p! %s breakpoint at %p! execute read/write write Hardware breakpoint (%s%s) "%s" at %s (%p)! Hardware breakpoint (%s%s) at %s (%p)! Hardware breakpoint (%s%s) "%s" at %p! Hardware breakpoint (%s%s) at %p! (read) (write) (execute) (read/write/execute) Memory breakpoint%s "%s" at %s (%p, %p)! Memory breakpoint%s at %s (%p, %p)! Memory breakpoint%s "%s" at %p (%p)! Memory breakpoint%s at %p (%p)! DLL Load DLL Unload DLL Load and unload Breakpoint reached not in list! User code reached at %s (%p)! Breakpoint %p has been disabled because the bytes don't match! Expected: %02X %02X, Found: %02X %02X Could not set breakpoint %p! (SetBPX) MemRead failed on breakpoint address%p! Could not set memory breakpoint %p! (SetMemoryBPXEx) You can only set 4 hardware breakpoints DLL Breakpoint %s(%s):Module %s DLL Breakpoint(%s):Module %s Could not set hardware breakpoint %p! (SetHardwareBreakPoint) Set hardware breakpoint on %p! Could not delete breakpoint %p! (DeleteBPX) Could not delete memory breakpoint %p! (RemoveMemoryBPX) Could not delete hardware breakpoint %p! (DeleteHardwareBreakPoint) Trace finished after %llu steps! Trace finished after %u steps! Bad tracing state. ??? (GetFileNameFromHandle failed) Process Started: %p %s TLS Callbacks: %d Failed to get TLS callback addresses! TLS Callback %d %d invalid TLS callback addresses... entry breakpoint Process stopped with exit code 0x%X Thread Thread %X created, Entry: %p No threads left to switch to (bug?) Thread %X exit Attach breakpoint reached! System breakpoint reached! Error: Cannot load global initialization script. Error: Cannot load debuggee initialization script. TLS Callback DLL Loaded: %p %s DLL Unloaded: %p %s DebugString: "%s" DetachDebuggerEx failed... Detached! paused! SetThreadName(%X, "%s") First chance exception on %p (%.8X, %s)! First chance exception on %p (%.8X)! Last chance exception on %p (%.8X, %s)! Last chance exception on %p (%.8X)! Delete breakpoint failed (BpDelete): %p Delete breakpoint failed (DeleteBPX): %p Could not enable breakpoint %p (SetBPX) Could not enable breakpoint %p (BpEnable) Could not disable breakpoint %p (BpEnable) Could not disable breakpoint %p (DeleteBPX) Did not enable hardware breakpoint %p (all slots full) Could not enable hardware breakpoint %p (BpEnable) Could not enable hardware breakpoint %p (SetHardwareBreakPoint) Could not disable hardware breakpoint %p (BpEnable) Could not disable hardware breakpoint %p (DeleteHardwareBreakPoint) Could not enable memory breakpoint %p (BpEnable) Could not enable memory breakpoint %p (SetMemoryBPXEx) Could not disable memory breakpoint %p (BpEnable) Could not disable memory breakpoint %p (RemoveMemoryBPX) Could not enable DLL breakpoint %s (BpEnable) Could not enable DLL breakpoint %s (LibrarianSetBreakPoint) Could not disable DLL breakpoint %s (BpEnable) Could not disable DLL breakpoint %s (LibrarianRemoveBreakPoint) Could not delete DLL breakpoint %s (BpDelete) Could not delete DLL breakpoint %s (LibrarianRemoveBreakPoint) Delete memory breakpoint failed (BpDelete): %p Delete memory breakpoint failed (RemoveMemoryBPX): %p Delete hardware breakpoint failed (BpDelete): %p Delete hardware breakpoint failed (DeleteHardwareBreakPoint): %p Error starting process (CreateProcess, %s)! IsWow64Process failed! Use x32dbg to debug this process! Use x64dbg to debug this process! Debugging stopped! not enough arguments! Resolved shortcut "%s"->"%s" File does not exist! Could not open file! Invalid PE file! Use x32dbg to debug this file! Use x64dbg to debug this file! The debuggee does not stop after 10 seconds. The debugger state may be corrupted. Not enough arguments! Invalid type specified! Default breakpoint type set to: %s Invalid addr: "%s" Breakpoint already set! Error setting breakpoint at %p! (IsBPXEnabled) Error setting breakpoint at %p! (memread) Error setting breakpoint at %p! (bpnew) Error setting breakpoint at %p! (SetBPX) Breakpoint at %p set! No breakpoints to delete! All breakpoints deleted! Delete breakpoint failed (bpdel): %p No such breakpoint "%s" Breakpoint deleted! No breakpoints to enable! All breakpoints enabled! Breakpoint already enabled! Breakpoint enabled! No breakpoints to disable! All breakpoints disabled! Breakpoint already disabled! Breakpoint disabled! not enough arguments! Can't set %s on breakpoint "%s" breakpoint name break condition logging text logging condition command on hit command condition Can't set hit count on breakpoint "%s" Can't set fast resume on breakpoint "%1" Can't set singleshoot on breakpoint "%1" Can't set silent on breakpoint "%1" argument count mismatch! Invalid type, assuming 'x' Invalid size, using 1 Address not aligned to %d Hardware breakpoint already set! Error setting hardware breakpoint (bpnew)! Error setting hardware breakpoint (TitanEngine)! Hardware breakpoint at %p set! No hardware breakpoints to delete! All hardware breakpoints deleted! Delete hardware breakpoint failed: %p (BpDelete) Delete hardware breakpoint failed: %p (DeleteHardwareBreakPoint) No such hardware breakpoint "%s" Hardware breakpoint deleted! No hardware breakpoints to enable! All hardware breakpoints enabled! Hardware breakpoint already enabled! Could not enable hardware breakpoint %p (SetHardwareBreakpoint) Hardware breakpoint enabled! No hardware breakpoints to disable! All hardware breakpoints disabled! Hardware breakpoint already disabled! Could not disable hardware breakpoint %p (DeleteHardwareBreakpoint) Hardware breakpoint disabled! Invalid type (argument ignored) Memory breakpoint already set! Error setting memory breakpoint! (BpNew) Error setting memory breakpoint! (SetMemoryBPXEx) Memory breakpoint at %p set! no memory breakpoints to delete! All memory breakpoints deleted! Delete memory breakpoint failed: %p (BpDelete) Delete memory breakpoint failed: %p (RemoveMemoryBPX) No such memory breakpoint "%s" Memory breakpoint deleted! No memory breakpoints to enable! All memory breakpoints enabled! Memory memory already enabled! Memory breakpoint enabled! No memory breakpoints to disable! All memory breakpoints disabled! Memory breakpoint already disabled! Memory breakpoint disabled! Something went wrong... Error creating Dll breakpoint! (BpNewDll) Error creating Dll breakpoint! (LibrarianSetBreakPoint) No DLL breakpoints to disable! All DLL breakpoints disabled! No such DLL breakpoint "%s" DLL breakpoint already disabled! Could not disable DLL breakpoint %s (LibrarianSetBreakPoint) DLL breakpoint disabled! No DLL breakpoints to enable! All DLL breakpoints enabled! DLL breakpoint already enabled! DLL breakpoint enable! Skipped INT3! Debugger hidden Something went wrong Run to party is busy. Not enough arguments Trace already active Invalid expression "%s" VirtualAllocEx failed $lastalloc is zero, provide a page address VirtualFreeEx failed Invalid address specified Memset failed Memory %p (size: %.8X) set to %.2X %ums Program is not running Error suspending thread Error resuming thread Error loading Scylla.dll! Could not find export 'ScyllaStartGui' inside Scylla.dll Scylla is already loaded Could not open process %X! Could not get module filename %X! Invalid address "%s"! Invalid stack address! Exception will be swallowed Exception will be thrown in the program Dll breakpoint set on "%s"! No DLL breakpoints to delete! All DLL breakpoints deleted! Failed to remove DLL breakpoint... DLL breakpoint removed! Not debugging! Invalid thread %X Thread switched! Thread suspended Thread resumed! Thread terminated Error terminating thread! Create thread failed! Thread %X created at %s %p(Argument=%llX) Thread %X created at %s %p(Argument=%X) %d/%d thread(s) suspended %d/%d thread(s) resumed Unknown priority value, read the help! Error setting thread priority Thread priority changed! Failed to change the name for thread %X Thread name set to "%s"! Thread name changed from "%s" to "%s"! This may take very long, depending on your network connection and data in the debug directory... Done! See symbol log for more information Invalid module "%s"! GetModuleFileNameExA failed! SymGetSearchPath failed! SymSetSearchPath (1) failed! SymUnloadModule64 failed! SymLoadModuleEx failed! SymSetSearchPathW (2) failed! Error getting JIT auto %s Unknown JIT auto entry type. Use x64 or x32 as parameter. Error using x64 arg the debugger is not a WOW64 process Unknown JIT auto entry type. Use x64 or x32 as parameter JIT auto %s: %s Error run the debugger as Admin to setjitauto Error setting JIT Auto. Use ON:1 or OFF:0 arg or x64/x32, ON:1 or OFF:0. Error unknown parameters. Use ON:1 or OFF:0 Error setting JIT auto x64 Error setting JIT auto x32 Error unknown parameters. Use x86 or x64 and ON:1 or OFF:0 Error getting JIT auto x64 Error getting JIT auto x32 Error unknown parameters use x86 or x64, ON/1 or OFF/0 New JIT auto %s: %s Error run the debugger as Admin to setjit Error setting JIT %s Error there is no old JIT entry stored. New OLD JIT stored: %s Unknown JIT entry type. Use OLD, x64 or x32 as parameter. Error using x64 arg. The debugger is not a WOW64 process Error unknown parameters. Use old, oldsave, restore, x86 or x64 as parameter. New JIT %s: %s Error getting JIT %s Error: there is not an OLD JIT entry stored yet. OLD JIT entry stored: %s JIT %s: %s Error: using an address as arg1 Error getting rights of page: %s Page: %p, Rights: %s Error: Using an address as arg1 and as arg2: Execute, ExecuteRead, ExecuteReadWrite, ExecuteWriteCopy, NoAccess, ReadOnly, ReadWrite, WriteCopy. You can add a G at first for add PAGE GUARD, example: GReadOnly Error: Set rights of %p with Rights: %s New rights of %p: %s Error: you must specify the name of the DLL to load Error: couldn't allocate memory in debuggee Error: couldn't write process memory Error: couldn't get kernel32:LoadLibraryA Error allocating memory for cmdline Error converting UNICODE cmdline Error reading PEB base addres Error reading PEB -> ProcessParameters -> CommandLine UNICODE_STRING Error reading PEB -> ProcessParameters pointer address Error Getting remote PEB address Error Getting command line base address Error checking the pattern of the commandline stored Error writing the new command line stored Error getting getcommandline Error allocating the page with UNICODE and ANSI command lines Error writing the ANSI command line in the page Error writing the UNICODE command line in the page Error writing command line UNICODE in PEB Error getting cmdline (Address: %p) Command line: %s Error: write the arg1 with the new command line of the process debugged New command line: %s Stack is now freezed Stack is now unfreezed Invalid line: "%s" Failed to convert number "%s" invalid dest "%s" Cannot restore last instruction. History record is empty unknown command/expression: "%s" Not enough arguments! At least %d arguments must be specified. invalid variable name "%s" invalid value "%s" error creating variable "%s" could not delete variable "%s" deleted variable "%s" invalid hex string "%s" (contains invalid characters) invalid destination "%s" invalid hex byte "%s" failed to write to %p invalid src "%s" no variables! error listing variables! directory doesn't exist current directory changed! error setting comment error deleting comment error setting label error deleting label failed to set bookmark! bookmark set! failed to delete bookmark! bookmark deleted! invalid expression: "%s"! invalid address: %p! failed to assemble "%s" (%s) failed to add function function added! failed to delete function function deleted! all functions deleted! failed to add argument argument added! failed to delete argument argument deleted! all arguments deleted! invalid variable "%s" invalid argument "%s"! Variable size not supported. invalid hex string "%s" (length not divisible by 2) Script Address Data Disassembly Constant: %p Range: %p-%p %u reference(s) in %ums String Strings %u string(s) in %ums no such variable "%s"! failed to set variable "%s"! variable "%s" is not a string! failed to get variable size "%s"! failed to get variable data "%s"! invalid address "%s"! memwrite failed! string written! invalid memory address %p! failed to read memory! Pattern: %s &Data& failed to transform pattern! [Error disassembling] %d occurrences found in %ums MemFindInMap failed! Destination Calls %u call(s) in %ums Comments Comment no comments %d comment(s) listed in Reference View Labels Label no labels %d label(s) listed in Reference View Bookmarks No bookmarks found %d bookmark(s) listed Functions Start End Disassembly (Start) Label/Comment No functions %d function(s) listed Arguments No arguments %d argument(s) listed Loops no loops %d loop(s) listed failed to assemble "%s" (%s)! Command: "%s" %u result(s) in %ums [YARA ERROR] [YARA WARNING] File: "%s", Line: %d, Message: "%s" [YARA] Global rule "%s' matched! [YARA] Rule "%s" matched: [YARA] String "%s" : %s on %p [YARA] Rule "%s" did not match! [YARA] Scan finished! [YARA] Imported module "%s"! invalid value "%s"! failed to get module path for %p! failed to read file "%s"! failed to read memory page %p[%X]! Failed to read the rules file "%s" Rule [YARA] Scan started... %u scan results in %ums... too many matches! error while scanning memory! error while getting the rules! errors in the rules file! yr_compiler_create failed! invalid module "%s"! invalid address "%s" could not read memory at %p failed to disassemble! size: %d, id: %d, opcount: %d operand "%s" %d, register: %s immediate: 0x%p memory segment: %s, base: %s, index: %s, scale: %d, displacement: 0x%p Invalid parameter [base]! Invalid memory address! Invalid parameter [size] Failed to load module (ModLoad)... Virtual module "%s" loaded on %p[%p]! invalid arguments! usage: meminfo a/r, addr invalid argument ReadProcessMemory failed! data: %02X memory map updated! Invalid expression: "%s" Failed to read memory... Failed to write file... %p[% llX] written to "%s" ! %p[% X] written to "%s" ! no description or empty description EncodeMapSetType failed... Could not find the specified privilege: %s DuplicateHandle failed: %s Handle %llX closed! Handle %X closed! Failed to get SEH (disabled?) Failed to get VEH (loaded symbols for ntdll.dll?) Failed to get VCH (loaded symbols for ntdll.dll?) Failed to get UnhandledExceptionFilter (loaded symbols for kernelbase.dll?) Invalid memory address %p! No graph generated... Invalid argument 1 : %s Invalid argument 2 : %s Image information for %s Characteristics (0x%X): None IMAGE_FILE_RELOCS_STRIPPED: Relocation info stripped from file. IMAGE_FILE_EXECUTABLE_IMAGE: File is executable (i.e. no unresolved externel references). IMAGE_FILE_LINE_NUMS_STRIPPED: Line nunbers stripped from file. IMAGE_FILE_LOCAL_SYMS_STRIPPED: Local symbols stripped from file. IMAGE_FILE_AGGRESIVE_WS_TRIM: Agressively trim working set IMAGE_FILE_LARGE_ADDRESS_AWARE: App can handle >2gb addresses IMAGE_FILE_BYTES_REVERSED_LO: Bytes of machine word are reversed. IMAGE_FILE_32BIT_MACHINE: 32 bit word machine. IMAGE_FILE_DEBUG_STRIPPED: Debugging info stripped from file in .DBG file IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP: If Image is on removable media, copy and run from the swap file. IMAGE_FILE_NET_RUN_FROM_SWAP: If Image is on Net, copy and run from the swap file. IMAGE_FILE_SYSTEM: System File. IMAGE_FILE_DLL: File is a DLL. IMAGE_FILE_UP_SYSTEM_ONLY: File should only be run on a UP machine IMAGE_FILE_BYTES_REVERSED_HI: Bytes of machine word are reversed. DLL Characteristics (0x%X): IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE: DLL can move. IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY: Code Integrity Image IMAGE_DLLCHARACTERISTICS_NX_COMPAT: Image is NX compatible IMAGE_DLLCHARACTERISTICS_NO_ISOLATION: Image understands isolation and doesn't want it IMAGE_DLLCHARACTERISTICS_NO_SEH: Image does not use SEH. No SE handler may reside in this image IMAGE_DLLCHARACTERISTICS_NO_BIND: Do not bind this image. IMAGE_DLLCHARACTERISTICS_WDM_DRIVER: Driver uses WDM model. IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE: Remote Desktop Services aware. Reserved (%p) Reserved Thread %X TEB Thread %X WoW64 TEB Thread %X Stack Invalid mnemonic! Too many redirections... invalid instruction No patches to apply Not all patches are in module %s Failed to get base of module %s Failed to get module path of module %s Failed to make a copy of the original file (patch target is in use?) Unable to obtain attributes for copied file StaticFileLoad failed StaticFileUnload failed Invalid memory page 0x%p %s (Region %s) %s (Region %p) Region Search Couldn't locate module for 0x%p Module Search Couldn't get module list All Modules (%s) Error reading memory in reference search FileHelper::ReadAllText failed... Empty label detected on line %d! Duplicate label "%s" detected on lines %d and %d! Invalid branch label "%s" detected on line %d! Script finished! Error executing command! The script is too busy. Would you like to terminate it now? Script is terminated by user. Debugger must be paused to run a script! Pointer to SEH_Record[%d] End of SEH Chain return to %s from %s return to %s from ??? [Formatting Error] SymEnumSymbols failed! SymEnumerateModules64 failed! SymGetSearchPathW failed! SymSetSearchPathW (1) failed! Downloading symbols for %s... GetModuleFileNameExW(%p) failed! SymUnloadModule64(%p) failed! SymLoadModuleEx(%p) failed! Main Thread could not get filename of module %p unable to load library %s not debugging noexpr failed on %s failed to read memory not debugging! invalid value: "%s"! failed to write memory Watchdog %s (expression "%s") is triggered at %p ! Original value: %p, New value: %p Watch %u No enough arguments for addwatch No enough arguments for delwatch Error expression in argument 1. No enough arguments for SetWatchName No enough arguments for SetWatchExpression Unknown watchdog mode. command cut at ~%d characters [Script DLL] Calling export "AsyncStart"... [Script DLL] "AsyncStart" returned! [Script DLL] Calling FreeLibrary... success! failure (%08X)... [Script DLL] Loading Script DLL "%s"... [Script DLL] DLL loaded on 0x%p! [Script DLL] Creating thread to call the export "AsyncStart"... [Script DLL] Calling export "Start"... [Script DLL] "Start" returned! [Script DLL] Failed to find the exports "AsyncStart" or "Start" (%08X)! [Script DLL] LoadLibary failed (%08X)! Initializing wait objects... Initializing debugger... Initializing debugger functions... Setting JSON memory management functions... Initializing capstone... Initializing Yara... Getting directory information... Mnemonic help database loaded! Failed to load mnemonic help database... Failed to read mnemonic help database... Error codes database loaded! Failed to load error codes... Exception codes database loaded! Failed to load exception codes... NTSTATUS codes database loaded! Failed to load NTSTATUS codes... It is strongly discouraged to use symbol servers in your path directly (use the store option instead). Do you want me to fix this? Symbol Path: %s Allocating message stack... Initializing global script variables... Registering debugger commands... Registering GUI command handler... Registering expression functions... Default Registering Script DLL command handler... Script DLL Starting command loop... Loading plugins... Handling command line... Reading notes file... Initialization successful! Stopping running debuggee... The debuggee does not close after 10 seconds. Probably the debugger state has been corrupted. Aborting scripts... Waiting for the debuggee to be stopped... Unloading plugins... Stopping command thread... Cleaning up allocated data... Checking for mem leaks... %d memory leak(s) found! Cleaning up wait objects... Cleaning up debugger threads... Saving notes... Exit signal processed successfully! Failed on ks_open()... ks_asm() failed: count = %lu, error = %u Non-executable memory region Assembled branch does not point to an executable memory region! Error while writing process memory [PLUGIN] Failed to load plugin: %s [PLUGIN] Export "pluginit" not found in plugin: %s [PLUGIN] pluginit failed for plugin: %s [PLUGIN] %s is incompatible with this SDK version [PLUGIN] %s v%d Loaded! [PLUGIN] GuiMenuAdd(GUI_PLUGIN_MENU) failed for plugin: %s [PLUGIN] GuiMenuAdd(GUI_DISASM_MENU) failed for plugin: %s [PLUGIN] GuiMenuAdd(GUI_DUMP_MENU) failed for plugin: %s [PLUGIN] GuiMenuAdd(GUI_STACK_MENU) failed for plugin: %s [PLUGIN] command "%s" registered! [PLUGIN] command "%s" unregistered! [PLUGIN] expression function "%s" registered! [PLUGIN] expression function "%s" unregistered! DataCopyDialog Data Copy Copy C-Style BYTE (Hex) C-Style WORD (Hex) C-Style DWORD (Hex) C-Style QWORD (Hex) C-Style String C-Style Unicode String C-Style Shellcode String Pascal BYTE (Hex) Pascal WORD (Hex) Pascal DWORD (Hex) Pascal QWORD (Hex) GUID DisassemblerGraphView Use Graph command or menu action to draw control flow graph here... Follow in &Disassembler Toggle &Overview EditBreakpointDialog Edit breakpoint &Log Text: &Break Condition: Lo&g Condition: &Name: &Command Text: &Hit Count: C&ommand Condition: Singlesho&ot &Silent &Fast Resume &Save C&ancel Edit Breakpoint %1 EditFloatRegister Dialog Double: Short: Float: Byte: Int64: Long: High: 0-1 2-3 4-5 6-7 8-9 A-B C-D E-F Low: &Hexadecimal &Signed &Unsigned Unified hex value follows memory byte order. &OK &Cancel Error, register size %1 is not supported. EntropyDialog Entropy ExceptionRangeDialog Range Start: End: OK Cancel FavouriteTools Favourites Tools &Add... &Edit &Remove De&scription... &Up &Down Script Command Shortcut Clear &OK &Cancel Path Description Enter the description This string will appear in the menu. Select script Script files (*.txt *.scr);;All files (*.*) Enter the command you want to favourite Example: bphws csp Enter a new command Example: bphws ESP GotoDialog Enter expression to follow... &OK &Cancel <font color='red'><b>Not debugging...</b></font> <font color='red'><b>Invalid expression...</b></font> <font color='red'><b>Empty expression...</b></font> <font color='#00DD00'><b>Correct expression! -&gt; </b></font> <font color='red'><b>Invalid file offset...</b></font> <font color='red'><b>Invalid memory address...</b></font> <font color='red'><b>Memory out of range...</b></font> HandlesView Type Type number Handle Access Name Remote address Local address Privilege State Handles TCP Connections Privileges &Refresh Close handle Disable Privilege: Enable Privilege: Disable all privileges Enable all privileges TCP Connection enumeration is only available on Windows Vista or greater. &Copy Unknown Enabled Disabled HexDump &Selection &Address Error! Selection not in a module... Address HexEditDialog HexEdit &ASCII: &UNICODE: &Hex: &Keep Size &OK &Entire Block &Cancel &Codepage... Enter text to convert... LineEditDialog Dialog CheckBox &OK &Cancel <font color='red'>CT: %1%2</font> LogView Clea&r &Copy Select &All &Save Disable &Logging &Redirect Log... Enable &Logging Stop &Redirection fwrite() failed (GetLastError()= %1 ). Log redirection stopped. Redirect log to file Enter the file to which you want to redirect log messages. Log files(*.txt);;All files(*.*) _wfopen() failed. Log will not be redirected to %1. Log will be redirected to %1. Logging will be enabled. Logging will be disabled. Error, log have not been saved. Log have been saved as %1 MHTabBar &Detach &Delete MainWindow x64dbg &File &Recent Files &View &Debug Trace record &Help &Plugins &Options Favour&ites toolBar &Open E&xit &Run &Pause Re&start &Close Step &into Step &over Co&mmand E&xecute till return &Memory Map &Log Window &About Scylla &Breakpoints Step into (pass exceptions) Step over (pass exceptions) Run (pass exceptions) Execute till return (pass exceptions) &Script Script Run &until selection Run until selection &CPU CPU Symbol &Info Symbol Info &References References &Threads Threads &Preferences Settings &Find Strings Find Strings &Appearance Find Intermodular Calls Patches Comments Labels Bookmarks Functions Check for &Updates Call Stack Shortcuts &Donate Donate Calculator Attach Detach Change Command &Line Skip next instruction Topmost Topmost Window &Report Bug Report Bug &Source Source &Manual &FAQ FAQ SEH Chain Hide debugger (PEB) Reload style.css Notes Snowman Handles Trace over until condition Trace into until condition Bit Byte Word Trace into beyond trace record Trace over beyond trace record Trace into into trace record Trace over into trace record None Run to &user code Run until e&xpression Undo last instruction Generate crash dump &Manage Favourite Tools... Step over (source) Step into (source) &Graph Step into (swallow exception) Step over (swallow exception) Run (swallow exception) Blog Animate into Animate over Animate command... Set Initialization Script Import settings... Log Symbols Breakpoints Memory Map SEH Graph Command: Ready Languages Enter trace into finishing condition. Example: eax == 0 && ebx == 0 Enter trace over finishing condition. About x64dbg About x32dbg Open file Executables (*.exe *.dll);;All files (*.*) Enter expression to run to... Error! Patches cannot be shown when not debugging... All the money will go to x64dbg development. You will visit x64dbg's official blog. You will be taken to a website where you can report a bug. Make sure to fill in as much information as possible. This action will crash the debugger and generate a crash dump. You will LOSE ALL YOUR DATA. Do you really want to continue? Have fun debugging the debugger! Debugger detected! Change Command Line Cannot get remote command line, use the 'getcmdline' command for more information. Could not set command line! New command line: Error Manual cannot be opened. Please check if x64dbg.chm exists and ensure there is no other problems with your system. The translation is nearly empty. Do you still want to use this language? New language setting will take effect upon restart. Animate command Example: StepInto Set Initialzation Script for Debuggee Script files (*.txt *.scr);;All files (*.*) Set Global Initialzation Script Settings (*.ini);;All files (*.*) MemoryMapView Address Size Info Page Information Type Allocation Type Protection Current Protection Initial Allocation Protection &Follow in Dump Follow in &Disassembler Set Page Memory Rights &Switch View Memory &Breakpoint Access &Singleshoot &Restore Write Execute &Remove &Allocate memory &Free memory Find address &page Entropy... &Find Pattern... &Dump Memory to File Add virtual module &Copy Entropy (Address: %1, Size: %2) Error Warning You're trying to allocate a zero-sized buffer just now. The size of buffer you're trying to allocate exceeds 1GB. Please check your expression to ensure nothing is wrong. Memory allocation failed! Find Pattern... All files (*.*) Save Memory Region Address %0 not found in memory map... Enter the address to find... NotesManager Global Debuggee PageMemoryRights Set Page Memory Rights Rights NO ACCESS READ ONLY READ WRITE EXECUTE EXECUTE READ FULL ACCESS WRITE COPY EXECUTE WRITE COPY Set Rights Select ALL Deselect ALL Press CTRL or SHIFT key to select multiple pages PAGE GUARD Address Pages Rights Changed to: Error setting rights, read the MSDN to learn the valid rights of: PatchDialog Patches &Patches &Modules &Select All &Deselect All &Restore Selected Pick &Groups &Patch File &Import &Export Information Nothing to patch! Error! Failed to get module filename... Save file All files (*.*) Failed to save patched file (%1) %1/%2 patch(es) applied! Open patch Patch files (*.1337) The patch file is empty... Patch file format is incorrect... No patches to apply in the current process. Question Some patches are already applied. Do you want to remove these patches? Some bytes do not match the original in the patch file. Do you want to apply these patches anyway? Save patch No patches to export. %1 patch(es) exported! PatchDialogGroupSelector Group Selector 0000000000000000 &Toggle &Previous &Next QObject DbgInit Error! ReferenceManager Close All Tabs ReferenceView &Follow in Disassembler Follow in &Dump Follow &API Address Toggle Breakpoint Toggle Bookmark Set breakpoint on all commands Remove breakpoint on all commands Set breakpoint on all api calls Remove breakpoint on all api calls Total Progress %1% Set breakpoint on all calls to %1 Remove breakpoint on all calls to %1 Error! DbgSetBookmarkAt failed! RegistersView Increment Decrement Zero Set to 1 Modify value Toggle Copy value to clipboard Copy Symbol Value to Clipboard Copy all registers Follow in Disassembler Follow in Dump Follow in Stack Increment x87 Stack Decrement x87 Stack Change view Increase 4 Increase 8 Decrease 4 Decrease 8 Push Pop Highlight Follow in &Dump Dump %1 Hide FPU Show FPU Edit YMM register Edit XMM register Edit FPU register ERROR CONVERTING TO HEX Edit Set Hardware Breakpoint on %1 SEHChainView Address Handler Module/Label Comment Follow &Address Follow Handler &Copy ScriptView Line Text Info &Open... Load Script Re&load Script &Unload Script Toggle &BP Ru&n until selection &Step &Run &Abort &Continue here... &Execute Command... Error on line Script Error! Select script Script files (*.txt *.scr);;All files (*.*) Error setting script breakpoint! Execute Script Command... Error executing command! Message Question SearchListView Type here to filter results... Regex Lock Search: Search... &Copy SelectFields Dialog SettingsDialog Settings Events System Breakpoint* Break on: DLL Load Attach Breakpoint DLL Entry Entry Breakpoint* DLL Unload TLS Callbacks* Thread End Thread Entry Debug Strings Thread Start Engine Calculation Type &Signed &Unsigned Default Breakpoint Type INT3 Long INT3 UD2 Undecorate Symbol Names Enable Debug &Privilege Enable Source Debugging Disable Database Compression Save Database in Program Directory Enable Trace Record Recording during a Trace Skip INT3 stepping No Script Timeout Warning &Ignore inconsistent breakpoints Exceptions Ignored Exceptions: Add &Range &Delete Range Add &Last Disasm Argument Spaces Tab between mnemonic and arguments Memory Spaces Uppercase Autocomments only on CIP GUI Show FPU registers as little endian Save column order and width Don't show close dialog Show PID in HEX Show Watch Labels in Side Bar Misc Symbol Store: Symbol Path: Set x64dbg as Just In Time Debugger JIT: Confirm before attaching <font color="red">DIE SCUM!</font> Enable Load/Save Tab Order Search Engine URL Save Cancel <font color="red"><b>Warning</b></font>: Run the debugger as Admin to enable JIT. Settings saved! ERROR NOT FOUND OLD JIT NOT FOUND OLD JIT ENTRY STORED, USE SETJIT COMMAND Question Are you sure you want to add %.8X? ShortcutsDialog Shortcuts Shortcut Clear &Save &Cancel Instruction Settings saved! SourceView Address Line Code SourceViewerManager Close All Tabs StatusLabel <font color='#00DD00'>Initialized</font> <font color='#ff0000'>Paused</font> Running <font color='#ff0000'>Terminated</font> StdTable &Line Cropped &Table &Full Table &Copy SymbolView Form Base Module Party Address Type Symbol Symbol (undecorated) &Follow in Disassembler Follow in &Dump Toggle Breakpoint Toggle Bookmark Follow &Entry Point in Disassembler &Download Symbols for This Module Download Symbols for &All Modules Copy File &Path Browse in Explorer &Yara Memory... &Yara File... Entropy... Mark as &user module Mark as &system module Mark as &party... Import Export User System Party: %1 &Copy Error! DbgSetBookmarkAt failed! Entropy (%1) Mark the party of the module as Error The party number can only be an integer ThreadView &Copy Normal AboveNormal TimeCritical Idle BelowNormal Highest Lowest Switch Thread Suspend Thread Resume Thread Kill Thread Set Priority Above Normal Suspend All Threads Resume All Threads Set Name Below Normal Time Critical Go to Thread Entry Number ID Entry TEB RIP EIP Suspend Count Priority Wait Reason Last Error User Time Kernel Time Creation Time CPU Cycles Name Main Unknown TimeWastedCounter %1 events/s Time Wasted Debugging: UpdateChecker Network Error! Error! File on server could not be parsed... New build %1 available!<br>Download <a href="%2">here</a><br><br>You are now on build %2 You have a development build (%1) of x64dbg! You have the latest build (%1) of x64dbg! Information VirtualModDialog Virtual Module &Name: &Base: &Size: &OK &Cancel WatchView Name Expression Value Type Watchdog Mode ID %1 is not readable. Disabled Changed Is true Is false Not changed &Add... &Delete Rename &Edit... Watchdog &Copy Enter the expression to watch Example: [EAX] Enter the name of the watch variable WordEditDialog Edit Signed: Unsigned: Bytes: Expression: XrefBrowseDialog Dialog xrefs at %1 YaraRuleSelectionDialog Yara Directory... &File... &Select &Cancel Select Yara Rules Directory... Select Yara Rule...