Skip to main content

​
Overview

The Analyze Module feature performs a complete, comprehensive analysis over the entire module currently being debugged. This is the most thorough analysis mode in xAnalyzer and provides the closest experience to OllyDbg’s initial analysis behavior in x64dbg.
Module analysis can take significant time and resources, especially with Extended Analysis enabled. It may consume large amounts of RAM depending on the module size and the amount of data being added.

​
How to Analyze a Module

There are three ways to perform module analysis:

​
Method 1: Using the Context Menu

1

Select any instruction

Click on any instruction in the disassembly window within the module you want to analyze.
2

Open context menu

Right-click to open the context menu.
3

Launch analysis

Navigate to Plugins → xAnalyzer → Analyze Module.
4

Wait for completion

xAnalyzer will display a progress indicator as it processes the entire module. This may take from seconds to several minutes depending on the module size.

​
Method 2: Using the Command

Execute the module analysis command in the x64dbg command line: 
xanal module
This command starts a full analysis of the current module.

​
Method 3: Using Hotkeys

1

Configure shortcuts

Go to Options → Preferences → Shortcuts in x64dbg.
2

Find the command

Locate the xAnalyzer module analysis command.
3

Set hotkey

Assign your preferred keyboard shortcut.
4

Apply and use

Save the configuration and use your hotkey to launch module analysis anytime.

​
Method 4: Automatic Analysis

Enable the Automatic Analysis option to run module analysis automatically when the debugger reaches the entry point:
1

Open xAnalyzer options

In x64dbg, go to Plugins → xAnalyzer → Options.
2

Enable automatic analysis

Check the Automatic Analysis option.
3

Save settings

The setting is saved automatically. Next time you load an executable, xAnalyzer will analyze it automatically at the entry point.
With Automatic Analysis enabled, you get OllyDbg-like behavior where your code is pre-analyzed and ready to debug as soon as you hit the entry point.

​
Analysis Modes

Module analysis offers two modes that affect the depth and scope of analysis:

​
Regular Analysis (Default)

Analyzes the main executable code sections with optimal performance:
  • Processes the primary code section
  • Detects all API function calls
  • Identifies loop structures
  • Analyzes defined functions from API definition files
  • Fast completion time
  • Moderate memory usage

​
Extended Analysis

Provides deeper analysis across the entire code section:
  • Analyzes all code sections, not just the main section
  • More comprehensive coverage
  • Detects additional function calls and patterns
  • Significantly longer processing time
  • Higher memory consumption
Extended Analysis can take much more time and resources to complete. Large executables may use substantial RAM. Only enable this mode when you need comprehensive coverage of all code sections.
To enable Extended Analysis:
1

Open options

Go to Plugins → xAnalyzer → Options.
2

Enable extended analysis

Check the Extended Analysis option.
3

Run analysis

The next module analysis will use extended mode.

​
What Gets Analyzed

Module analysis provides complete coverage of:

​
API Function Calls

  • Over 13,000 API definitions from nearly 200 DLLs
  • Complete function prototypes and signatures
  • All function arguments with names and data types
  • Return value information
  • Calling conventions

​
Loop Structures

  • Automatic detection of all loops in the module
  • Loop entry and exit points labeled
  • Nested loop recognition
  • Loop depth analysis

​
VB DllFunctionCall Stubs

  • Detection of Visual Basic “DllFunctionCall” stub patterns
  • Proper labeling of VB-specific code structures

​
Function Tracking

  • Smart prediction of indirect calls
  • Recognition of function pointers
  • Tracking of dynamic function calls
  • Call chain analysis

​
Data Type Recognition

  • Constants and enums (1000+ enum types, 800+ flags)
  • Flags and bit field analysis
  • String arguments cleaned and formatted
  • Numeric and non-numeric parameter types

​
Progress Indicator

During module analysis, xAnalyzer displays a progress indicator showing:
  • Current progress percentage
  • Number of instructions processed
  • Estimated time remaining (for larger modules)
You can continue using x64dbg during analysis, but the interface may be less responsive with very large modules. It’s recommended to wait for analysis to complete before debugging.

​
Execution Summary

After module analysis completes, xAnalyzer logs a detailed execution summary in the x64dbg Log window: 
[xAnalyzer] Analysis Summary:
[xAnalyzer] - Defined API Calls Detected: 247
[xAnalyzer] - Undefined Calls Detected: 83
[xAnalyzer] - DLL Function Calls Detected: 15
[xAnalyzer] - Loops Detected: 42
[xAnalyzer] - Total Comments Set: 531
[xAnalyzer] - Total Labels Set: 89
[xAnalyzer] - Analysis completed in 2.4 seconds
This summary helps you understand what was found during analysis.

​
Configuration Impact

Module analysis behavior is affected by these configuration options: Automatic Analysis: When enabled, analysis runs automatically at the entry point. Extended Analysis: Controls whether to analyze only the main code section or all code sections. Analyze Undefined Functions: Determines if undefined/undocumented functions should be analyzed with generic parameters. Track Undefined Functions: Enables smart tracking for indirect function calls. Clear Auto Comments/Labels: Controls whether previous analysis data is cleared before new analysis.

Configuration Options

Learn more about all xAnalyzer configuration settings

​
Performance Considerations

Module analysis typically completes in seconds. Extended Analysis can be safely used.
Regular analysis takes 10-30 seconds. Extended Analysis may take 1-2 minutes and use several hundred MB of RAM.
Regular analysis may take 1-5 minutes. Extended Analysis can take 5-15 minutes or more and may use GB of RAM. Consider using function or selection analysis instead.
Full module analysis may not be practical. Use Analyze Function or Analyze Selection for targeted analysis of specific areas of interest.

​
Best Practices

1

Start with regular analysis

Run module analysis without Extended Analysis first to see if it provides sufficient coverage for your needs.
2

Save your database

After module analysis, save your x64dbg database file. This preserves all analysis comments and labels for future sessions.
3

Use selective analysis for large modules

For very large executables, consider analyzing specific functions or sections rather than the entire module.
4

Review the execution summary

Check the log window after analysis to see what was detected and ensure the analysis completed successfully.

​
Use Cases

Initial reconnaissance: When first examining an unknown executable to understand its structure and API usage. Comprehensive documentation: When you need complete coverage of all function calls and code patterns. OllyDbg-style workflow: Mimicking OllyDbg’s automatic analysis behavior for a familiar debugging experience. Malware analysis: Obtaining a complete picture of an executable’s capabilities before detailed analysis. Automated analysis: Setting up automatic analysis for consistent, repeatable analysis of multiple samples.

Analyze Selection

Quick analysis of selected instructions

Analyze Function

Analyze a specific function only

Remove Analysis

Remove analysis data from module

Configuration

Configure analysis behavior

Build docs developers (and LLMs) love

Get started for freeTalk to us