X64dbg: Notes: Pointers, 0x, Freeze the stack, Go to address

[10miles]

• Pointers in Arguments pane not resolved.

SS:[RSP-58]=28C58018 - pointer not resolved
SS:[13FCC08]=28C58018 - pointer resolved in OllyDbg

So, researcher should resolve/calculate manually.

• "0x" prefix

What is [RSP-58], 58 decimal or hex, who knows? It should be [RSP-0x58]

Values and indexes should have 0x prefix, addresses should not.

Or, researcher should add manually.

• "Freeze the stack" option pointless.

Stack freezes with no options apart from "Unfreeze the stack".

So, researcher should write down info by visual copying addresses and data.

Freeze should mean only stop moving up and down, Highlight and Copy should be available.

• "Go to address" Button.

Still think this Button is needed.

Thanks. :(

[mrexodia]

Hey, please create separate issues for each thing next time.

Could you give exact steps to reproduce the pointer not resolved issue?

As for "0x" prefix there is an issue for it, but it is documented in the
manual that everything is hex.

I didn't try freeze the stack, selection should be available but I will
check it.

There should be a goto address button, somewhere in the top menu bar, maybe
it got removed. You can also use the calculator (Shift+?) and go to
addresses from there.

On Sat, 17 Sep 2016 at 13:18, 10miles [email protected] wrote:

1. Pointers in Arguments pane not resolved.

SS:[RSP-58]=28C58018 - pointer not resolved
SS:[13FCC08]=28C58018 - pointer resolved in OllyDbg

So, researcher should resolve/calculate manually.

1. "0x" prefix

What is [RSP-58], 58 decimal or hex, who knows? It should be [RSP-0x58]

Values and indexes should have 0x prefix, addresses should not.

Or, researcher should add manually.

1. "Freeze the stack" option pointless.

Stack freezes with no options apart from "Unfreeze the stack".

So, researcher should write down info by visual copying addresses and data.

Freeze should mean only stop moving up and down, Highlight and Copy should
be available.

1. "Go to address" Button.

Still think this Button is needed.

Thanks. :(

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
https://github.com/x64dbg/x64dbg/issues/1094, or mute the thread
https://github.com/notifications/unsubscribe-auth/ACWCmb1MktEET6I0tMLbRkRnnIz0Ue9Yks5qq8yWgaJpZM4J_ktF
.

[10miles]

Create separate issues?

No thanks. I'm a researcher not a writer.

All these "issues": button in toolbar, RSP-0x58 calculation and Lock stack can be seen in OllyDbg within less than 2 min.

Do you know how to use OllyDbg, who knows?

[mrexodia]

Well I'm a student and I do this in my free time. Without exact
reproduction steps and more details nothing will happen here. If you want
support buy the IDA support plan for 10k per year.
On Sat, 17 Sep 2016 at 18:01, 10miles [email protected] wrote:

Create separate issues?

No thanks. I'm a researcher not a writer.

All these "issues": button in toolbar, RSP-0x58 calculation and Lock stack
can be seen in OllyDbg within less than 2 min.

Do you know how to use OllyDbg, who knows?

—
You are receiving this because you commented.

Reply to this email directly, view it on GitHub
https://github.com/x64dbg/x64dbg/issues/1094#issuecomment-247784622, or mute
the thread
https://github.com/notifications/unsubscribe-auth/ACWCmefs3uCxnVv_-yJDObPLo9-mZek1ks5qrA7qgaJpZM4J_ktF
.

[10miles]

Look Mr. Student, I'm trying to help.

You cannot develop seccessful debugger without knowing what pointer is
and how it works in debugger.

When you reverse code you go 20-30 lines further to see
where data is going to land, the addresses.

When you pick a line with pointer in disassembler window, pointer should
be resolved/calculated in the below window for instruction operands.

Instead of [RSP+30]=0, there should be [13FD130]=0 as it is in OllyDbg.

Who should calculate RSP+30=13FD130 ? Researcher?

Is it in Researcher power to calculate pointers for every second line of code?

Such "debugger" is useless.

Besides, IDA Pro also has issues. There is no context navigation there.
You go to address or function with no Back option except a small button
in toolbar etc.

Hope this helps.

[mrexodia]

"Go to address" Button.

It was removed, don't know why but I will check it out.

No thanks. I'm a researcher not a writer.

The 0x prefix has already been requested in #614, I opened a separate issue for freeze the stack #1103.

All these "issues": button in toolbar, RSP-0x58 calculation and Lock stack can be seen in OllyDbg within less than 2 min.

OllyDbg doesn't run on an iPhone unfortunately and a wall of text in an email doesn't give much context to an issue which is why I _kindly_ requested more information and reproduction steps so it could easily be checked by members of our kind community while I was enjoying my PC-less weekend with my girlfriend.

Instead of [RSP+30]=0, there should be [13FD130]=0 as it is in OllyDbg.

It was designed and intended like this (64 bit pointers are usually too long to memorize anyway and provide little value). Now, if you want the value of rsp+30, just type it (rsp+30) in the command bar or the calculator or any place where you can enter expressions it's faster than typing the pointer anyway. Mostly you can just use the context menu to navigate around:

Now because you asked so kindly here is a compromise:

Such "debugger" is useless.

Nobody forces you to use x64dbg. There are probably countless alternatives out there that provide better support and have all the functionality you need. Also open source is a nice thing. You can easily make modifications and possibly even get your changes merged so everybody can enjoy them. Think about contributing!