2.1 Launching a New Process in x64dbg

In x64dbg, to load an executable, select File | Open and browse to the file that you wish to debug; this will start the process, and the debugger will pause at the System Breakpoint, the TLS callback, or the program entry point function, depending on the configuration settings. You can access the settings dialog by choosing Options | Preferences | Events. The default settings dialog is shown as follows, with the default settings when the executable is loaded. The debugger first breaks in the system function (because the System Breakpoint* option is checked). Next, after you run the debugger, it will pause at the TLS Callback function, if present (because the TLS callbacks* option is checked). This is sometimes useful, because some anti-debugger tricks contain TLS entries that allow malware to execute code before the main application runs. If you further execute the program, the execution pauses at the entry point of the program:

If you want the execution to pause directly at the program's entry point, then uncheck the System Breakpoint* and TLS Callbacks* options (this configuration should work fine for most malware programs, unless the malware uses anti-debugging tricks). To save the configuration settings, just click the save button. With this configuration, when an executable is loaded, the process starts, and execution is paused at the program's entry point, as shown here:

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.140.185.123