When analysts need to follow a Windows program closely without its source code, many of them reach for x64dbg, an open source debugger built for reverse engineering and malware analysis. It is released under the GPL v3, in a modified form that adds a clause on how plugins are treated, and development happens on GitHub, where the current repository was opened in April 2015.
No company stands behind the software. It is maintained by a community of contributors, and the developer list starts with the person known as mrexodia, who is also the recipient of the donation link on the official site. GitHub counts more than 49,000 stars on the repository, changes were still landing in October 2026, and the latest tagged release dates from 27 May 2026.
What x64dbg is for
A disassembler such as IDA Pro or Ghidra studies a file at rest, whereas x64dbg works on a running program. You launch the executable under its control, or attach to a process that is already running, then step through it one instruction at a time while keeping an eye on CPU registers, the stack and memory. It comes as two variants sharing one interface, x32dbg for 32-bit programs and x64dbg for 64-bit ones, and it can debug DLL libraries as well as applications.
The interface borrows conventions IDA users will recognise, such as a sidebar where arrows trace jumps and highlighting that marks a register in every instruction that touches it. It offers a memory map, loaded modules with their symbols, threads, the call stack, structured exception handlers and a control flow graph. Under the hood x64dbg relies on well-known open source components: TitanEngine for debugging, Zydis for disassembly, and XEDParse and asmjit for the built-in assembler.
Its advanced features explain why it is a fixture in analysis labs. Conditional breakpoints and conditional tracing are driven by a C-like expression parser, and a scripting language takes care of repetitive sequences. The Scylla module rebuilds the import table of a program once it has unpacked itself in memory, a frequent step when a sample is wrapped in an executable packer. The debugger can also patch an executable and save the result, keep comments and labels in a JSON database, and host plugins through a documented API.
The April 2026 release added initial support for screen readers, and one contributor is separately working on an experimental Linux debugger that is still at a pre-alpha stage. x64dbg does not compete with static disassemblers so much as complement them. A common approach is to spot an interesting function in Ghidra, IDA Pro or Binary Ninja, then run it in x64dbg to see the actual values. System Informer, for its part, gives the wider picture of processes and services on the machine.
Who is it for?
x64dbg is aimed at malware analysts, vulnerability researchers, security students and developers trying to work out why a program shipped without symbols misbehaves. Free and with no account to create, it fits classrooms as comfortably as incident response teams.
Its boundaries are clear. x64dbg runs only on Windows and debugs only user mode programs, so drivers and the operating system kernel call for WinDbg, Microsoft’s own tool. It is not a decompiler either and produces no pseudocode. The documentation points out that memory breakpoints cover a whole page, unlike some other debuggers, and its defences against anti-debugging tricks are basic. Above all, debugging malware means running it, which is why the work belongs in an isolated virtual machine and never on an everyday computer.
Download x64dbg safely
Official builds are published on the Releases page of the x64dbg/x64dbg repository on GitHub, which the x64dbg.com site links to, and the project also keeps snapshots on SourceForge. Each release is named after its date. There is no installer: you download a zip archive of about 30 MB, extract it to any folder and start x32dbg or x64dbg. A separate archive holds debug symbols, and two more contain the plugin development kit.
x64dbg costs nothing and has no commercial edition. Since the project ships nothing but a zip archive, any x64dbg installer offered by a third-party site is packaging the project never produced. On a machine meant for taking malware apart, where your tools come from matters as much as where your samples come from.
Frequently asked questions
Is x64dbg free?
Yes. It is released under a slightly modified GPL v3 that clarifies the status of plugins, and there is no paid version. Source code and binaries are both available on GitHub.
Does x64dbg run on Linux or macOS?
Not for everyday use. The debugger is built for Windows and targets Windows programs. Work on a Linux version began in 2026, but it is described as a pre-alpha prototype.
How does x64dbg differ from IDA Pro?
IDA Pro is first and foremost a disassembler and decompiler that analyses a file without running it, even though it includes a debugger. x64dbg focuses on stepping through Windows programs and inspecting their memory. The two often work side by side during the same investigation.
