x64dbg / x64dbg

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Home Page:http://x64dbg.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Bug for GleeBug when assembling?

Dangerfreak opened this issue · comments

This issue happens for GleeBug engine only (TitanEngine works): Open any .exe (32 or 64 bit) file and set a breakpoint (F2) at any CALL or JMP or conditional jump like JE or JNE within the code . Now run the debugger until the breakpoint is reached and press space (=assemble) to change the code exactly at this CALL/JMP, e.g. to NOP. You'll notice, that the first byte won't change. If it is a multi-byte command, only the bytes after the first byte will be changed.

Example:

  1. Code before function "Assemble" (random code):
    006EEF77 | E8 49040000 | call 6EF3C5 (breakpoint was set to this line)
  2. Press space and change the code above to NOP (checkboxes all checked to see it better)
  3. Code after function "Assemble":
    006EEF77 | E8 90909090 | call 90FF800C

The first byte (E8) is unchanged! This seems to be a bug for me.

Note: If you set the breakpoint to another command (no CALL or JUMP), it works as it should.