44 lines
1.3 KiB
Markdown
44 lines
1.3 KiB
Markdown
# API Reference: Debugging Malware with x64dbg
|
|
|
|
## Overview
|
|
|
|
`scripts/analyst.py` generates an x64dbg command script of strategic API breakpoints for a
|
|
chosen goal (unpacking, injection, crypto, network, persistence). The output is a text script
|
|
to load in x64dbg; the tool does not run any process.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| (stdlib) | — | argument handling, text output |
|
|
|
|
## External tools
|
|
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| x64dbg | Windows user-mode debugging |
|
|
| Scylla (x64dbg plugin) | Dump memory and rebuild import tables when unpacking |
|
|
|
|
## Core functions
|
|
|
|
### `build_script(presets)`
|
|
Returns an x64dbg `.txt` script of `bp` commands for the selected presets, de-duplicating APIs
|
|
across presets.
|
|
|
|
### `PRESETS`
|
|
Maps each analysis goal to the relevant Windows APIs.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python scripts/analyst.py breakpoints --preset unpacking > bp.txt
|
|
python scripts/analyst.py breakpoints --preset injection --preset crypto > bp.txt
|
|
# in x64dbg: scriptload bp.txt
|
|
```
|
|
|
|
## Sources
|
|
|
|
- x64dbg documentation — https://help.x64dbg.com/
|
|
- Windows API reference — https://learn.microsoft.com/windows/win32/api/
|
|
- Common API-breakpoint strategy for manual unpacking (standard RE practice)
|