API Reference: Debugging Malware with x64dbg

Overview

scripts/analyst.py generates an x64dbg command script of strategic API breakpoints for a chosen goal (unpacking, injection, crypto, network, persistence). The output is a text script to load in x64dbg; the tool does not run any process.

Dependencies

Package	Version	Purpose
(stdlib)	—	argument handling, text output

External tools

Tool	Purpose
x64dbg	Windows user-mode debugging
Scylla (x64dbg plugin)	Dump memory and rebuild import tables when unpacking

Core functions

`build_script(presets)`

Returns an x64dbg .txt script of bp commands for the selected presets, de-duplicating APIs across presets.

`PRESETS`

Maps each analysis goal to the relevant Windows APIs.

Usage

python scripts/analyst.py breakpoints --preset unpacking > bp.txt
python scripts/analyst.py breakpoints --preset injection --preset crypto > bp.txt
# in x64dbg: scriptload bp.txt

Sources

x64dbg documentation — https://help.x64dbg.com/
Windows API reference — https://learn.microsoft.com/windows/win32/api/
Common API-breakpoint strategy for manual unpacking (standard RE practice)

1.3 KiB Raw Blame History