Weekly digest 1106 Nov 2016, by mrexodia
This is already number eleven of the weekly digests! It will highlight the things that happened to and around x64dbg this week.
More advanced conditional tracing
Just like conditional breakpoints there is now more advanced conditional tracing. This allows you to (conditionally) log stuff and (conditionally) execute commands during tracing. In combination with plugin commands and expression functions you can make this arbitrarily complex, yay!
Fixed more GUI update issues
Sadly the recent performance improvements have introduced lots of GUI refresh bugs. Many were fixed and even more have been solved this week…
Remember history in goto file offset and RVA
The goto dialog has an edit box that has a history (use up/down to browse it). This feature is now available in all goto dialogs.
Reverted default behavior for null and nonprint characters
There was a discussion at issue #1196 and on Reddit and it seems like nobody likes the new behavior for null and nonprint characters. It has been reverted to use dots again. If you still want to show unicode replacements you can add the following to the
GUI section of your config file.
[GUI] NonprintReplaceCharacter=25CA NullReplaceCharacter=2022
Cleaner GUI look
The GUI should look a little bit cleaner now (less borders mostly), see this GIF for a comparison.
Traced background in reference, source and symbol view
The trace record will now also show up in various views to help you understand where you might have already been.
Update trace record when changing CIP manually
When you set CIP it will now execute the trace record on that address.
Allow skipping of INT3 instruction on run
The setting to skip INT3 instructions (mostly useful for ASM-level debugging) now also allows you to use the run command so INT3 instructions can be used as breakpoints directly.
Command to print stack trace
The (currently undocumented)
printstack command will print the callstack in the log.
5 call stack frames (RIP = 00007FF7995A202F , RSP = 000000957F1FFD58 , RBP = 0000000000000000 ): 000000957F1FFDB0 return to 000000957F3E4829 from x64dbg.00007FF7995A202F 000000957F1FFDB8 return to x64dbg.00007FF7995A2555 from 000000957F3E4829 000000957F1FFDF8 return to kernel32.00007FFB74F013D2 from x64dbg.00007FF7995A2555 000000957F1FFE28 return to ntdll.00007FFB75B254E4 from kernel32.00007FFB74F013D2 000000957F1FFE78 return to 0000000000000000 from ntdll.00007FFB75B254E4
Set foreground on system breakpoint
Some time ago an option was introduced that would disable calls to set x64dbg as the foreground window. One of these calls is now removed and x64dbg will always be on the foreground after you started a new debug session.
Option to not highlight operands separately
A user on Telegram requested an option to expand the highlighting of the mnemonic to the whole instruction. This has now been added and this allows you to create absolutely stunning syntax highlighting!
Removed the toggle option for certain registers
General purpose registers had an option to ‘Toggle’ their state, but this did nothing particularly useful. This option has now been removed.
- Spanish (95%)
- German (86%)
- Chinese Simplified (80%)
- Korean (64%)
- Russian (59%)
- Polish (47%)
- French (32%)
If you have some time it would be appreciated if you could translate a few sentences in your language!
Finally, if someone is interested in hiring me to work on x64dbg more, please contact me!