Systems with AVX-512 would crash when using x32dbg.
CPUs AVX support would always show 0 for XMM registers (thanks to @CXVUSER).
To prevent critical issues like this from slipping through we are working on an automated test system. The headless version of x64dbg introduced in the previous release was a first step in this direction, but much more work is required. This release also introduced support for , which helps prevent memory safety issues.
The documentation has now been moved to the docs folder in the x64dbg repository. This streamlines development, but also makes the project much more LLM-friendly. Practically-speaking this means you can now ask questions about x64dbg in DeepWiki and expect reasonably-useful results!
Obviously this is no replacement for reading the documentation, but it might at least point you to some concepts to research!
๐ Tracing
There have been quite a lot of updates to the trace recording feature over the past few months by @torusrxxx. For those not familiar, trace recording allows you to capture the registers and memory accesses for every step of the program. Think Time Travel Debugging, but on a much smaller scale. This feature can be helpful trying to understand the data flow or figuring out where a specific value first pops up when executing a function.
To start a trace recording, use Help -> Trace into... and then enable the Record trace checkbox:
You can see a reconstruction of the memory/stack (best effort, might be slow on larger traces):
This version introduces support to search for intermodular calls in the trace, which can be useful to understand where APIs get called. A blog post with more details will follow!
๐ค Scripting
โ You might want to check out Analysis at Scale with x64dbg Automate, which introduces a Python library to automate x64dbg. There is also an MCP Server built on top of it, which allows LLMs to interact with x64dbg.
The builtin scripting feature has always been a bit lackluster, but the need for testing automation has pushed things forward. Improved command line handling was introduced by @peace-maker and you can now specify a script to execute on debuggee startup:
x64dbg {OPTIONS} [filename] -- [extra arguments]
x64dbg
OPTIONS:
-workingDir Current working directory of new process.
Defaults to current working directory if not specified. (optional)
-pid Process ID to attach to. (optional)
-tid Thread Identifier (TID) of the thread to resume
after attaching (PLMDebug). (optional)
-event Handle to an Event Object to signal (JIT). (optional)
-c Command to execute Specifies the initial
debugger command to run at start-up. (optional)
-cf Specifies the path and name of a script file.
This script file is executed immediately on startup. (optional)
-p Alias for -pid. (optional)
-a Alias for -pid. (optional)
-e Alias for -event (optional)
-help Show this message. (optional)
The scripting system has been rewritten from scratch to execute all of the script commands on an event loop, which ensures everything executes in a deterministic order. A lot of bugs have been fixed too, which enables more complex scripting scenarios:
fn = RtlEnterCriticalSection
bp fn
SetBreakpointCommand fn, "scriptcmd call analyze"
ret
analyze:
SpinCount = ReadPtr(rcx + 0x20)
log "SpinCount: {u:SpinCount}"
ret
The script above sets a breakpoint on RtlEnterCriticalSection. It uses a breakpoint command to execute the analyze function in the script every time the breakpoint hits, and performs some logging. For testing we can use the headless command line tool with test executables and scripts to make sure everything works as expected.
๐ง Cross Platform
Thanks to @eldarkg you can now build x64dbg in Wine with a custom CMake toolchain. Additionally the first iteration of the cross-platform branch has been merged. Slowly the GUI components will be ported to an x64dbg::widgets library that can be reused for other projects.
๐ค Community
x64dbg is a community-driven project, and this release would not have been possible without the incredible work of our contributors. A huge thank you to everyone who contributed code, reported bugs, and helped shape this release โค๏ธ
We recently revamped the Discord community, which you can join below:
Other platforms are synchronized with the #general channel:
โค๏ธ Sponsors
This project is also made possible by the generous support of sponsors. We would like to give a special shout out to the following sponsors:
FLOSS/fund - Funding for Free and Open Source projects.
Also many thanks to my active sponsors: @LabGuy94, @grant-h, @MorpheusH3x, @re-jevi, @adam-the, @verdeckt, @emesare, @daaximus, @stevemk14ebr, @as0ni, @sedrakpc, @Dan0xE, @Invoke-RE, @leandrofroes, @shu-tom, @buzzer-re, @expend20, @crudd, @clayne, @fr0zenbag, @dzzie
If you find x64dbg valuable in your work, please consider becoming a sponsor. Your support directly funds development and helps us continue to build the future of debugging. For companies we also offer custom services depending on the level of sponsorship, please reach out for more details!
๐ Changelog
InitializeSignatureCheck now loads msvcp140.dll
Always load VC runtime from application directory #3616
Move https://github.com/x64dbg/docs into this repo
Fix snapshot timestamp format
Fix AVX-512 crash on 32-bit
Exclude unnecessary OpenGL libraries from snapshot
Fix bug with string formatting
Fix ambiguous operand size when hiding pointer sizes by @kalhotky in #3620
Display style values refactor and MASM style by @kalhotky in #3617
Revert "Fixed inverted logic" by @mrexodia in #3622
Improve developer experience when forking
Improve CONTRIBUTING guide
Another attempt to fix msvcp140 loading #3624
Unbreak x32dbg after last commit
Fixed pattern search by @OldGamesCracking in #3628
Add back -DX64DBG, closes #3634
Update resources translations by @torusrxxx in #3562
Faster disasmgetstringatwrapper by @d2k2-git in #3625
Fix deleting breakpoint at module base address by @kalhotky in #3629
Fix symbolic name help URL encoding by @kalhotky in #3630
Fix fastresume hiding other summary text by @kalhotky in #3631
Disasm value notation by @kalhotky in #3640
Fix incorrect "None" label for disabled trace coverage in shortcuts by @adityaxa in #3638
Refactor QZydis instance in Bridge class by @mrexodia in #3641
Automatically cancel previous workflow runs on the same branch
align char buffer sizes with defined limit in GuiGetDisassembly by @d2k2-git in #3627
Fix autocomment precedence by @kalhotky in #3632
Fix mnemonic brief column #3510, #3509
MSVC build under linux wine by @eldarkg in #3657
Use library for command line parsing by @peace-maker in #3516
Fix headless initialization and thread model
msvc-wine: Fix: LINK : fatal error LNK1158: cannot run 'rc.exe' by @eldarkg in #3660
Do not produce an import library for exe target #3663
Add clang-tidy configuration
Show struct widget in DisplayTypeDialog
Misc improvements
Fix bug where disabling and reenabling GUI updates didn't update the GUI properly
Make breakpoint silent if breakpoint command execution fails
JobQueue.await now recursively calls job function when called on worker thread
Greatly improve script state handling
Export table to tab-separated values by @torusrxxx in #3666
Support adjusting font size via ctrl+wheel in RegistersView by @torusrxxx in #3665
Intermodular calls: add column for module name (#3664)
Properly synchronize breakpoint commands and script state
Allow using VirtualQueryEx in MemIsCodePage and enable it everywhere
Msvc wine build x64 architecture (#3669)
Patch file: fix wine usage by @eldarkg in #3679
Unity build by @mrexodia in #3674
Follow in stack in trace registers view; fix shortcuts in registers view by @torusrxxx in #3670
Search for intermodular calls in trace by @torusrxxx in #3672
Goto dialog: add completion for labels by @dabeibao in #3681
Upgrade _WIN32_WINNT to Windows 7 by @torusrxxx in #3668
Fix code formatting
Remove dbghelp/DeviceNameResolver/TitanEngine from pluginsdk #3412
Add some cross platform example projects by @mrexodia in #3224
Simplify licenses sections of the docs to use links instead
Fix struct view refreshing and add error message when connection fails
