x64dbg

What is x64dbg?

x64dbg is a free, open source debugger for Windows, built for dynamic analysis of 32- and 64-bit executables when you don't have the source code. It ships two binaries: x32dbg for 32-bit programs and x64dbg for 64-bit ones. It became the natural replacement for OllyDbg (which never made the jump to 64 bits) and is today the most widely used user-mode debugger for malware analysis, crackmes and reverse engineering on Windows.

Its interface shows disassembly, registers, stack, memory dump and breakpoints at the same time, and adds a command language, scripting and a very active plugin ecosystem.

What x64dbg is used for

• Malware analysis: seeing what a sample really does at runtime, which APIs it calls and which data it decrypts in memory.
• Manual unpacking: reaching the original entry point (OEP) of a packed binary, dumping it and rebuilding the import table with Scylla, which comes built in.
• Crackmes and CTFs: following a password or license check instruction by instruction.
• Exploit development and vulnerability debugging: watching register state after an overflow in a controlled lab.

How to install x64dbg

x64dbg is portable. Download the latest snapshot from the official website or GitHub, unzip it and run release\x96dbg.exe, a launcher that registers shortcuts and automatically opens the right 32- or 64-bit version. You can also run release\x64\x64dbg.exe or release\x32\x32dbg.exe directly.

Always work inside a virtual machine with snapshots if you debug suspicious code: debugging means executing, and the malware will really run.

Practical x64dbg examples

Basic shortcuts

• F2: toggle a breakpoint on the selected instruction.
• F7 / F8: step into / step over.
• F9: continue execution.
• Ctrl+F9: run until the current function returns.
• Ctrl+G: go to an address or expression.

Command bar commands

At the bottom there is a command line. Some of the most useful commands:

bp kernel32.CreateFileW
bp user32.MessageBoxW
bpcnd kernel32.CreateFileW, "rcx != 0"
bph 0x140001000, x
run
sto
sti
rtr
bpc kernel32.CreateFileW

This sets breakpoints on Windows APIs (very handy to see which files a sample opens), adds a condition, places a hardware breakpoint, steps through code and removes the breakpoint when you are done.

Finding a password check

1. Open the crackme and let it reach the entry point.
2. Right-click in the disassembly → Search for → Current Module → String references.
3. Find the error message ("Wrong password" or similar) and double-click to jump to the code.
4. Scroll up to the conditional jump (je/jne) that decides which message to show and set a breakpoint on the comparison before it.
5. Inspect registers and memory at that point to understand the logic.

Only use x64dbg on your own software, lab samples, challenges designed for it, or with explicit authorization.

Pro tips

• Install ScyllaHide to hide the debugger from anti-debug tricks (IsDebuggerPresent, PEB checks, timing...).
• Use labels and comments (: and ;) as you go; x64dbg stores them in its per-module database.
• Pair it with a static disassembler: understand the structure in Ghidra and confirm the behavior in x64dbg.
• Configure in Options → Preferences → Events where you want it to stop (System breakpoint, Entry breakpoint, TLS callbacks). TLS callbacks are a common trick to run code before the entry point.
• Explore the Plugin Manager and the community: there are plugins for Python scripting, tracing and more.

x64dbg pros and cons

Pros	Cons
Free and open source	Windows only and user mode only (no driver debugging)
Supports 32 and 64 bits	Learning curve if you have never seen assembly
Built-in Scylla and a large plugin ecosystem	Limited static analysis compared to Ghidra or Binary Ninja
Active development and big community	Advanced malware detects debuggers without extra plugins

x64dbg alternatives

• Ghidra: free disassembler and decompiler; it includes a debugger, although most people use it for static analysis.
• Binary Ninja: commercial reversing platform with a built-in debugger.
• PEiD: to check whether a binary is packed before debugging it.
• WinDbg: Microsoft's debugger, required if you need to debug the kernel.

Frequently asked questions

Is x64dbg free?

Yes, x64dbg is completely free and open source, including for professional use.

What is the difference between x32dbg and x64dbg?

They are the same project: x32dbg debugs 32-bit processes and x64dbg debugs 64-bit processes. The x96dbg launcher picks the right one for each executable.

Is x64dbg legal?

Yes, it is a legitimate development and security tool. What would be illegal is using it to pirate licensed software or attack other people's systems without permission.

How do I start using x64dbg?

Open a simple executable (a crackme), learn F2, F7, F8 and F9, search for string references and follow the conditional jumps. That is enough to solve your first challenges.

To practice reverse engineering with guided exercises, visit the Hackers en Acción Academy.