x64dbg Debugger Cheatsheet
What It Is
Free, open-source x86/x64 debugger for Windows. The primary debugger for malware dynamic analysis.
Essential Shortcuts
| Shortcut | Action |
|---|---|
F2 | Toggle breakpoint |
F7 | Step into (follow CALLs) |
F8 | Step over (skip CALLs) |
F9 | Run to next breakpoint |
Ctrl+F9 | Run until return |
Ctrl+G | Go to address/expression |
Space | Assemble (edit instruction) |
Ctrl+F2 | Restart debugging |
; | Add comment |
: | Add label |
Breakpoint Types
| Type | How | Use Case |
|---|---|---|
| Software (INT 3) | F2 | General breakpoints |
| Hardware | Right-click > HW BP | Anti-debug resistant |
| Memory | Dump > right-click > Memory BP | Track memory access |
| Conditional | Edit BP > add condition | Auto-patch values |
API Breakpoints (Most Useful)
bp CreateFileA
bp WriteFile
bp RegSetValueExA
bp InternetConnectA
bp VirtualAllocEx
bp WriteProcessMemory
bp CreateRemoteThread
bp CreateProcessA
bp IsDebuggerPresent
Memory Inspection
Ctrl+Gin Dump panel to navigate to address- Right-click > Follow in Disassembler (for code regions)
- Right-click > Binary > Save to file (dump memory)
Key Plugins
| Plugin | Purpose |
|---|---|
| ScyllaHide | Hide debugger from anti-debug |
| Scylla | Dump processes and fix IAT |
| xAnalyzer | Annotate API parameters |
Common Workflow
- Load sample → F9 to reach entry point
- Set API breakpoints for target behavior
- F9 to run → examine parameters at each break
- Step through interesting code with F7/F8
- Dump unpacked code with Scylla if needed