Dynamic Analysis

; x64dbg Keyboard Shortcuts
F2      - Toggle breakpoint
F7      - Step into
F8      - Step over
F9      - Run
Ctrl+G  - Go to address
Ctrl+F  - Find pattern

; Useful commands
bp VirtualAlloc              ; Break on memory allocation
bp CreateFileW               ; Break on file creation
bp InternetConnectW          ; Break on network connection
bp GetProcAddress            ; Break on API resolution

; Conditional breakpoint - stops at MessageBoxA only while eax is zero
bp MessageBoxA, eax==0

; Log without breaking (log writes to the log window; {s:rcx} formats the pointer as a string)
log "CreateFileW path: {s:rcx}"

; Run trace: record every executed instruction to a file
StartRunTrace "C:/traces/run.txt"
run
StopRunTrace

# GDB with pwndbg or GEF (both actively maintained). PEDA still appears in
# older write-ups, but it has had no commit since January 2021 and is best
# treated as legacy rather than as a current option.
gdb ./binary

# Basic commands
break main              # Set breakpoint
run                     # Start execution
continue                # Continue after break
step                    # Step into (s)
next                    # Step over (n)
finish                  # Run until return

# Examine memory
x/10x $rsp              # 10 hex words at stack pointer
x/s 0x400000            # String at address
x/i $rip                # Instruction at current IP

# Info commands
info registers          # Show all registers
info breakpoints        # List breakpoints
info functions          # List functions

# Set values
set $rax = 0
set {int}0x601000 = 42

# GEF commands
vmmap                   # Memory map
heap chunks             # Heap information
got                     # Global Offset Table