Learning Malware Analysis

2.1 Launching a New Process in x64dbg

In x64dbg, to load an executable, select File | Open and browse to the file that you wish to debug; this will start the process, and the debugger will pause at the System Breakpoint, the TLS callback, or the program entry point function, depending on the configuration settings. You can access the settings dialog by choosing Options | Preferences | Events. The default settings dialog is shown as follows, with the default settings when the executable is loaded. The debugger first breaks in the system function (because the System Breakpoint* option is checked). Next, after you run the debugger, it will pause at the TLS Callback function, if present (because the TLS callbacks* option is checked). This is ...