What is xAnalyzer?
xAnalyzer is a powerful plugin for the x86/x64 x64dbg debugger that performs extensive static code analysis on debugged applications. It automatically detects API function calls and enriches your debugging session with detailed function definitions, argument types, data types, and additional debugging information. Think of xAnalyzer as bringing OllyDbg’s analysis engine capabilities to x64dbg, making your disassembly more comprehensible before you even start debugging.xAnalyzer is based on the APIInfo Plugin by @mrfearless, with significant improvements and additional features for modern reverse engineering workflows.
Key Features
xAnalyzer provides several powerful analysis capabilities to enhance your debugging workflow:Extensive API Coverage
Over 13,000 API definitions from almost 200 DLLs, covering Windows APIs, common libraries, and frameworks
Automatic Loop Detection
Identifies loops in your code automatically, helping you understand control flow at a glance
Smart Function Analysis
Detects direct and indirect function calls, including dynamic pointers and register-based calls
User-Maintained Definitions
Expandable system of API definition files you can customize and extend for your needs
Extended Analysis Capabilities
xAnalyzer goes beyond basic API recognition:- Defined and generic function recognition - Analyzes both documented API calls and undefined functions
- Argument and data type detection - Automatically identifies function parameters, their types, and values
- Symbols recognition - Supports 1000+ enum data types and 800+ flags with their corresponding values
- Function smart tracking - Predicts and recognizes indirect function calls like
CALL {REGISTER}orCALL {POINTER} - VB DllFunctionCall stub detection - Special handling for Visual Basic executables
Before and After xAnalyzer
See the difference xAnalyzer makes in your debugging session:Before Analysis
Raw disassembly with minimal context - just instruction mnemonics and addresses.After Analysis
Enriched disassembly with:- Function names and definitions
- Parameter names and types
- Argument values with their meanings
- Loop indicators
- Helpful comments explaining API behavior
The plugin currently supports both x86 and x64 architectures, with specialized handling for calling convention differences between platforms.
How xAnalyzer Works
When you load a program in x64dbg with xAnalyzer installed, the plugin:- Scans the code section - Identifies all function calls and control flow structures
- Matches API definitions - Looks up each function call in its extensive definition database
- Traces arguments - Works backward through instructions to identify parameters being passed
- Enriches disassembly - Adds comments, labels, and contextual information to your code view
- Detects patterns - Identifies loops, common code patterns, and indirect calls
Analysis Modes
xAnalyzer offers flexible analysis options to match your workflow:Selection Analysis
Analyze a specific range of instructions you’ve selected - fast and focused on the code you’re examining
Who Should Use xAnalyzer?
xAnalyzer is designed for:- Reverse engineers analyzing unfamiliar binaries
- Malware analysts needing quick API behavior insights
- Security researchers tracking function calls and data flow
- Software developers debugging complex applications
- Anyone who wants a more readable and informative disassembly view
Version Information
Current version: 2.5.6The plugin is actively maintained and regularly updated with new API definitions and features. You can track development and report issues on the GitHub repository.