morsisko/xfindout

A plugin to x64dbg that lets you find out what writes to/accesses particular address

! NOTE: Please use x64dbg version released after 30 Nov, 2020. Older versions of x64dbg got hardware breakpoint callback bug and thus the plugin won't work!

xFindOut

A plugin to x64dbg that lets you find out what writes to/accesses particular address. Based on the similar feature available in Cheat Engine.

Installation

Copy xFindOut.dp32 into x32/plugins and xFindOut.dp64 into x64/plugins

Usage

Right click the dump, then select corresponding option in the contex menu:

alternatively you can use commands:

findout address, [r]/w

For example:

• findout 0x1234 - will check out what accesses address 0x1234
• findout 0x1234, w - will check out what writes to address 0x1234

findoutstop address

For example:

• findoutstop 0x1234 - will stop and shutdown the window connected to address 0x1234 (provided it is currently opened and started)

Demo

xfindout's Issues

Feature requests

Hi,

Because I'm not familiar with c++.
I have some feature request:

• Allow resize find out windows.
• Allow toggle topmost (on-off, all window; or fast hide show all window)
• Allow select multible Instruction & Hits, and copy selected to clipboard.
• Keep focus selected Instruction when click Follow in CPU (I can remember last selected).
• Double click on instruction to Follow in CPU.
• Allow set software breakpoint from selected Instruction by F2 or context menu.
• Stop and resume (instead close)
• Context menu (Find out...) in References windows? (without Follow dump).
• Option use Exception breakpoint instead HWBP (this will make Find out more than 4 address).

Entry point not found

After installation I get the following error.
And the plugin is not available

error in english:
Entry point not found
Could not find GetContextData procedure entry point in dynamic link library C:....

xFindOut behavious

Hi, thank for your plugin.
I have problem with xFindOut.

Steps:

• Open x64dbg and load target (current state = paused)
• xFindOut-> Find out... this address.
• Press "Stop" or close "Find out..." window.
• xFindOut will automatically RUN target.

Expect: just "stop" or "close" and remove HWBP.

xFindOut v1.0.0 do not works on Windows XP SP3

Hi,

Is xFindOut compatible with Windows XP SP3 ?

I think not because it does not load.