Getting started with x64dbg (authorized Windows debugging)

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

x64dbg (x64dbg.com, x64dbg/x64dbg) is an open-source Windows user-mode debugger for 32-bit and 64-bit processes. The latest GitHub release tag checked on 2026-10-18 (UTC) is 2026.05.27. Use it only on programs you own or are explicitly authorized to debug.

On this page

Project facts

Projectx64dbg
Upstreamgithub.com/x64dbg/x64dbg
Sitex64dbg.com
LicenseGPL-3.0 (repo LICENSE)
Latest release checked2026.05.27 (2026-05-27 UTC)
ScopeWindows user-mode (x32/x64)
Verified2026-10-18 (UTC)

What x64dbg is (and is not)

IsIs not
Interactive Windows debugger with CPU, memory, breakpoints, tracingA kernel debugger
Suited to authorized RE and malware lab work on WindowsA cross-platform Frida substitute
Open-source GPL-3.0A license for analyzing third-party apps without permission

For runtime hooks across platforms, compare Frida vs x64dbg. For static decompilation, see Ghidra / Cutter pages on BinBench.

Install (high level)

  1. Open x64dbg.com and follow Download to snapshots.x64dbg.com.
  2. Prefer a recent release or documented snapshot from the official host — not random mirrors.
  3. Extract and run the matching x32dbg / x64dbg binary for the bitness of your target process (debugging a 32-bit process needs the 32-bit debugger).
  4. On first launch, skim the built-in help / wiki links from the project site.

BinBench does not redistribute installers.

First authorized session

Only attach to software you may debug (your build, a CTF challenge you own, or a sample under a written lab policy).

  1. File → Open your authorized EXE, or attach to a running process you own.
  2. Let the debugger break at the entry / system breakpoint (default behavior depends on settings).
  3. Use the CPU view for disassembly, Registers, Memory Map, and Breakpoints.
  4. Set breakpoints on APIs or addresses you care about; step into / over carefully.
  5. Save a database / notes for your own work product — do not publish proprietary code.
Authorized target only → Open / Attach → Break → Inspect CPU & memory → Document findings

Practical tips

TopicGuidance
BitnessMatch debugger bitness to the target process
SymbolsLoad PDBs when you have them for your own builds
Anti-debugMany commercial apps detect debuggers; bypassing protections you are not allowed to test is out of scope
IsolationMalware labs use VMs/snapshots — follow your org's playbook
PluginsPrefer official or license-clear plugins

When to pick something else

  • Need cross-platform scripting / hooks → evaluate Frida (authorized targets only).
  • Need static decompilation of a PE → Ghidra, Cutter, or a commercial suite.
  • Need kernel debugging → WinDbg, not x64dbg.

FAQ

Is x64dbg free?

Yes. The project is open source; the repository LICENSE text is GPL-3.0. Download official builds from x64dbg.com / snapshots.x64dbg.com.

Does x64dbg debug the Windows kernel?

No. It is a user-mode debugger for 32-bit and 64-bit Windows processes. For kernel work, look at Microsoft WinDbg and related tooling instead.

Can I use it on malware samples?

Only in an isolated lab you control, on samples you are authorized to analyze, and under your local laws and employer policy. BinBench does not provide malware acquisition guides.

Is x64dbg the same as Frida?

No. Frida is a cross-platform dynamic instrumentation toolkit; x64dbg is a classic Windows debugger UI. See Frida vs x64dbg.

Does BinBench host unauthorized plugins?

No. Use official releases and plugins you are allowed to redistribute under their licenses.

Sources