x64dbg Overview

Relevant source files

• .github/CODE_OF_CONDUCT.md
• .github/CONTRIBUTING.md
• .github/sponsors/malcore.png
• .github/sponsors/telekom.svg
• README.md
• src/bridge/bridgemain.cpp
• src/bridge/bridgemain.h
• src/dbg/_exports.cpp
• src/dbg/_global.cpp
• src/dbg/_global.h
• src/dbg/commands/cmd-debug-control.cpp
• src/dbg/debugger.cpp
• src/dbg/debugger.h
• src/dbg/symbolundecorator.h
• src/dbg/x64dbg.cpp
• src/exe/LoadResourceString.h
• src/exe/resource.h
• src/exe/resource.rc
• src/exe/strings.h
• src/exe/strings.rc
• src/exe/strings_utf8.rc
• src/gui/Src/Bridge/Bridge.cpp
• src/gui/Src/Bridge/Bridge.h
• src/gui/Src/Bridge/BridgeResult.cpp
• src/gui/Src/Gui/MainWindow.cpp
• src/gui/Src/Gui/MainWindow.h
• src/gui/Src/Gui/MainWindow.ui
• src/gui/resource.qrc
• src/launcher/x64dbg_launcher.cpp

x64dbg is an open-source binary debugger for Windows, specifically designed for malware analysis and reverse engineering of executables where source code is unavailable README.md1-9 It provides a comprehensive feature set including a robust plugin system, a custom expression engine, and advanced visualization tools like control-flow graphs README.md9-17

Core Architecture

x64dbg employs a three-layer architecture designed to separate the low-level debugging logic from the high-level graphical interface. This separation ensures stability and allows for alternative front-ends, such as the headless mode used for automated scripts src/bridge/bridgemain.h70-72

System Component Relationship

The following diagram illustrates how the major subsystems interact through defined boundaries, specifically focusing on the communication between the GUI and the Engine via the Bridge.

Architecture Component Map

Sources: src/bridge/bridgemain.h57-67 src/gui/Src/Gui/MainWindow.cpp89-110 src/dbg/debugger.cpp102-104 src/bridge/bridgemain.cpp15-34

Key Subsystems

1. The GUI (x64gui.dll): A Qt-based front-end centered around MainWindow src/gui/Src/Gui/MainWindow.cpp62-66 It handles all user interaction and rendering of views like disassembly, memory maps, and registers. It connects to the engine via the Bridge singleton src/gui/Src/Bridge/Bridge.cpp200-212
2. The Bridge (x64bridge.dll): A C-interface communication layer. It provides a stable API for the GUI to call engine functions and manages persistent settings via BridgeSettingGet/Set src/bridge/bridgemain.h94-121 It also handles the translation of internal engine states to GUI messages (GUIMSG) src/gui/Src/Bridge/Bridge.cpp32-73
3. The Engine (x64dbg.dll): The core logic of the debugger, implemented in the src/dbg directory. It manages the debug loop thread src/dbg/debugger.cpp104 command registration src/dbg/x64dbg.cpp105-107 and global state tracking like bIsDebugging src/dbg/debugger.cpp106
4. TitanEngine: The underlying debugging core used for low-level Windows debugging events, execution control, and hardware/memory breakpoint management README.md50 src/dbg/debugger.h5

For a deeper dive into these layers, see Architecture Overview: Bridge, DBG, and GUI.

Code-to-Entity Mapping

To assist developers in navigating the codebase, the following diagram maps conceptual debugger features to their primary implementation files and classes.

Feature to Code Entity Mapping

Sources: src/dbg/debugger.cpp7-21 src/gui/Src/Gui/MainWindow.cpp21-32 src/dbg/x64dbg.cpp7-22 src/dbg/_exports.cpp46-60

Getting Started

x64dbg supports both 32-bit (x32) and 64-bit (x64) architectures. The build system ensures that the correct libraries are loaded based on the target architecture src/bridge/bridgemain.cpp28-34

• Installation: Snapshots are portable and do not require formal installation beyond extracting the archive. Users typically run x96dbg.exe to select the architecture or register shell extensions README.md20-25
• Building: The project uses a combination of CMake and a custom configuration system. It requires Visual Studio and Qt. The BridgeInit function handles the initial setup of user directories and configuration loading src/bridge/bridgemain.cpp167-184
• Execution: The debugger initializes by setting up a debug thread for the target process via dbgcreatedebugthread src/dbg/debugger.cpp176-177 and entering a command loop managed by hCommandLoopThread src/dbg/x64dbg.cpp38-39

For details, see Getting Started: Installation and Building.

Component Summary

Component	Responsibility	Primary Technologies
GUI	Visualization and User Input	Qt5, MainWindow, Bridge signals
DBG	Debugging Logic, Command Execution	C++, TitanEngine, Zydis
Bridge	Cross-DLL Communication	C-API, GUIMSG messaging, Utf8Ini
Plugins	Extensibility	C-API Callbacks, plugin_loader
Launcher	Architecture selection	x64dbg_launcher.cpp

Sources: README.md50-58 src/bridge/bridgemain.cpp11-15 src/dbg/plugin_loader.h1-15 src/launcher/x64dbg_launcher.cpp1-10

Accessibility and Localization

x64dbg includes a translation system and accessibility wrappers to ensure the tool is usable by a wide range of developers.

• Localization: Multi-language support is integrated into the GUI via the chooseLanguage slot src/gui/Src/Gui/MainWindow.h150 and handled through the Crowdin platform README.md5
• Accessibility: Custom implementations of accessibility interfaces are provided for complex widgets like the disassembly and register views to support screen readers.

Sources: src/gui/Src/Gui/MainWindow.h150 src/gui/Src/Gui/MainWindow.cpp90-110 README.md5