x64dbg

x64dbg lets you run a Windows executable that has no source code, pause it partway, and look inside. This review uses a small program that you write and compile yourself to show the basic debugger operations.

This review is for people who have written a simple program in C or a similar language and want to see what happens inside a running program. After reading it, you can do the following:

• Download and start x64dbg
• Open your own program and stop it at a breakpoint
• Step through the code and watch instructions and registers change

##What x64dbg is for

x64dbg is an open-source debugger for Windows. The official README names analysis of executables without source code, and malware analysis, as its main uses. According to the official website, it offers:

• Debugging of EXE and DLL files
• Views for disassembly, the memory map, symbols, threads, and a graph
• Patching instructions and writing the patches to a file
• Scripting to automate operations
• Plugins written in C++
• A JSON database that keeps your comments and labels

You debug 32-bit and 64-bit programs with the same interface and controls. The executables are separate, though: use x32dbg.exe for a 32-bit program and x64dbg.exe for a 64-bit one.

##Network connections

Here is what we could confirm:

• Update checks do not run automatically. In the source code, the only places that call the update check are a button in the About dialog and a menu item for checking updates. When you use one, it queries https://update.x64dbg.com/releases.json.
• Symbols (clues such as function names) are downloaded only when you run the symdownload command or choose “Download Symbols for This Module” in the interface. The default source is Microsoft’s symbol server (https://msdl.microsoft.com/download/symbols). You can change it in the settings dialog.
• The help and plugin menu items open the official sites in your browser.
• x64dbg does not block the network traffic of the program you debug. If the target connects to a network, it keeps doing so while you debug it.

This list covers what we could confirm in the source code and the official documentation. We did not read all of the code.

##Requirements

The latest download is snapshot_2026-05-27_12-11.zip in the GitHub release 2026.05.27 (checked on 2026-10-27).

##Try it safely with your own program

1. From the official releases page, download snapshot_<date>.zip. Do not pick files that start with symbols-snapshot or x64dbg-pluginsdk. They are not the main program.
2. Unpack it in a place where your user can write. The README states this condition. Do not put it under Program Files.
3. Run x96dbg.exe in the unpacked folder and choose 32-bit or 64-bit. You can also run x32\x32dbg.exe or x64\x64dbg.exe directly. This review does not use the shell extension or desktop shortcuts that x96dbg.exe can register.
4. For practice, write a small C program that only prints a string, and compile it as 64-bit.
5. In x64dbg, choose File>Open and open the compiled file.
6. You can choose where the debugger first stops in the Events page of Options>Preferences. The choices include the system breakpoint (during process initialization) and the entry breakpoint (the entry of the executable).
7. In the disassembly view, select an instruction and press F2 to set a breakpoint.
8. Press F9 to resume. The program stops when it reaches the breakpoint.
9. When it stops, press F7 (step into) or F8 (step over) to advance one instruction at a time. Watch how the register values change with each instruction.
10. Compare what you see with your source code to check which instructions each C statement became.

After you are comfortable with your own program, move on to material that clearly allows analysis, such as CTF practice challenges.

##Common uses

The default shortcut keys are defined in the source code.

Attach connects to a running process. It can attach only to a process of the same kind (32-bit or 64-bit) as the debugger. The 32-bit x32dbg cannot attach to a 64-bit process.

You can also work from the command box at the bottom of the window. Conditional breakpoints and logging are available too. The Introduction in the official help covers them in detail.

##How x64dbg differs from Ghidra

A good order is to read the overall structure in Ghidra first, then follow the parts whose behavior you want to confirm in x64dbg.

##Cautions

##Read next

• Ghidraa reverse engineering tool for reading compiled programscd ../ghidra
• Wiresharka packet analyzer for recording and inspecting the traffic of a targetcd ../wireshark
• How to set up a safe test labcat ~/guides/lab-setup.md