Tracing Memory With X64dbg and Advanced Breakpoints
Added 2024-07-06 14:00:08 +0000 UTCIn this tutorial we combine multiple concepts and transform x64dbg into a memory tracing tool using conditional breakpoints. Many of the concepts used in this tutorial build on our previous tutorials. The following may be helpful for a deeper explanation of the topics discussed.
Tutorials
Sample
5fc152649ac2f0ed3f418107e20bd01a97bcd8028e1ef076faab9524e954cedf
https://www.unpac.me/results/759da01a-d8e6-4b31-b44f-c894e77ec733
X64dbg log format
https://help.x64dbg.com/en/latest/introduction/Formatting.html
Helpful x64dbg Breakpoint Conditions
https://gist.github.com/herrcore/673d045870dd09b8bbe6e112bffd3c40
Lab Exercise
Replicate the memory tracing breakpoints and trace the memory until you hit the breakpoint on NtCreateUserProcess.
Review the memory allocations in the log file and find the memory segments that have been allocated with read|write|execute permissions (hint look up the memory protection constants).
What do you find in this allocated memory?
