## Debugging with x64dbg

Static analysis is hard when the code is obfuscated. A **Debugger** lets you run it and watch.

### Key Concepts
1.  **Breakpoints (BP)**: Trapwires using Software Interrupts (INT 3).
    *   You tell the debugger: "Run until you hit address 401050, then PAUSE."
    *   *Use*: Put a BP on `CreateFileW`. The malware will run until it tries to create a file, then freeze. You can then look at the stack to see *filename* it is trying to write.
2.  **Stepping**:
    *   **Step Into (F7)**: Go inside the function call.
    *   **Step Over (F8)**: Run the function and pause after it returns. (Use this to skip boring library functions like `printf`).
3.  **Register/Memory View**:
    *   Watch the EAX register change as you step.
    *   Watch the memory dump to see encrypted strings suddenly become decrypted.

### Patching
You can modify the binary in memory.
*   **Scenario**: The malware checks `If (Year == 2023)`. It is 2025, so it quits.
*   **Fix**:
    1.  Find the `CMP Year, 2023` and `JNE Exit` instructions.
    2.  Change the `JNE` (Jump Not Equal) to `NOP` (No Operation - Do nothing).
    3.  The malware continues running.

### Anti-Debugging
Malware hates debuggers.
*   **IsDebuggerPresent()**: A Windows API function that returns 1 if being debugged.
*   **RDTSC**: Read Time Stamp Counter. Measures CPU cycles.
    *   "It took 5,000,000 cycles to run this instruction. Humans are slow. A debugger must be attached." -> *Self Destruct*.
*   **Bypass**: Use plugins like **ScyllaHide** to hide your debugger from these checks.