058c14d8bf
Make source file strings unique, reduces a lot of memory.
2018-07-01 19:27:49 +02:00
bd08f67f47
Load symbols and source line in parallel.
2018-07-01 19:27:49 +02:00
7c6bfcd2c6
Use enumerators Next instead of index, slight performance improvement.
2018-07-01 19:27:48 +02:00
97fa3c1408
Lock when trying to read source lines.
2018-07-01 19:27:48 +02:00
ae050ea4a1
Fix source lines displayed with disp.
2018-07-01 19:27:48 +02:00
cad369f7a5
Refactor DbgHelp source line query references to new symbol interface.
2018-07-01 19:27:48 +02:00
ac6ee608e4
Add source line queries into new symbol interface.
2018-07-01 19:27:48 +02:00
2604384853
Refactor source line queries in DIA interface.
2018-07-01 19:27:47 +02:00
b68c89a12e
Hide undecorated name if identical to decorated.
2018-07-01 19:27:47 +02:00
d6fd79346e
Prioritize private symbols over public.
2018-07-01 19:27:47 +02:00
e648e27346
Use spinlock instead of critical section.
...
Use proper thread termination on destructor.
2018-07-01 19:27:47 +02:00
a0c94caaf6
Cleanup DIA interface some more.
2018-07-01 19:27:46 +02:00
d35996883e
Implement unloading.
2018-07-01 19:27:46 +02:00
0ea92f26eb
Remove unused functions from DIA interface.
2018-07-01 19:27:46 +02:00
Duncan Ogilvie
1b94728118
DBG: buggy implementation of symbol enum
2018-07-01 19:27:46 +02:00
Duncan Ogilvie
03a609c954
lf to crlf
2018-07-01 19:27:45 +02:00
4e2f307052
Tabs to spaces
2018-07-01 19:27:45 +02:00
626695f233
Add PDB load cancellation.
2018-07-01 19:27:45 +02:00
01f0a824ab
Fix marking symbol with wrong type.
2018-07-01 19:27:45 +02:00
b176fb7e46
Initial for async symbol loading.
2018-07-01 19:27:44 +02:00
3a3afa3744
Remove unused DbgHelp loading.
2018-07-01 19:27:44 +02:00
bd173bf01e
Refactor symbol loading/query to use a common interface.
2018-07-01 19:27:44 +02:00
121486a137
Initial implementation of LRU.
...
Initial implementation of MSDIA.
2018-07-01 19:27:44 +02:00
Duncan Ogilvie
95cacb3732
DBG: add information to Zydis command
2018-07-01 19:04:38 +02:00
380df7ba2e
minor parsing bug
2018-06-19 18:51:36 +02:00
ddbeeefab4
Special format to find an inactive breakpoint to edit it.
2018-06-19 18:51:36 +02:00
b59798db6f
minor enhancements about SymbolView&breakpointcpp&SearchListView
2018-06-19 18:51:36 +02:00
Duncan Ogilvie
12e9127799
DBG: support for an edge case in HandlesGetName where the process itself doesn't have query access
2018-06-19 18:30:13 +02:00
f8c67ef2ab
show PID or TID in handles view
2018-06-19 18:30:13 +02:00
Duncan Ogilvie
f5fa7de918
DBG: better message in _dbg_animatecommand
2018-06-11 03:13:25 +02:00
0ab417f5b4
Animation help; Restore empty graph help
2018-06-11 03:12:50 +02:00
Duncan Ogilvie
db17e323fe
DBG: more message fixes
2018-06-03 17:47:01 +02:00
Duncan Ogilvie
01960c556b
fix some whitespace in strings
2018-06-03 17:43:30 +02:00
1cd3cfc469
fix mistakes
2018-06-03 17:43:30 +02:00
4cf5508b5f
add error descriptions to x64dbg failure messages
2018-06-03 17:43:30 +02:00
Duncan Ogilvie
3f33ad44cc
DBG+GUI: update zydis and fix some issues related to formatting
...
closes #1904
closes #1898
2018-04-05 00:20:31 +02:00
Duncan Ogilvie
3f754c0bfc
DBG: fix an out of bounds access on expression "([esp])"
2018-03-26 02:14:49 +02:00
Duncan Ogilvie
1c1a48bcee
DBG: fix heuristic string detection near the end of a page
...
related to #1906
2018-03-05 23:52:07 +01:00
Duncan Ogilvie
f8e4ed4f1f
DBG: fix bug with operand size in TraceRecord
2018-03-04 23:00:13 +01:00
Duncan Ogilvie
8da82cf569
PROJECT: remove keystone
2018-03-04 22:41:00 +01:00
Duncan Ogilvie
e5f950308a
PROJECT: remove capstone
2018-03-04 22:35:01 +01:00
Duncan Ogilvie
55d99b5647
DBG+GUI: replace Capstone with Zydis in trace record
2018-03-04 22:32:08 +01:00
Duncan Ogilvie
49167e92c6
DBG+GUI: fix many application verifier issues
2018-03-04 22:04:37 +01:00
Duncan Ogilvie
53e621c175
DBG: replace WAITID_STOP with a more reliable method
...
closes #1852
2018-03-04 22:04:04 +01:00
Duncan Ogilvie
16fdf57f41
DBG: move call to CB_STOPDEBUG to the very end of the debug loop
...
close issue #1899
2018-02-14 22:19:00 +01:00
Duncan Ogilvie
2c284cd210
DBG: remove std::thread usage from TaskThread
2018-02-14 20:38:49 +01:00
Duncan Ogilvie
1fa1c3d705
DBG: remove limitation of placing "&" in labels
2018-01-30 20:54:45 +01:00
Duncan Ogilvie
ddc97f2a74
DBG: show PEB in memory map
...
#1882
2018-01-28 11:51:15 +01:00
Duncan Ogilvie
39f78b1c33
DBG: remove weak acquire in dbghelp_safe
...
possibly fixes #1863
2018-01-12 14:15:06 +01:00
Duncan Ogilvie
2d6004da9b
DBG: remove TitanEngine for parsing TLS callbacks
2017-12-28 23:25:42 +01:00
Duncan Ogilvie
7c0d122ee4
DBG: add breakpointexceptionaddress variable
2017-12-28 20:27:23 +01:00
Duncan Ogilvie
761e2f67c0
DBG: fix a rare bug with module resolving by name (thanks to chessgod101!)
...
if you had:
blub.exe
blub.exe.dll
And tried to resolve 'blub.exe' it could return the base of 'blub.exe.dll'
2017-12-24 13:21:06 +01:00
Duncan Ogilvie
0e2ff40443
DBG: remove unused parameter from RecursiveAnalysis class
2017-12-17 02:05:53 +01:00
f29d660b6e
Search for function pointer
2017-12-17 02:05:39 +01:00
Duncan Ogilvie
37e83c9436
DBG+GUI: trim error descriptions in RegisterView and format functions
2017-12-03 22:27:47 +01:00
Duncan Ogilvie
e11701d7c3
GUI: improve InfoBox for bigger memory sizes
2017-12-03 22:27:47 +01:00
70a836b17a
Move SafeSymCleanup() call to cbExitProcess so it isn't called when the process may have already terminated
...
debugLoopFunction: set fdProcessInfo->hProcess and fdProcessInfo->hThread to NULL as these shouldn't be used after this point. The actual CloseHandle calls on these two handles are done by kernel32!ContinueDebugEvent immediately after cbExitProcess
2017-11-28 17:29:50 +01:00
2f3f28746d
Remove 2 occurrences of 'varset("$hp", fdProcessInfo->hProcess)', one of which was being called with the initial handle from CreateProcess(). cbCreateProcess is now the only place where this variable is set, for both types of debug sessions (attaching or creating)
2017-11-28 17:29:50 +01:00
629a6022e4
Fix duplicate debuggee process and initial thread handles being kept around in the case that x64dbg is not attaching:
...
- CloseHandle() the fdProcessInfo->hProcess and fdProcessInfo->hThread handles and set them to NULL if CreateProcess was called (i.e. we are not attaching) just before entering the debug loop
- cbCreateProcess(): set fdProcessInfo->hProcess, fdProcessInfo->hThread and varset("$hp") to the correct handles prior to doing anything else
2017-11-28 17:29:50 +01:00
c8e8b692f0
Remove static global handle 'hProcess' in debugger.cpp; it is only used in one place as argument to SafeSymCleanup(). Use fdProcessInfo->hProcess instead
2017-11-28 17:29:50 +01:00
200c861761
fixed winerror & ntstatus fmt funcs
...
Thanks @Mattiwatti
2017-11-17 12:54:30 +01:00
Duncan Ogilvie
1c79384a06
DBG: remove the ordinal flag before printing the value
...
#1795
2017-11-15 13:44:36 +01:00
Duncan Ogilvie
d1edce0872
DBG: small improvement to Handle class
...
By @torusrxxx
2017-11-14 16:00:55 +01:00
Duncan Ogilvie
4db8d02cf4
DBG: show operand visibility in Zydis command
2017-11-14 16:00:54 +01:00
4cf0844255
Browse dialog and goto dialog support auto-complete ( #1738 )
...
* Browse dialog and goto dialog supports auto-complete
* don't use unicode string size
* Auto complete only when expression is valid symbol name
* use dbgfunctions for better flexibility and performance
* buffer last auto complete
* disable auto completion
2017-11-07 20:24:51 +01:00
3116b3dde0
fixed NTSTATUS name
2017-11-07 20:24:01 +01:00
01e5caf75b
removed upper part check in NTSTATUS
2017-11-07 20:24:01 +01:00
79e335277e
lazy load mnemonic data and save 3MB memory
2017-11-07 20:24:01 +01:00
990bccfffc
add mem.isstring()
2017-11-07 20:24:01 +01:00
e6297423f9
Add NTSTATUS fmt;show str in locals tab;fix div by 0 in data copy dlg.
2017-11-07 20:24:01 +01:00
d67031a089
DBG: remove \\n replacement in string formatting
2017-11-07 20:23:25 +01:00
15b0e73ba0
DGB: fix disp+imm printing in “zydis” command
2017-11-07 20:22:15 +01:00
Duncan Ogilvie
ae20041edb
DBG: proper workaround for 0x prefix in GUI
...
also closes #1792
2017-11-04 18:08:44 +01:00
Duncan Ogilvie
4870eebd87
DBG: correctly handle imports by ordinal
...
closes #1795
2017-11-04 16:34:52 +01:00
Duncan Ogilvie
9c639ddc5f
DBG: small improvements to winerror format function
2017-10-30 00:35:54 +01:00
Duncan Ogilvie
2f26a80b78
DBG+BRIDGE+GUI: deprecate DbgGetRegDump
2017-10-29 02:18:06 +02:00
ec0555dc0d
Added winerror format function and show help message for last error in reg view
2017-10-28 02:52:13 +02:00
d5582c6a1f
- DbgGetRegDumpEx(): copy lastStatus NTSTATUS name if requested struct size is >= sizeof(REGDUMP_V2)
...
- RegistersView: replace usages of REGDUMP with REGDUMP_V2 to access LastStatus register
2017-10-28 02:47:49 +02:00
8c9b11ecc9
Remove LastStatus from THREADALLINFO to preserve plugin compatibility
2017-10-28 02:47:49 +02:00
6f1b6b77bb
dbg changes for TEB->LastStatusValue:
...
- Add LASTSTATUS struct
- Add LastStatus members to REGDUMP and THREADALLINFO
- Add ThreadGetLastStatus()/ThreadGetLastStatusTEB()
- Make "laststatus" a supported pseudo-register in isregister() / getregister() / setregister() similar to "lasterror"
- _dbg_getregdump(): copy the full name of the last NTSTATUS value
- ThreadGetList(): add the last status value to the thread list for each thread
- TraceRecordManager: account for the size change of REGDUMP to keep REGDUMPWORD the same size
2017-10-28 02:47:49 +02:00
8f0f83bdf3
ntdll.h: Update PEB and TEB structs for Windows 10 RS3, and correct offset of TEB->LastStatusValue on x86
2017-10-28 02:47:49 +02:00
787b86cd1f
Add DbgGetRegDumpEx to bridge API
...
Public SDK changes:
- Add LASTSTATUS struct
- Add REGDUMP_V2 struct with LASTSTATUS member
- Add DbgGetRegDumpEx(REGDUMP* regdump, size_t size);
Internal changes:
- Change typedef of _dbg_getregdump to add a size parameter
- Make DbgGetRegDump() pass sizeof(REGDUMP) to _dbg_getregdump to preserve existing behaviour. DbgGetRegDumpEx() forwards the size that was passed to it
2017-10-27 00:02:39 +02:00
0fbb1aa056
Don't add autocomments on "mov edi,edi"( #1775 )
2017-10-26 00:43:54 +02:00
Duncan Ogilvie
0762182973
DBG: implement DLL breakpoints directly in x64dbg
2017-10-25 21:58:01 +02:00
466d5e9173
Update cmd-misc.cpp
2017-10-25 11:21:44 +00:00
db5c3e23af
Update cmd-misc.cpp
2017-10-25 11:16:01 +00:00
Duncan Ogilvie
ecbea6d9d8
GUI: fix Sonar issues
2017-10-22 17:07:45 +02:00
9a2cb20682
enhancement to run until return
2017-10-18 22:49:06 +02:00
390bf4c5ca
Trace recording ( #1736 )
...
* run trace file format
* record opcode
* Successfully recorded sample run trace
* fixed order of thread id and opcode
* use capstone in run trace
* Revised format;Stop tracing when stop debug;Changed ext name
* trace browser(draft)
* Lower bound
* Lower bound
* implemented more funcitons in trace file reader
* Initial trace browser
* trace browser works for single-page traces
* fixed page fault
* Multi-selection, fixed page faults
* copy disassembly
* resize columns
* address label;follow in disassembly
* highlight
* history,comment,breakpoint in trace view
* stricter validation to prevent buffer overflow
* MAX_MEMORY_OPERANDS=32
* fixing bug in memory access count
* Temporary info menu to view registers & memory
* assumed to fix thread id bug
* live update trace view
* Fixed a bug with registers recording (similar to thread id bug)
* Search for constant in trace file
* Fixed bugs with memory operands recording
* File header for trace file; Auto update trace viewer
* fix x64dbg_translations.pro
* Default filename for trace; Start trace from trace view
* Switch to Qt JSON
* Copy selection, file offset and RVA; recent files
* Properly implement MRU menu
* shortcut for tracing
* Fix file names with comma
* added interaction with tab closing
* change default directory for trace file
* fix minor issue
2017-10-16 20:00:26 +02:00
9959278863
Properly exit x64dbg
2017-10-15 16:18:48 +02:00
Duncan Ogilvie
f6590e6465
DBG: fixed a typo
2017-10-14 17:31:11 +02:00
Duncan Ogilvie
d6ca58efd1
DBG: fixed another problem with Zydis
2017-10-14 15:42:02 +02:00
Duncan Ogilvie
6f7af9b8da
DBG: fixed various small issues with Zydis
...
ping @athre0z
2017-10-14 00:32:34 +02:00
Duncan Ogilvie
c9e17df1c0
DBG+LAUNCHER: correctly handle mixed mode executables
...
fixes #1758
2017-10-13 23:38:53 +02:00
8cf9f63bac
Fixing #1752
2017-10-13 19:43:33 +02:00
c5c3358c52
Add range checks for operand access ( fixes #1750 ) ( #1751 )
...
* DBG: added range checks to operand access
- previously, some instructions could trigger the `DebugBreak` path in `Zydis::operator[]`
* GUI: removed redundant semicolon
2017-10-10 21:01:59 +02:00
5b1cf81f55
zydis_wrapper: Fixed x32 build
2017-10-09 10:02:13 +02:00
3fca5c9191
Ported & renamed `cbInstrCapstone`
2017-10-09 10:02:13 +02:00
af0ff55df3
zydis_wrapper: Better compliance with style-guide
...
- Removed underscores
- Removed redundant “zy” prefix
- Executed `AStyleWhore` (sorreh, I use git on my macOS host, can’t put it into pre-commit-hook)
2017-10-09 10:02:13 +02:00
ca9401fdb7
Moved “zydis_wrapper” into root repo
...
- Instead, we directly use Zydis as a submodule now
2017-10-09 10:02:13 +02:00
ZehMatt
Duncan Ogilvie
torusrxxx
Mattiwatti
Mack Stump
Joel Höner