Debugging Windows Internals with x64dbg!

[@engiocsagRehtaf]

Thank you very much Sir!!!!

[@ShxwnGrxhxm]

Man... can't believe I got caught up at work and missed it!

[@CHRISTIVN.OFFICIAL]

can't believe I missed the stream.

[@mcacyber]

thanks a lot

[@falanavictor1986]

I love you Stephen. You are my daily motivation

[@faanross]

epic stream!

[@eduardschreder1623]

Duncan, for the "trace coverage", what is the difference between bit/byte/word?

[@lPlanetarizado]

maybe unrelated to x64dbg, but in windows "context" structures have all the same information (like registers and stuff)? because alot of structures have a "context" field and i never know what the data means

[@OffByOneSecurity]

I did a stream on recreating undocumented structs on Windows using IDA Pro. One of the reasons I bring this up is that during that stream, I had to deal with the context structure for a given thread during an exception handler. The thread caused an access violation to a Guard Page, and the handler needed some of the register values at the moment in time when the exception was triggered.. So, think of the context as a snapshot of the state of the processor registers at a given moment in time. Same thing when you context switch out of a process and to another one (e.g. Notepad to Calc). In order to continue where you left off, the state of all registers and such are stored in something called the Process Control Block (PCB).

[@lPlanetarizado]

@@OffByOneSecurity i see, thanks alot

[@OffByOneSecurity]

You actually inspired me to create a short video, as this question has been asked quite a few times. Hope it helps... kzbin.info/www/bejne/mqubdIaXhreZsKc