Skip to content

Conversation

g0th1c54e4
Copy link

I’m developing a plugin to enhance the trace functionality of x64dbg (then it can carry more useful information to assist with reverse engineering). To achieve this, I considered appending additional data into the existing JSON blob inside the trace file. However, currently x64dbg enforces a size limit of 16,384 bytes (0x4000) for the JSON blob, which prevents this approach.

I’d like to remove this restriction. Or is there a specific reason why the JSON blob size must be limited when parsing trace files?

@g0th1c54e4
Copy link
Author

g0th1c54e4 commented Aug 26, 2025

I forgot to clarify the reason why I want to remove the size limit: Trace files with additional appended information currently fail to open in x64dbg(The reason is simply the size restriction imposed on the JSON blob). However, I want x64dbg to still be able to open these files (I did not modify any originally recorded trace data—I only appended extra information).
For parsing and reading this additional information, I have a separate repository that handles it: https://github.com/g0th1c54e4/x64dbg-trace-parser

@mrexodia
Copy link
Member

I'm okay with removing the limit, but perhaps @torusrxxx has some insight in why it exists. I suspect it was just added as a sanity check, because the documentation does not mention it: https://help.x64dbg.com/en/latest/developers/tracefile.html

Copy link
Member

@mrexodia mrexodia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See other comment.

@torusrxxx
Copy link
Member

The size check enforced here primarily serves as a sanity check to prevent the following code from attempting to read a lot of data (necessary if the file is corrupted and specifies a size on the order of hundreds of megabytes). The JSON parser used here QJsonDocument is not intended to parse a big document efficiently. The size limit 16KB is a reasonable size to store the list of modules, memory maps, thread lists and things like that. It's not intended to be a debug database with many megabytes of data (which should use a better JSON parser). The correct way to add lots of information to a trace file is to define a new chunk type so that x64dbg does not attempt to decode the huge JSON with mostly unsupported information. (If you did that, please share it with us so we don't use the same type number for something else in the future.)

@torusrxxx
Copy link
Member

Hm, it seems x64dbg does not like any other chunk type (throw std::wstring(L"Unsupported block type");), and that should be fixed instead.

@g0th1c54e4 g0th1c54e4 requested a review from mrexodia August 26, 2025 13:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants