$ show x64dbg/TitanEngine
TitanEngine is a Windows-native C/C++ library for reverse engineering, debugging, and unpacking PE executables. It provides a large exported C API covering process debugging (create/attach/detach, breakpoints, stepping), memory and register manipulation, PE file parsing and modification (sections, imports, exports, relocations, TLS), hooking (code redirection, IAT patching), import reconstruction (IAT scanning, dump fixing via integrated Scylla wrapper), anti-debugging evasion, and static file analysis (hashes, decompression). The codebase is primarily a monolithic DLL with hundreds of functions, tightly coupled to the Windows NT API and undocumented structures. It is the core engine behind the x64dbg debugger's unpacking and import-repair capabilities. While the library is functionally complete and has been battle-tested, it exhibits significant technical debt: heavy use of global mutable state, non-reentrant functions, manual memory management, hardcoded OS-specific offsets, and monolithic functions (e.g., DebugLoop). Some subsystems—such as the breakpoint handler, memory I/O with breakpoint bypass, file mapping utilities, and the self-contained ntdll.h header—demonstrate high craftsmanship and are reusable in other projects. The integration of scylla_wrapper and distorm adds well-engineered components for import scanning and disassembly, but overall the codebase requires careful use due to thread-safety and maintenance concerns.
The LLM identified 4 files worth highlighting for reuse:
Implements MemoryReadSafe and MemoryWriteSafe – robust memory I/O functions that handle breakpoint bytes by temporarily removing them, reading/writing, and restoring. Also manages page-guard-based memory breakpoints with thread-safe critical section locking. This pattern is reusable for any debugger or memory scanner that needs to avoid triggering software breakpoints.
Provides the DynBuf class, a dynamically allocated buffer using std::vector<char> with automatic cleanup. Used extensively across the engine for variable-size allocations (e.g., TLS arrays, handle info buffers). Demonstrates a simple, self-contained RAII pattern that can be extracted to any C++ project needing a safe dynamic buffer.
A comprehensive header redefining Windows NT native API structures and prototypes, covering system information classes, PEB/TEB, LDR, debug objects, mitigation policies, and many undocumented Nt/Zw/Rtl functions. Multiple static_asserts verify structure layout against known offsets. This is a reusable research artifact that any Windows native code (especially reverse engineering tools) can incorporate to avoid SDK dependencies. It includes version-adaptive guards and portable helpers for NtCurrentPeb, list operations, etc.
Implements advanced IAT scanning by disassembling process memory via diStorm, identifying CALL/JMP pointers, and filtering valid API addresses. Includes a scoring mechanism to disambiguate duplicate APIs (e.g., A/W suffixes, ordinal analysis). This module is self-contained (depends only on ProcessAccessHelp and diStorm) and could be reused in other unpackers or import repair tools.