x64dbg is an open-source binary debugger for Windows targeting malware analysis and reverse engineering. The architecture is a three-layer system: a GUI layer (Qt-based Windows application), a bridge layer (C API for communication), and a debugger core layer (TitanEngine/GleeBug/StaticEngine backends). The debugger supports x86 and x64 processes with comprehensive features including conditional breakpoints, memory analysis, symbol handling, and an extensive plugin SDK. The codebase demonstrates strong engineering in several areas. The analysis engine implements multiple analysis passes (linear, recursive, control flow, xrefs) with a clean pass-based architecture. The command system uses a flexible registration pattern with consistent error handling. The bridge layer provides a well-defined C API surface for plugins with careful attention to thread safety and marshaling between GUI and debugger threads. Recent development shows active work on Linux support (ElfBug debugger), cross-platform tools (hex viewer, minidump analyzer, remote table), and a comprehensive test framework with headless testing infrastructure. The test system uses convention-based test discovery with script-driven scenarios and plugin-based assertions. Technical debt includes some outdated documentation (docs reference Python 2.7 for CHM generation), mixed use of Qt versions (5.12+ required but some paths reference older configurations), and the inherent complexity of maintaining both Windows debugger and cross-platform analysis tools in one repository. The dependency on precompiled libraries (TitanEngine, Zydis, XEDParse) creates build complexity but is managed through CMake.

TitanEngine is a Windows-native C/C++ library for reverse engineering, debugging, and unpacking PE executables. It provides a large exported C API covering process debugging (create/attach/detach, breakpoints, stepping), memory and register manipulation, PE file parsing and modification (sections, imports, exports, relocations, TLS), hooking (code redirection, IAT patching), import reconstruction (IAT scanning, dump fixing via integrated Scylla wrapper), anti-debugging evasion, and static file analysis (hashes, decompression). The codebase is primarily a monolithic DLL with hundreds of functions, tightly coupled to the Windows NT API and undocumented structures. It is the core engine behind the x64dbg debugger's unpacking and import-repair capabilities. While the library is functionally complete and has been battle-tested, it exhibits significant technical debt: heavy use of global mutable state, non-reentrant functions, manual memory management, hardcoded OS-specific offsets, and monolithic functions (e.g., DebugLoop). Some subsystems—such as the breakpoint handler, memory I/O with breakpoint bypass, file mapping utilities, and the self-contained ntdll.h header—demonstrate high craftsmanship and are reusable in other projects. The integration of scylla_wrapper and distorm adds well-engineered components for import scanning and disassembly, but overall the codebase requires careful use due to thread-safety and maintenance concerns.