Archive notice

- remove ambiguous pronoun in the document

.gitignore

@@ -1,2 +1,3 @@
 _build*/
-*.chm
+*.chm
+python-2.7.18.amd64.portable/

.readthedocs.yaml

@@ -0,0 +1,23 @@
+# Read the Docs configuration file
+# See https://docs.readthedocs.io/en/stable/config-file/v2.html for details
+
+# Required
+version: 2
+
+# Set the version of Python and other tools you might need
+build:
+  os: ubuntu-22.04
+  tools:
+    python: "2.7"
+
+# Build documentation in the docs/ directory with Sphinx
+sphinx:
+  builder: html
+  configuration: conf.py
+  fail_on_warning: false
+
+# We recommend specifying your dependencies to enable reproducible builds:
+# https://docs.readthedocs.io/en/stable/guides/reproducible-builds.html
+python:
+  install:
+  - requirements: requirements.txt

README.md

@@ -1,9 +1,15 @@
-# docs
-
-Documentation repository for [x64dbg](http://x64dbg.com) at [Read the Docs](https://readthedocs.org/projects/x64dbg).
-
-## Building
-
-1. `pip install sphinx recommonmark==0.4.0`
-2. Add `relpath = relpath.replace(os.path.sep, '/')` to `C:\Python27\Lib\site-packages\recommonmark\transform.py` line `69`
-3. run `makechm.bat`. It will build the .CHM help file.
+# This repository was moved to https://github.com/x64dbg/x64dbg/tree/development/docs
+
+# docs
+
+Documentation repository for [x64dbg](http://x64dbg.com) at [Read the Docs](https://readthedocs.org/projects/x64dbg).
+
+## Building
+
+1. Download https://github.com/x64dbg/docs/releases/download/python27-portable/python-2.7.18.amd64.portable.7z
+2. Extract to the `python-2.7.18.amd64.portable` folder
+3. run `makechm.bat`. It will build the .CHM help file.
+
+Note: The following patch was applied:
+
+Add `relpath = relpath.replace(os.path.sep, '/')` after `C:\Python27\Lib\site-packages\recommonmark\transform.py` line `63`

commands/analysis/index.rst

@@ -16,6 +16,8 @@ This section contains commands that are used for analysis.
    analadv
    virtualmod
    symdownload
+   symload
+   symunload
    imageinfo
    GetRelocSize
    exhandlers

commands/analysis/symdownload.md

@@ -4,7 +4,7 @@ Attempt to download a symbol from a Symbol Store.
 
 ## arguments
 
-`[arg1]` Module name (with or without extension) to attept to download symbols for. When not specified, an attempt will be done to download symbols for all loaded modules.
+`[arg1]` Module name (with or without extension) to attempt to download symbols for. When not specified, an attempt will be done to download symbols for all loaded modules.
 
 `[arg2]` Symbol Store URL. When not specified, the default store will be used.
 

commands/analysis/symload.md

@@ -0,0 +1,15 @@
+# symload/loadsym
+
+Attempt to load a symbol from disk.
+
+## arguments
+
+`arg1` Module name (with or without extension) to attempt to load symbols for.
+
+`arg2` Path to the symbol file.
+
+`[arg3]` Force load. Set to `1` to skip symbol validation.
+
+## result
+
+This command does not set any result variables.

commands/analysis/symunload.md

@@ -0,0 +1,11 @@
+# symunload/unloadsym
+
+Unload a symbol.
+
+## arguments
+
+`arg1` Module name (with or without extension) to unload symbols from.
+
+## result
+
+This command does not set any result variables.

commands/breakpoint-control/LibrarianSetBreakpoint.md

@@ -6,9 +6,9 @@ Set a singleshoot breakpoint on DLL load/unload.
 
 `arg1` DLL Name to break on.
 
-`[arg2]` 'l' means on load, 'u' means on unload. When not specified, x64dbg will break on both load and unload.
+`[arg2]` `a` means on load and unload, `l` means on load, `u` means on unload. When not specified, x64dbg will break on both load and unload.
 
-`[arg3]` When specified, the breakpoint will not be singleshoot. When not specified the breakpoint will be removed after it has been hit.
+`[arg3]` When specified, the breakpoint will be singleshoot. When not specified the breakpoint will not be removed after it has been hit.
 
 ## result
 

commands/breakpoint-control/SetMemoryBPX.md

@@ -6,7 +6,7 @@ Set a memory breakpoint (GUARD_PAGE) on the whole memory region the provided add
 
 `arg1` Address of or inside a memory region that will be watched.
 
-`[arg2]` 1/0 restore the memory breakpoint once it's hit? When this value is not equal to '1' or '3', it's assumed to be arg3. This means "bpm eax,r" would be the same command as: "bpm eax,0,r".
+`[arg2]` 1/0 restore the memory breakpoint once it's hit? When this value is not equal to '1' or '0', it's assumed to be arg3. This means "bpm eax,r" would be the same command as: "bpm eax,0,r".
 
 `[arg3]` Breakpoint type, it can be 'a' (read+write+execute) 'r' (read), 'w' (write) or 'x' (execute). Per default, it's 'a' (read+write+execute)
 

commands/breakpoint-control/SetMemoryRangeBPX.md

@@ -0,0 +1,15 @@
+# SetMemoryRangeBPX/memrangebp/bpmrange
+
+Set a memory breakpoint (GUARD_PAGE) on a specific memory range.
+
+## arguments
+
+`start` Start of the memory range.
+
+`size` Size of the memory range.
+
+`[type]` Breakpoint type, it can be 'a' (read+write+execute) 'r' (read), 'w' (write) or 'x' (execute). Per default, it's 'a' (read+write+execute). Append `ss` for a singleshot breakpoint (you can also use [`SetMemoryBreakpointSingleshoot`](../conditional-breakpoint-control/SetMemoryBreakpointSingleshoot.md) to do this).
+
+## result
+
+This command does not set any result variables.

commands/breakpoint-control/index.rst

@@ -17,6 +17,7 @@ This section contains breakpoint control (set/delete/enable/disable) commands.
    EnableHardwareBreakpoint
    DisableHardwareBreakpoint
    SetMemoryBPX
+   SetMemoryRangeBPX
    DeleteMemoryBPX
    EnableMemoryBreakpoint
    DisableMemoryBreakpoint

commands/debug-control/InitDebug.md

@@ -8,7 +8,7 @@ Initializes the debugger. This command will load the executable (do some basic c
 
 `[arg2]` Commandline to create the process with.
 
-`[arg3]` Current folder (passed to the `CreateProcess` API).
+`[arg3]` Current folder (passed to the `CreateProcess` API) (this is also sometimes called 'working directory' or 'current directory')
 
 ## result
 

commands/debug-control/StepSystem.md

@@ -0,0 +1,11 @@
+# StepSystem/StepSystemInto
+
+Step into until reaching a system module.
+
+## arguments
+
+This command has no arguments.
+
+## results
+
+This command does not set any result variables.

commands/debug-control/StepUser.md

@@ -0,0 +1,11 @@
+# StepUser/StepUserInto
+
+Step into until reaching a user module.
+
+## arguments
+
+This command has no arguments.
+
+## results
+
+This command does not set any result variables.

commands/debug-control/index.rst

@@ -24,4 +24,6 @@ Debug Control
    StepOut
    eStepOut
    skip
-   InstrUndo
+   InstrUndo
+   StepUser
+   StepSystem

commands/general-purpose/bswap.md

@@ -1,6 +1,6 @@
 # bswap
 
-Perform a `bswap` operation.
+Perform a `bswap` operation: The byte order of the destination is inverted, so the last byte becomes the first.
 
 ## arguments
 

commands/general-purpose/dec.md

@@ -1,4 +1,4 @@
-# dec
+# dec
 
 Decrease a value.
 
@@ -8,4 +8,4 @@ Decrease a value.
 
 ## result
 
-This command does not set any result variables.
+This command does not set any result variables.

commands/general-purpose/index.rst

@@ -12,6 +12,7 @@ This section contains various commands that are used for calculations etc.
    add
    sub
    mul
+   mulhi
    div
    and
    or
@@ -24,8 +25,13 @@ This section contains various commands that are used for calculations etc.
    shl
    shr
    sar
+   popcnt
+   lzcnt
    push
    pop
    test
    cmp
    mov
+   movdqu
+   vmovdqu
+   kmovd

commands/general-purpose/kmovd.md

@@ -0,0 +1,20 @@
+# kmovd/kmovq
+
+The `kmovd`/`kmovq` commands are used to access AVX-512 opmask registers `K0`-`K7`. These commands are only available when the computer and x64dbg version supports AVX-512.
+
+The `kmovd` command copies a 32-bit value from an expression to an AVX-512 opmask register, or from an AVX-512 opmask register to a memory location, a general purpose register, or an opmask register.
+If the destination is a 64-bit register, for example, an opmask register, then the 32-bit value is zero-extended to 64 bits.
+
+The `kmovq` command copies a 64-bit value from an expression to an AVX-512 opmask register, or from an AVX-512 opmask register to a memory location, a general purpose register, or an opmask register.
+If executed in 32-bit environment, then only memory locations in the form of `[address]` or opmask registers are supported as operands.
+In 64-bit environment, all valid expressions can be used to calculate the value to be copied into the destination opmask register.
+
+## arguments
+
+`arg1` The destination operand.
+
+`arg2` The source operand.
+
+## result
+
+This command does not set any result variables.

commands/general-purpose/lzcnt.md

@@ -0,0 +1,11 @@
+# lzcnt
+
+Count the number of leading zeros of a value. If the value is 0, then the result is 64 on 64-bit platform and 32 on 32-bit platform.
+
+## arguments
+
+`arg1` Value.
+
+## result
+
+`arg1` is set to the number of leading zeros. Additionaly, the internal variable `$_EZ_FLAG` is set to 1 if `arg1` is 0, and set to 0 otherwise. The internal variable `$_BS_FLAG` is set to 0.

commands/general-purpose/mov.md

@@ -4,7 +4,7 @@ Set a variable.
 
 ## arguments
 
-`arg1` Variable name (optionally prefixed with a $) to set. When the variable does not exist, it will be created.
+`arg1` Variable name (optionally prefixed with a $) to set. When the variable does not exist, it will be created. Note that SSE registers are not supported (Instead use [movdqu](movdqu.md) for SSE registers).
 
 `arg2` Value to store in the variable. If you use `#11 22 33#` it will write the bytes `11 22 33` in the process memory at `arg1`.
 

commands/general-purpose/movdqu.md

@@ -0,0 +1,13 @@
+# movdqu/movups/movupd
+
+Read/write an XMM register. The source and destination operands can be either an XMM register, or a memory location. The value of destination operand will be set to source operand. When using a memory location, only the syntax `[addr]` is supported, where `addr` is an expression of the memory address. Unlike other commands, the size of operands are 16 bytes. MM/YMM/ZMM registers are not supported by this command, to access YMM/ZMM registers, use [`vmovdqu`](vmovdqu.md) command.
+
+## arguments
+
+`arg1` The destination operand.
+
+`arg2` The source operand.
+
+## result
+
+This command does not set any result variables.

commands/general-purpose/mul.md

@@ -1,6 +1,6 @@
 # mul
 
-Multiply two values.
+Multiply two values and store the lower part of result into `arg1`.
 
 ## arguments
 

commands/general-purpose/mulhi.md

@@ -0,0 +1,13 @@
+# mulhi
+
+Multiply two unsigned values and store the upper part of result into `arg1`.
+
+## arguments
+
+`arg1` Destination.
+
+`arg2` Source.
+
+## result
+
+This command does not set any result variables.

commands/general-purpose/popcnt.md

@@ -0,0 +1,11 @@
+# popcnt
+
+Evaluate the population count of a value, that is, number of bits set to 1.
+
+## arguments
+
+`arg1` Value.
+
+## result
+
+`arg1` is set to the population count. Additionaly, the internal variable `$_EZ_FLAG` is set to 1 if `arg1` is 0, and set to 0 otherwise. The internal variable `$_BS_FLAG` is set to 0.

commands/general-purpose/rol.md

@@ -1,6 +1,6 @@
 # rol
 
-Binary ROL a value.
+Binary ROL (rotate left) a value.
 
 ## arguments
 

commands/general-purpose/ror.md

@@ -1,6 +1,6 @@
 # ror
 
-Binary ROR a value.
+Binary ROR (rotate right) a value.
 
 ## arguments
 

commands/general-purpose/vmovdqu.md

@@ -0,0 +1,13 @@
+# vmovdqu/vmovups/vmovupd
+
+Read/write a YMM/ZMM register. The source and destination operands can be either an YMM/ZMM register, or a memory location. The value of destination operand will be set to source operand. When using a memory location, only the syntax `[addr]` is supported, where `addr` is an expression of the memory address. Unlike other commands, the size of operands are 32 bytes for YMM registers and 64 bytes for ZMM registers. To access ZMM registers, the computer and x64dbg version must support AVX-512. To access XMM registers, use [`movdqu`](movdqu.md) command.
+
+## arguments
+
+`arg1` The destination operand.
+
+`arg2` The source operand.
+
+## result
+
+This command does not set any result variables.

commands/gui/refadd.md

@@ -6,7 +6,7 @@ Add an entry to the reference view. You need to call 'refinit' before using refa
 
 `arg1` Address to put in the reference view.
 
-`arg2` Text to put after the address. You can use [String Formatting](../../introduction/Formatting.rst) here.
+`arg2` Text to put after the address. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 ## result
 

commands/gui/refget.md

@@ -1,4 +1,4 @@
-# reget
+# refget
 
 Retrieve the address of a reference.
 

commands/gui/refinit.md

@@ -4,7 +4,7 @@ Initialize reference view for command usage.
 
 ## arguments
 
-`[arg1]` The title of the new reference view. You can use [String Formatting](../../introduction/Formatting.rst) here.
+`[arg1]` The title of the new reference view. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 ## result
 

commands/gui/sdump.md

@@ -1,6 +1,6 @@
 # sdump
 
-Dump the at a certain position.
+Dump the stack at a certain position.
 
 ## arguments
 

commands/index.rst

@@ -1,7 +1,17 @@
 Commands
 ========
 
-This is the documentation of x64dbg commands.
+Commands have the following format (notice the arguments are **comma separated**):
+
+``command arg1, arg2, argN``
+
+FAQ:
+
+- Please note that all integer constants are represented in hex. For example, after executing the following command, ``$i`` will be 256 (0x100): ``mov $i, 100`` . This also means a variable cannot begin with letters from A to F.
+- Throughout this documentation, ``[arg1]`` (argument with a square bracket) represents an optional argument. ``arg1`` (argument without a square bracket) represents an mandatory argument. "[" and "]" represent memory reference operation in expression evaluation for the argument. If you don't want to refer to the content in the memory pointer, don't add "[" and "]".
+- For commands with two or more arguments, a comma (,) is used to separate these arguments. Do not use a space to separate the arguments.
+- x64dbg only supports integer in expressions. Strings, Floating point numbers and SSE/AVX data is not supported. Therefore you cannot use ``[eax]=="abcd"`` operator to compare strings. Instead, you can compare the first DWORD/QWORD of the string, or use an appropriate plugin which provides such feature.
+- The "==" operator is used to test if both operands are equal. The "=" operator is used to transfer the value of the expression to the destination.
 
 **Contents:**
 

commands/memory-operations/index.rst

@@ -9,7 +9,9 @@ This section contains commands to manipulate memory inside the debuggee.
    
    alloc
    Fill
+   memcpy
    free
    getpagerights
    setpagerights
-   savedata
+   savedata
+   minidump

commands/memory-operations/memcpy.md

@@ -0,0 +1,15 @@
+# memcpy
+
+Copy memory in the context of the debuggee, without applying patches.
+
+## arguments
+
+`arg1` Destination address.
+
+`arg2` Source address.
+
+`arg3` Size to copy.
+
+## result
+
+This command sets `$result` to the total amount of bytes written at the destination. The condition `$result == arg3` is true if all memory was copied.

commands/memory-operations/minidump.md

@@ -0,0 +1,11 @@
+# minidump
+
+Create a [minidump](https://learn.microsoft.com/en-us/windows/win32/debug/minidump-files) with full memory and handle information from the debuggee.
+
+## arguments
+
+`arg1` The filename of the `.dmp`.
+
+## results
+
+This command does not set any result variables.

commands/memory-operations/savedata.md

@@ -4,7 +4,7 @@ Save a memory region to disk.
 
 ## arguments
 
-`arg1` The filename. If you use `:memdump:` as name it will save a file as `memdump_pid_addr_size.bin` in the x64dbg directory. You can use [String Formatting](../../introduction/Formatting.rst) here.
+`arg1` The filename. If you use `:memdump:` as name it will save a file as `memdump_pid_addr_size.bin` in the x64dbg directory. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 `arg2` The address of the memory region.
 

commands/misc/HideDebugger.md

@@ -1,6 +1,6 @@
 # HideDebugger/dbh/hide
 
-Hide the debugger from (very) simple detection methods.
+Hide the debugger from (very) simple detection methods. The PEB will be modified so that `IsDebuggerPresent()` will return false.
 
 ## arguments
 

commands/misc/asm.md

@@ -6,7 +6,7 @@ Assemble an instruction.
 
 `arg1` Address to place the assembled instruction at.
 
-`arg2` Instruction text. You can use [String Formatting](../../introduction/Formatting.rst) here.
+`arg2` Instruction text. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 `[arg3]` When specified the remainder of the previous instruction will be filled with NOPs.
 

commands/misc/gpa.md

@@ -10,4 +10,4 @@ Get the address of an export inside a DLL.
 
 ## result
 
-The $resultvariable is set to the export address. When the export is not found, $resultwill be set to 0.
+The $result variable is set to the export address. When the export is not found, $result will be set to 0.

commands/script/Jxx.md

@@ -3,12 +3,13 @@ Jxx/IFxx
 
 There are various branches that can react on the flags set by the `cmp` (and maybe other) command(s):
 
-* unconditional branch - `jmp`/`goto`* branch if not equal - `jne`/`ifne(q)`/`jnz`/`ifnz`
+* unconditional branch - `jmp`/`goto`
+* branch if not equal - `jne`/`ifne(q)`/`jnz`/`ifnz`
 * branch if equal - `je`/`ife(q)`/`jz`/`ifz`
 * branch if smaller - `jb`/`ifb`/`jl`/`ifl`
 * branch if bigger - `ja`/`ifa`/`jg`/`ifg`
-* branch if bigger/equal - `jbe`/`ifbe(q)`/`jle`/`ifle(q)`
-* branch if smaller/equal - `jae`/`ifae(q)`/`jge`/`ifge(q)`
+* branch if smaller/equal - `jbe`/`ifbe(q)`/`jle`/`ifle(q)`
+* branch if bigger/equal - `jae`/`ifae(q)`/`jge`/`ifge(q)`
 
 arguments
 ---------

commands/script/index.rst

@@ -18,4 +18,5 @@ This section contains various commands that are only used or available in a scri
    printstack
    ret
    scriptload
-   scriptdll
+   scriptdll
+   scriptcmd

commands/script/log.rst

@@ -6,7 +6,7 @@ Put information in the log.
 arguments
 ---------
 
-``[arg1]`` Format string (see :doc:`../../introduction/Formatting`). When not specified, a newline will be logged.
+``[arg1]`` Format string (see :doc:`../../introduction/Formatting`). When not specified, a newline will be logged. When using a format string it is recommended to use quotes to avoid ambiguity with the ``;`` (command separator): ``log "{mem;8@rax}"``.
 
 result
 ------

commands/script/msg.md

@@ -4,7 +4,7 @@ Display a message box.
 
 ## arguments
 
-`arg1` Message box text. You can use [String Formatting](../../introduction/Formatting.rst) here.
+`arg1` Message box text. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 ## result
 

commands/script/msgyn.md

@@ -4,7 +4,7 @@ Display a message box, asking the user to answer yes or no.
 
 ## arguments
 
-`arg1` Message box text. You can use [String Formatting](../../introduction/Formatting.rst) here.
+`arg1` Message box text. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 ## result
 

commands/script/scriptcmd.md

@@ -0,0 +1,29 @@
+# scriptcmd
+
+Execute a command in the context of a running script.
+
+## arguments
+
+Unlike other commands this command forwards everything after `scriptcmd ` directly to the command processor.
+
+For example `scriptcmd add rax, 0x1245` will execute the command `add rax, 0x1234`.
+
+## result
+
+This command does not set any result variables.
+
+## example
+
+This command can be used in combination with [SetBreakpointCommand](../conditional-breakpoint-control/SetBreakpointCommand.md) to execute scripts on breakpoint callbacks:
+
+```
+fn_addr = module.dll:$0x1234 // module.dll RVA 0x1234
+bp fn_addr
+SetBreakpointCommand fn_addr, "scriptcmd call mycallback"
+
+// make sure the script is not unloaded
+
+mycallback:
+log "fn({arg.get(0)}, {arg.get(1)})"
+ret
+```

commands/searching/find.md

@@ -1,16 +1,15 @@
 # find
 
-Find a pattern.
+Find a pattern in a memory page. If you want to find all occurrences of a pattern in a memory page use [findall](./findall.md).
 
 ## arguments
 
-`arg1` The address to start searching from. Notice that the searching will stop when the end of the memory page this address resides in has been reached. This means you cannot search the complete process memory without enumerating the memory pages first.
+`arg1` The address to start searching from. Notice that the searching will stop when the end of the memory page this address resides in has been reached. This means you cannot search the complete process memory without enumerating the memory pages first. If you want to find all occurrences of a pattern in the entire memory map use [findallmem](./findallmem.md).
 
-`arg2` The byte pattern to search for. This byte pattern can contain wildcards (?) for example: `EB0?90??8D`.
+`arg2` The byte pattern to search for. This byte pattern can contain wildcards (?) for example: `EB0?90??8D`. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 `[arg3]` The size of the data to search in. Default is the size of the memory region.
 
 ## result
 
-The $result variable is set to the virtual address of the address that matches the byte pattern. $result will be 0 when the pattern could not be matched.
-
+The `$result` variable is set to the virtual address of the address that matches the byte pattern. `$result` will be 0 when the pattern could not be matched.

commands/searching/findall.md

@@ -1,15 +1,43 @@
 # findall
 
-Find all occurrences of a pattern.
+Find all occurrences of a pattern in a memory page.
 
 ## arguments
 
-`arg1` The address to start searching from. Notice that the searching will stop when the end of the memory page this address resides in has been reached. This means you cannot search the complete process memory without enumerating the memory pages first.
+`arg1` The address to start searching from. Notice that the searching will stop when the end of the memory page this address resides in has been reached. This means you cannot search the complete process memory without enumerating the memory pages first. You can use [findallmem](./findallmem.md) to search for a pattern in the whole memory.
 
-`arg2` The byte pattern to search for. This byte pattern can contain wildcards (?) for example: `EB0?90??8D`.
+`arg2` The byte pattern to search for. This byte pattern can contain wildcards (?) for example: `EB0?90??8D`. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 `[arg3]` The size of the data to search in. Default is the size of the memory region.
 
 ## result
 
 `$result` is set to the number of occurrences.
+
+## examples
+
+Search for all occurrences a pattern in the memory page CIP is residing:
+
+```
+findall mem.base(cip), "0FA2 E8 ???????? C3"
+```
+
+Search for all occurences of the value of cax in the stack memory page:
+
+```
+findall mem.base(csp), "{bswap@cax}"
+```
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/searching/findallmem.md

@@ -6,10 +6,26 @@ Find all occurrences of a pattern in the entire memory map.
 
 `arg1` The address to start searching from.
 
-`arg2` The byte pattern to search for. This byte pattern can contain wildcards (?) for example: `EB0?90??8D`.
+`arg2` The byte pattern to search for. This byte pattern can contain wildcards (?) for example: `EB0?90??8D`. You can use [String Formatting](../../introduction/Formatting.md) here.
 
-`[arg3]` The size of the data to search in. Default is the entire memory map.
+`[arg3]` The size of the data to search in. Default is the entire memory map (`-1`).
+
+`[arg4]` Set to `user`/`system`/`module` to only include (user/system) modules in the search.
 
 ## result
 
 `$result` is set to the number of occurrences.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/searching/findasm.md

@@ -4,7 +4,7 @@ Find assembled instruction.
 
 ## arguments
 
-`arg1` Instruction to look for (make sure to use quoted "mov eax, ebx" to ensure you actually search for that instruction). You can use [String Formatting](../../introduction/Formatting.rst) here.
+`arg1` Instruction to look for (make sure to use quoted "mov eax, ebx" to ensure you actually search for that instruction). You can use [String Formatting](../../introduction/Formatting.md) here.
 
 `[arg2]` Address of/inside a memory page to look in. When not specified CIP will be used.
 
@@ -12,4 +12,18 @@ Find assembled instruction.
 
 ## result
 
-The $result variable is set to the number of references found.
+The `$result` variable is set to the number of references found.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/searching/findguid.md

@@ -12,4 +12,18 @@ Find references to GUID. The referenced GUID must be registered in the system, o
 
 ## results
 
-Set `$result` to `1` if any GUID is found, `0` otherwise.
+Set `$result` to `1` if any GUID is found, `0` otherwise.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/searching/index.rst

@@ -17,6 +17,4 @@ This section contains commands that are used to search data.
    reffindrange
    refstr
    modcallfind
-   yara
-   yaramod
    setmaxfindresult

commands/searching/modcallfind.md

@@ -11,3 +11,17 @@ Find all inter-modular calls.
 ## result
 
 The `$result` variable is set to the number of inter-modular calls found.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/searching/reffind.md

@@ -12,4 +12,18 @@ Find references to a certain value.
 
 ## result
 
-The $result variable is set to the number of references found.
+The `$result` variable is set to the number of references found.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/searching/reffindrange.md

@@ -15,3 +15,17 @@ Find references to a certain range of values.
 ## result
 
 The `$result` variable is set to the number of references found.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/searching/refstr.md

@@ -10,4 +10,18 @@ Find referenced text strings.
 
 ## result
 
-The $result variable is set to the number of string references found.
+The `$result` variable is set to the number of string references found.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/searching/yara.md

@@ -1,19 +0,0 @@
-# yara
-
-Apply Yara rules to a memory range.
-
-YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic.
-
-Yara is a separate project. You can view its documentation at [http://yara.readthedocs.io](http://yara.readthedocs.io). x64dbg also maintains a list of Yara signatures at [https://github.com/x64dbg/yarasigs](https://github.com/x64dbg/yarasigs).
-
-## arguments
-
-`arg1` Rules file to apply. This should be a full path.
-
-`[arg2]` Start address of the range to apply the rules to. If not specified, the disassembly selection will be used.
-
-`[arg3]` Size of the range to apply the rules to. When not specified, the whole page will be used.
-
-## result
-
-This command does not set any result variables.

commands/searching/yaramod.md

@@ -1,17 +0,0 @@
-# yaramod
-
-Apply Yara rules to a module.
-
-YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic.
-
-Yara is a separate project. You can view its documentation at [http://yara.readthedocs.io](http://yara.readthedocs.io). x64dbg also maintains a list of Yara signatures at [https://github.com/x64dbg/yarasigs](https://github.com/x64dbg/yarasigs).
-
-## arguments
-
-`arg1` Rules file to apply. This should be a full path.
-
-`arg2` Name of the module to apply the rules to.
-
-## result
-
-This command does not set any result variables.

commands/tracing/RunToParty.md

@@ -4,8 +4,12 @@ Run the program until the program reaches somewhere belonging to the party numbe
 
 ## arguments
 
-`arg1` The party number. This value cannot be an expression.
+`arg1` The party number. This value cannot be an expression. Note: `0` is user module, `1` is system module.
 
 ## results
 
 This command does not set any result variables.
+
+## see also
+
+[RunToUserCode](RunToUserCode.md)

commands/tracing/RunToUserCode.md

@@ -2,6 +2,8 @@
 
 Run until user code is reached. It is equivallent to `RunToParty 0`.
 
+This command sets temporary memory breakpoints on all user code pages, rather than single stepping. It fails when another RunToUserCode command is already executing, because the temporary memory breakpoints are already set.
+
 ## arguments
 
 This command has no arguments.

commands/tracing/StartRunTrace.md

@@ -1,6 +1,6 @@
-# StartRunTrace/opentrace
+# StartTraceRecording/StartRunTrace/opentrace
 
-Start recording a run trace with a specified file. The file will also be opened in the trace view. Note you need to use [TraceIntoConditional](./TraceIntoConditional.md) or other command to actually trace the program.
+Start recording a trace to the specified file. The file will also be opened in the trace view. Note you need to use [TraceIntoConditional](./TraceIntoConditional.md) or other command to actually trace the program and record instructions.
 
 ## arguments
 

commands/tracing/StopRunTrace.md

@@ -1,6 +1,6 @@
-# StopRunTrace/tc
+# StopTraceRecording/StopRunTrace/tc
 
-Stops recording a run trace and closes file.
+Stops trace recording and closes the file.
 
 ## arguments
 

commands/tracing/TraceIntoBeyondTraceRecord.md

@@ -1,6 +1,9 @@
-# TraceIntoBeyondTraceRecord/tibt
+# TraceIntoBeyondTraceCoverage/TraceIntoBeyondTraceRecord/tibt
 
-Perform [StepInto](StepInto.md) until the program reaches somewhere outside the trace record.
+Perform [StepInto](StepInto.md) until the program reaches somewhere outside the trace coverage. This is similar to `ticnd tr.hitcount(cip)==0&&arg1, arg2` except that it achieves higher performance by avoiding the expression function invocation.
+
+Usage example: If you want to find out the forking point of the program when different inputs are provided, first enable or re-enable trace coverage to clean trace coverage data.
+Then you trace while input A is provided. Finally you provide input B and execute `TraceIntoBeyondTraceRecord` command. The program will be paused where the instruction is never executed before.
 
 ## arguments
 

commands/tracing/TraceIntoIntoTraceRecord.md

@@ -1,6 +1,6 @@
-# TraceIntoIntoTraceRecord/tiit
+# TraceIntoIntoTraceCoverage/TraceIntoIntoTraceRecord/tiit
 
-Perform StepInto until the program reaches somewhere inside the trace record.
+Perform StepInto until the program reaches somewhere inside the trace coverage.
 
 ## arguments
 

commands/tracing/TraceOverBeyondTraceRecord.md

@@ -1,6 +1,6 @@
-# TraceOverBeyondTraceRecord/tobt
+# TraceOverBeyondTraceCoverage,TraceOverBeyondTraceRecord/tobt
 
-Perform StepOver until the program reaches somewhere outside the trace record.
+Perform StepOver until the program reaches somewhere outside the trace coverage.
 
 ## arguments
 

commands/tracing/TraceOverIntoTraceRecord.md

@@ -1,6 +1,6 @@
-# TraceOverIntoTraceRecord/toit
+# TraceOverIntoTraceCoverage/TraceOverIntoTraceRecord/toit
 
-Perform StepOver until the program reaches somewhere inside the trace record.
+Perform StepOver until the program reaches somewhere inside the trace coverage.
 
 ## arguments
 

commands/types/VisitType.md

@@ -1,14 +1,16 @@
-# VisitType
+# VisitType/DisplayType/dt
 
-Visit a type and print its members.
+Display a type and print its members in the struct view.
 
 ## arguments
 
-`arg1` The type to visit.
+`arg1` The type to display.
 
 `[arg2]` Address to print from. If not specified (or zero) the type will be printed without values.
 
-`[arg3]` Maximum pointer resolution depth (default is 0). This can be used to also display structures (and values) pointed to by members of the type you are visiting.
+`[arg3]` Maximum pointer resolution depth. This can be used to also display structures (and values) pointed to by members of the type you are visiting. If not specified or negative, it will default to 2 (configurable with `[Engine].DefaultTypePtrDepth`).
+
+`[arg4]` Name of the variable. If not specified it will default to an empty string.
 
 ## result
 

commands/user-database/argumentlist.md

@@ -8,4 +8,18 @@ This command has no arguments.
 
 ## result
 
-$resultwill be set to the number of user-defined arguments.
+`$result` will be set to the number of user-defined arguments.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/user-database/bookmarklist.md

@@ -8,4 +8,18 @@ This command has no arguments.
 
 ## result
 
-$resultwill be set to the number of user-defined bookmarks.
+`$result` will be set to the number of user-defined bookmarks.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/user-database/commentlist.md

@@ -8,4 +8,18 @@ This command has no arguments.
 
 ## result
 
-$resultwill be set to the number of user-defined comments.
+`$result` will be set to the number of user-defined comments.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/user-database/functionlist.md

@@ -8,4 +8,18 @@ This command has no arguments.
 
 ## result
 
-$resultwill be set to the number of user-defined functions.
+`$result` will be set to the number of user-defined functions.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/user-database/labellist.md

@@ -8,4 +8,18 @@ This command has no arguments.
 
 ## result
 
-$resultwill be set to the number of user-defined labels.
+`$result` will be set to the number of user-defined labels.
+
+## remarks
+
+The contents of the reference view can be iterated in a script with the `ref.addr` [expression function](../../introduction/Expression-functions.md):
+
+```
+i = 0
+loop:
+  addr = ref.addr(i)
+  log "reference {d:i} = {p:addr}"
+  i++
+  cmp i, ref.count()
+  jne loop
+```

commands/user-database/labelset.md

@@ -6,7 +6,7 @@ Set a label.
 
 `arg1` Address to set the label at (preferably inside a module).
 
-`arg2` Label text. You can use [String Formatting](../../introduction/Formatting.rst) here.
+`arg2` Label text. You can use [String Formatting](../../introduction/Formatting.md) here.
 
 ## result
 

commands/variables/var.md

@@ -2,6 +2,8 @@
 
 Declare a new variable.
 
+**Note**: You should not use this command under normal circumstances. If you want to create a variable you can do so with `myvar = 42`.
+
 ## arguments
 
 `arg1` Variable name (will be prefixed with '$' if not done).

commands/watch-control/SetWatchdog.md

@@ -8,7 +8,7 @@ Set the watchdog mode of a watch item.
 
 `[arg2]` The watchdog mode. Possible values:
 
-* disabled : Watchdog is disableed.
+* disabled : Watchdog is disabled.
 * changed : Watchdog is triggered when the value is changed.
 * unchanged : Watchdog is triggered when the value is not changed.
 * istrue : Watchdog is triggered when the value is not 0.
@@ -18,4 +18,4 @@ When this argument is not specified, the mode will be set to "changed" if the cu
 
 ## results
 
-This command does not set any result variables.
+This command does not set any result variables.

conf.py

@@ -89,7 +89,7 @@ language = None
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
 # This patterns also effect to html_static_path and html_extra_path
-exclude_patterns = ['_build*', 'Thumbs.db', '.DS_Store', 'README.md', '.git']
+exclude_patterns = ['_build*', 'Thumbs.db', '.DS_Store', 'README.md', '.git', 'python-2.7.18.amd64.portable']
 
 # The reST default role (used for this markup: `text`) to use for all
 # documents.

developers/functions/debug/DbgCmdExec.md

@@ -1,25 +1,25 @@
 # DbgCmdExec
 
-Function description.
+Execute the command on the command processing thread.
 
 ```c++
-Function definition.
+bool DbgCmdExec(const char* cmd);
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`cmd` The command string in UTF-8 encoding
 
 ## Return Value
 
-Return value description.
+`true` if the command is sent to the command processing thread for asynchronous execution, `false` otherwise.
 
 ## Example
 
 ```c++
-Example code.
+DbgCmdExec("run");
 ```
 
 ## Related functions
 
-- List of related functions
+- [DbgCmdExecDirect](./DbgCmdExecDirect.md)

developers/functions/debug/DbgCmdExecDirect.md

@@ -1,25 +1,25 @@
 # DbgCmdExecDirect
 
-Function description.
+Execute the command on the calling thread.
 
 ```c++
-Function definition.
+bool DbgCmdExecDirect(const char* cmd)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`cmd` The command string in UTF-8 encoding
 
 ## Return Value
 
-Return value description.
+`true` if the command is executed successfully, `false` otherwise.
 
 ## Example
 
 ```c++
-Example code.
+DbgCmdExecDirect("run");
 ```
 
 ## Related functions
 
-- List of related functions
+- [DbgCmdExec](./DbgCmdExec.md)

developers/functions/debug/DbgExit.md

@@ -1,18 +1,18 @@
 # DbgExit
 
-Function description.
+Used by x64dbg GUI to send exit signal to debugger and close the debugger.
 
 ```c++
-Function definition.
+void DbgExit()
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+No parameters
 
 ## Return Value
 
-Return value description.
+No return value.
 
 ## Example
 

developers/functions/debug/DbgMemFindBaseAddr.md

@@ -1,18 +1,23 @@
 # DbgMemFindBaseAddr
 
-Function description.
+Returns the baseaddress and size of a specific module
 
 ```c++
-Function definition.
+duint DbgMemFindBaseAddr(
+  duint addr,
+  duint* size
+  );
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`addr` Virtual address which is in a specific module. <br>
+`size` Pointer, which will, on success, hold the module size.
 
 ## Return Value
 
-Return value description.
+On success, returns the virtual address of a specific module. <br>
+On failure, it will return 0.
 
 ## Example
 
@@ -22,4 +27,4 @@ Example code.
 
 ## Related functions
 
-- List of related functions
+- [DbgMemGetPageSize](./DbgMemGetPageSize.md)

developers/functions/debug/DbgMemGetPageSize.md

@@ -1,25 +1,30 @@
-# DbgMemGetPageSize
-
-Function description.
-
-```c++
-Function definition.
-```
-
-## Parameters
-
-`param1` Parameter description.
-
-## Return Value
-
-Return value description.
-
-## Example
-
-```c++
-Example code.
-```
-
-## Related functions
-
-- List of related functions
+# DbgMemGetPageSize
+
+Function description.
+
+```c++
+Function definition.
+```
+
+## Parameters
+
+`param1` Parameter description.
+
+## Return Value
+
+Return value description.
+
+## Example
+
+Get page base and size of selected instruction.
+```c++
+    SELECTIONDATA sel; // Define Address the slected line in the Disassembly window ( begin , End )
+    GuiSelectionGet(GUI_DISASSEMBLY, &sel); // Get the value of sel(begin addr , End addr )
+    duint pagesize = DbgMemGetPageSize(sel.start);  // get the page size of the section from the selected memory addr
+    //Or use the following statement to get page base and size in one call.
+    duint sctionbase = DbgMemFindBaseAddr(sel.start, &pagesize); // get the base of this section ( begin addr of the section )
+```
+
+## Related functions
+
+- List of related functions

developers/functions/debug/DbgMemRead.md

@@ -3,23 +3,35 @@
 Function description.
 
 ```c++
-Function definition.
+bool DbgMemRead(
+  duint va,
+  void* dest,
+  duint size
+  );
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`va` Virtual address to source<br>
+`dest` Pointer to pre allocated buffer of size `size`<br>
+`size` Number of bytes that should be read
 
 ## Return Value
 
-Return value description.
+Returns true on success.
 
 ## Example
 
 ```c++
-Example code.
+// read user selected data from disassembly window
+SELECTIONDATA sel;
+GuiSelectionGet(GUI_DISASSEMBLY, &sel);
+uint16_t size = sel.end - sel.start + 1;
+uint8_t* dest = new uint8_t[size];
+bool success = DbgMemRead(sel.start, dest, size);
+// on success, the selected data is stored in dest
 ```
 
 ## Related functions
 
-- List of related functions
+- List of related functions

developers/functions/debug/DbgSetAutoCommentAt.md

@@ -1,25 +1,31 @@
 # DbgSetAutoCommentAt
 
-Function description.
+Set an auto comment at the given address.
 
 ```c++
-Function definition.
+bool DbgSetAutoCommentAt(duint addr, const char* text)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`addr` The address to comment.
+
+`text` The auto comment in UTF-8 encoding.
 
 ## Return Value
 
-Return value description.
+`true` if the function is successful, `false` otherwise.
 
 ## Example
 
 ```c++
-Example code.
+DbgSetAutoCommentAt(DbgValFromString("dis.sel()"), "This is the currently selected instruction");
 ```
 
 ## Related functions
 
-- List of related functions
+- [DbgSetCommentAt](./DbgSetCommentAt.md)
+- [DbgSetAutoLabelAt](./DbgSetAutoLabelAt.md)
+- [DbgSetAutoBookmarkAt](./DbgSetAutoBookmarkAt.md)
+- [DbgSetLabelAt](./DbgSetLabelAt.md)
+- [DbgSetBookmarkAt](./DbgSetBookmarkAt.md)

developers/functions/debug/DbgSetCommentAt.md

@@ -1,25 +1,31 @@
 # DbgSetCommentAt
 
-Function description.
+Set a comment at the given address.
 
 ```c++
-Function definition.
+bool DbgSetCommentAt(duint addr, const char* text)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`addr` The address to comment.
+
+`text` The comment in UTF-8 encoding.
 
 ## Return Value
 
-Return value description.
+`true` if the function is successful, `false` otherwise.
 
 ## Example
 
 ```c++
-Example code.
+DbgSetCommentAt(DbgValFromString("dis.sel()"), "This is the currently selected instruction");
 ```
 
 ## Related functions
 
-- List of related functions
+- [DbgSetAutoCommentAt](./DbgSetAutoCommentAt.md)
+- [DbgSetAutoLabelAt](./DbgSetAutoLabelAt.md)
+- [DbgSetAutoBookmarkAt](./DbgSetAutoBookmarkAt.md)
+- [DbgSetLabelAt](./DbgSetLabelAt.md)
+- [DbgSetBookmarkAt](./DbgSetBookmarkAt.md)

developers/functions/debug/DbgValFromString.md

@@ -1,25 +1,25 @@
 # DbgValFromString
 
-Function description.
+Evaluate the expression.
 
 ```c++
-Function definition.
+duint DbgValFromString(const char* string);
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`string` The [expression](../../../introduction/Expressions.md) to evaluate in UTF-8 encoding.
 
 ## Return Value
 
-Return value description.
+The value of the expression.
 
 ## Example
 
 ```c++
-Example code.
+eip = DbgValFromString("cip");
 ```
 
 ## Related functions
 
-- List of related functions
+- [DbgValToString](./DbgValToString.md)

developers/functions/debug/DbgValToString.md

@@ -1,25 +1,27 @@
 # DbgValToString
 
-Function description.
+Set the variable to the value.
 
 ```c++
-Function definition.
+bool DbgValToString(const char* string, duint value);
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`string` The name of the thing to set in UTF-8 encoding.
+
+`value` The value to set.
 
 ## Return Value
 
-Return value description.
+`true` if the value was set successfully, `false` otherwise.
 
 ## Example
 
 ```c++
-Example code.
+DbgValToString("eax", 1);
 ```
 
 ## Related functions
 
-- List of related functions
+- [DbgValFromString](./DbgValFromString.md)

developers/functions/gui/GuiAddLogMessage.md

@@ -1,6 +1,6 @@
 # GuiAddLogMessage
 
-Function description.
+Adds a message to the log. The message will be shown in the log window and on the status bar at the bottom of x64dbg.
 
 ```c++
 void GuiAddLogMessage(
@@ -32,4 +32,5 @@ Invoke GuiAddLogMessage, Addr szMsg
 
 ## Related functions
 
-- [GuiLogClear](./GuiLogClear.md)
+- [GuiLogClear](./GuiLogClear.md)
+- [GuiAddStatusBarMessage](./GuiAddStatusBarMessage.md)

developers/functions/gui/GuiAddStatusBarMessage.md

@@ -1,25 +1,25 @@
 # GuiAddStatusBarMessage
 
-Function description.
+Shows text in the statusbar, which can be used to inform the user.
 
 ```c++
-Function definition.
+void GuiAddStatusBarMessage(const char* msg);
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`msg` String containing the message to add to the status bar.
 
 ## Return Value
 
-Return value description.
+This function does not return a value.
 
 ## Example
 
 ```c++
-Example code.
+GuiAddStatusBarMessage("This text will be displayed in the statusbar.");
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiAddLogMessage](./GuiAddLogMessage.md)

developers/functions/gui/GuiDisplayWarning.md

@@ -1,9 +1,9 @@
 # GuiDisplayWarning
 
-Function description.
+Shows a warning dialog with title text and main message text.
 
 ```c++
-Function definition.
+void GuiDisplayWarning(const char* title, const char* text)
 ```
 
 ## Parameters
@@ -12,14 +12,15 @@ Function definition.
 
 ## Return Value
 
-Return value description.
+This function does not return a value.
 
 ## Example
 
 ```c++
-Example code.
+GuiDisplayWarning("Warning!", "Operation cannot be reversed.");
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiAddLogMessage](./GuiAddLogMessage.md)
+- [GuiAddStatusBarMessage](./GuiAddStatusBarMessage.md)

developers/functions/gui/GuiGetDebuggeeNotes.md

@@ -1,25 +1,33 @@
-# GuiGetDebuggeeNotes
-
-Function description.
-
-```c++
-Function definition.
-```
-
-## Parameters
-
-`param1` Parameter description.
-
-## Return Value
-
-Return value description.
-
-## Example
-
-```c++
-Example code.
-```
-
-## Related functions
-
-- List of related functions
+# GuiGetDebuggeeNotes
+
+Returns into a variable a pointer to a string containing notes and information that a user has made relating to the target being debugged (the debuggee). The function GuiGetGlobalNotes can be used to get the global notes stored by a user.
+
+```c++
+void GuiGetDebuggeeNotes(char** text)
+```
+
+## Parameters
+
+`text` A variable that will contain a pointer to a buffer on return. The pointer returned points to a string that will contain the notes for the debuggee.
+
+## Return Value
+
+This function does not return a value. The string containing the notes is returned via the pointer supplied via the `text` parameter.
+
+## Example
+
+```c++
+char* text = nullptr;
+GuiGetDebuggeeNotes(&text);
+if(text)
+{
+    // do something with text
+    BridgeFree(text);
+}
+```
+
+## Related functions
+
+- [GuiSetDebuggeeNotes](./GuiSetDebuggeeNotes.md)
+- [GuiGetGlobalNotes](./GuiGetGlobalNotes.md)
+- [GuiSetGlobalNotes](./GuiSetGlobalNotes.md)

developers/functions/gui/GuiGetGlobalNotes.md

@@ -1,25 +1,33 @@
-# GuiGetGlobalNotes
-
-Function description.
-
-```c++
-Function definition.
-```
-
-## Parameters
-
-`param1` Parameter description.
-
-## Return Value
-
-Return value description.
-
-## Example
-
-```c++
-Example code.
-```
-
-## Related functions
-
-- List of related functions
+# GuiGetGlobalNotes
+
+Returns into a variable a pointer to a string containing global notes and information that a user has made. The function GuiGetDebuggeeNotes can be used to get the local notes stored by a user for the target being debugged (the debuggee).
+
+```c++
+void GuiGetGlobalNotes(char** text)
+```
+
+## Parameters
+
+`text` A variable that will contain a pointer to a buffer on return. The pointer returned points to a string that will contain the global notes.
+
+## Return Value
+
+This function does not return a value. The string containing the notes is returned via the pointer supplied via the `text` parameter.
+
+## Example
+
+```c++
+char* text = nullptr;
+GuiGetGlobalNotes(&text);
+if(text)
+{
+    // do something with text
+    BridgeFree(text);
+}
+```
+
+## Related functions
+
+- [GuiSetGlobalNotes](./GuiSetGlobalNotes.md)
+- [GuiGetDebuggeeNotes](./GuiGetDebuggeeNotes.md)
+- [GuiSetDebuggeeNotes](./GuiSetDebuggeeNotes.md)

developers/functions/gui/GuiGetWindowHandle.md

@@ -1,25 +1,24 @@
 # GuiGetWindowHandle
 
-Function description.
+Obtains the main window handle for x64dg.
 
 ```c++
-Function definition.
+HWND GuiGetWindowHandle();
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+This function has no parameters.
 
 ## Return Value
 
-Return value description.
+Returns the main window handle for x6dbg as a HWND variable
 
 ## Example
 
 ```c++
-Example code.
+hWnd = GuiGetWindowHandle();
 ```
 
 ## Related functions
 
-- List of related functions

developers/functions/gui/GuiIsUpdateDisabled.md

@@ -1,25 +1,42 @@
 # GuiIsUpdateDisabled
 
-Function description.
+Returns the status of the internal update flag, which can be disabled via GuiUpdateDisable function or enabled vis the GuiUpdateEnable function.
 
 ```c++
-Function definition.
+bool GuiIsUpdateDisabled()
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+This function has no parameters.
 
 ## Return Value
 
-Return value description.
+Returns a boolean value indicating if the internal update flag is set to disabled. If it is set to disabled the value is TRUE otherwise updates are enabled and the value is FALSE.
 
 ## Example
 
 ```c++
-Example code.
+bool bUpdate = GuiIsUpdateDisabled();
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiUpdateAllViews](./GuiUpdateAllViews.md)
+- [GuiUpdateArgumentWidget](./GuiUpdateArgumentWidget.md)
+- [GuiUpdateBreakpointsView](./GuiUpdateBreakpointsView.md)
+- [GuiUpdateCallStack](./GuiUpdateCallStack.md)
+- [GuiUpdateDisable](./GuiUpdateDisable.md)
+- [GuiUpdateDisassemblyView](./GuiUpdateDisassemblyView.md)
+- [GuiUpdateDumpView](./GuiUpdateDumpView.md)
+- [GuiUpdateEnable](./GuiUpdateEnable.md)
+- [GuiUpdateGraphView](./GuiUpdateGraphView.md)
+- [GuiUpdateMemoryView](./GuiUpdateMemoryView.md)
+- [GuiUpdatePatches](./GuiUpdatePatches.md)
+- [GuiUpdateRegisterView](./GuiUpdateRegisterView.md)
+- [GuiUpdateSEHChain](./GuiUpdateSEHChain.md)
+- [GuiUpdateSideBar](./GuiUpdateSideBar.md)
+- [GuiUpdateThreadView](./GuiUpdateThreadView.md)
+- [GuiUpdateTimeWastedCounter](./GuiUpdateTimeWastedCounter.md)
+- [GuiUpdateWatchView](./GuiUpdateWatchView.md)
+- [GuiUpdateWindowTitle](./GuiUpdateWindowTitle.md)

developers/functions/gui/GuiLogClear.md

@@ -1,25 +1,25 @@
 # GuiLogClear
 
-Function description.
+Clears the log window of all text.
 
 ```c++
-Function definition.
+void GuiLogClear();
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+This function has no parameters.
 
 ## Return Value
 
-Return value description.
+This function does not return a value.
 
 ## Example
 
 ```c++
-Example code.
+GuiLogClear();
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiAddLogMessage](./GuiAddLogMessage)

developers/functions/gui/GuiMenuAdd.md

@@ -1,25 +1,40 @@
 # GuiMenuAdd
 
-Function description.
+This function adds a new child menu to a menu.
 
 ```c++
-Function definition.
+int GuiMenuAdd(int hMenu, const char* title)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`hMenu` Menu handle from a previously-added menu or from the main menu.
+
+`title` A const char repesenting the text title of the menu item to be added.
 
 ## Return Value
 
-Return value description.
+Returns the menu handle (unique), or -1 on failure.
 
 ## Example
 
 ```c++
-Example code.
+hNewMenu = GuiMenuAdd(hMenu, &szMenuTitle);
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiMenuAddEntry](./GuiMenuAddEntry.md)
+- [GuiMenuAddSeparator](./GuiMenuAddSeparator.md)
+- [GuiMenuClear](./GuiMenuClear.md)
+- [GuiMenuSetEntryIcon](./GuiMenuSetEntryIcon.md)
+- [GuiMenuSetIcon](./GuiMenuSetIcon.md)
+
+Note: Plugin developers should make use of the plugin functions provided:
+
+- [\_plugin\_menuadd](../../plugins/API/menuadd.rst)
+- [\_plugin\_menuaddentry](../../plugins/API/menuaddentry.rst)
+- [\_plugin\_menuaddseparator](../../plugins/API/menuaddseparator.rst)
+- [\_plugin\_menuclear](../../plugins/API/menuclear.rst)
+- [\_plugin\_menuentryseticon](../../plugins/API/menuentryseticon.rst)
+- [\_plugin\_menuseticon](../../plugins/API/menuseticon.rst)

developers/functions/gui/GuiMenuAddEntry.md

@@ -1,25 +1,40 @@
 # GuiMenuAddEntry
 
-Function description.
+This function adds a menu entry to a menu.
 
 ```c++
-Function definition.
+int GuiMenuAddEntry(int hMenu, const char* title)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`hMenu` Menu handle from a previously-added menu or from the main menu.
+
+`title` A const char repesenting the text title of the menu item to be added.
 
 ## Return Value
 
-Return value description.
+Returns the menu handle (unique), or -1 on failure.
 
 ## Example
 
 ```c++
-Example code.
+hNewMenuEntry = GuiMenuAddEntry(hMenu, &szMenuEntryText);
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiMenuAdd](./GuiMenuAdd.md)
+- [GuiMenuAddSeparator](./GuiMenuAddSeparator.md)
+- [GuiMenuClear](./GuiMenuClear.md)
+- [GuiMenuSetEntryIcon](./GuiMenuSetEntryIcon.md)
+- [GuiMenuSetIcon](./GuiMenuSetIcon.md)
+
+Note: Plugin developers should make use of the plugin functions provided:
+
+- [\_plugin\_menuadd](../../plugins/API/menuadd.rst)
+- [\_plugin\_menuaddentry](../../plugins/API/menuaddentry.rst)
+- [\_plugin\_menuaddseparator](../../plugins/API/menuaddseparator.rst)
+- [\_plugin\_menuclear](../../plugins/API/menuclear.rst)
+- [\_plugin\_menuentryseticon](../../plugins/API/menuentryseticon.rst)
+- [\_plugin\_menuseticon](../../plugins/API/menuseticon.rst)

developers/functions/gui/GuiMenuAddSeparator.md

@@ -1,25 +1,44 @@
 # GuiMenuAddSeparator
 
-Function description.
+Adds a menu separator to a menu.
 
 ```c++
-Function definition.
+void GuiMenuAddSeparator(int hMenu)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`hMenu` Menu handle from a previously-added menu or from the main menu.
 
 ## Return Value
 
-Return value description.
+This function does not return a value.
 
 ## Example
 
 ```c++
-Example code.
+hNewMenu = GuiMenuAdd(hMenu, &szMenuTitle);
+GuiMenuAddEntry(hNewMenu, &szMenuEntry1Text);
+GuiMenuAddEntry(hNewMenu, &szMenuEntry2Text);
+GuiMenuAddSeparator(hNewMenu);
+GuiMenuAddEntry(hNewMenu, &szMenuEntry3Text);
+GuiMenuAddEntry(hNewMenu, &szMenuEntry4Text);
+
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiMenuAdd](./GuiMenuAdd.md)
+- [GuiMenuAddEntry](./GuiMenuAddEntry.md)
+- [GuiMenuClear](./GuiMenuClear.md)
+- [GuiMenuSetEntryIcon](./GuiMenuSetEntryIcon.md)
+- [GuiMenuSetIcon](./GuiMenuSetIcon.md)
+
+Note: Plugin developers should make use of the plugin functions provided:
+
+- [\_plugin\_menuadd](../../plugins/API/menuadd.rst)
+- [\_plugin\_menuaddentry](../../plugins/API/menuaddentry.rst)
+- [\_plugin\_menuaddseparator](../../plugins/API/menuaddseparator.rst)
+- [\_plugin\_menuclear](../../plugins/API/menuclear.rst)
+- [\_plugin\_menuentryseticon](../../plugins/API/menuentryseticon.rst)
+- [\_plugin\_menuseticon](../../plugins/API/menuseticon.rst)

developers/functions/gui/GuiMenuClear.md

@@ -1,25 +1,39 @@
 # GuiMenuClear
 
-Function description.
+This function removes all entries and child menus from a menu. It will not remove the menu itself.
 
 ```c++
-Function definition.
+void GuiMenuClear(int hMenu)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`hMenu` Menu handle from a previously-added menu or from the main menu.
 
 ## Return Value
 
-Return value description.
+This function does not return a value.
 
 ## Example
 
 ```c++
-Example code.
+hNewMenu = GuiMenuAdd(hMenu, &szMenuTitle);
+GuiMenuClear(hMenuNew);
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiMenuAdd](./GuiMenuAdd.md)
+- [GuiMenuAddEntry](./GuiMenuAddEntry.md)
+- [GuiMenuAddSeparator](./GuiMenuAddSeparator.md)
+- [GuiMenuSetEntryIcon](./GuiMenuSetEntryIcon.md)
+- [GuiMenuSetIcon](./GuiMenuSetIcon.md)
+
+Note: Plugin developers should make use of the plugin functions provided:
+
+- [\_plugin\_menuadd](../../plugins/API/menuadd.rst)
+- [\_plugin\_menuaddentry](../../plugins/API/menuaddentry.rst)
+- [\_plugin\_menuaddseparator](../../plugins/API/menuaddseparator.rst)
+- [\_plugin\_menuclear](../../plugins/API/menuclear.rst)
+- [\_plugin\_menuentryseticon](../../plugins/API/menuentryseticon.rst)
+- [\_plugin\_menuseticon](../../plugins/API/menuseticon.rst)

developers/functions/gui/GuiMenuSetEntryIcon.md

@@ -1,25 +1,44 @@
 # GuiMenuSetEntryIcon
 
-Function description.
+Sets an icon for a specified menu entry.
 
 ```c++
-Function definition.
+void GuiMenuSetEntryIcon(int hEntry, const ICONDATA* icon)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`hEntry` Parameter description.
+
+`icon` 
 
 ## Return Value
 
-Return value description.
+This function does not return a value.
 
 ## Example
 
 ```c++
-Example code.
+ICONDATA rocket;
+rocket.data = icon_rocket;
+rocket.size = sizeof(icon_rocket);
+hNewMenuEntry = GuiMenuAddEntry(hMenu, &szMenuEntryText);
+GuiMenuSetEntryIcon(hNewMenuEntry,&rocket);
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiMenuAdd](./GuiMenuAdd.md)
+- [GuiMenuAddEntry](./GuiMenuAddEntry.md)
+- [GuiMenuAddSeparator](./GuiMenuAddSeparator.md)
+- [GuiMenuClear](./GuiMenuClear.md)
+- [GuiMenuSetIcon](./GuiMenuSetIcon.md)
+
+Note: Plugin developers should make use of the plugin functions provided:
+
+- [\_plugin\_menuadd](../../plugins/API/menuadd.rst)
+- [\_plugin\_menuaddentry](../../plugins/API/menuaddentry.rst)
+- [\_plugin\_menuaddseparator](../../plugins/API/menuaddseparator.rst)
+- [\_plugin\_menuclear](../../plugins/API/menuclear.rst)
+- [\_plugin\_menuentryseticon](../../plugins/API/menuentryseticon.rst)
+- [\_plugin\_menuseticon](../../plugins/API/menuseticon.rst)

developers/functions/gui/GuiMenuSetIcon.md

@@ -1,25 +1,49 @@
 # GuiMenuSetIcon
 
-Function description.
+Sets an icon for a specified menu.
 
 ```c++
-Function definition.
+void GuiMenuSetIcon(int hMenu, const ICONDATA* icon)
 ```
 
 ## Parameters
 
-`param1` Parameter description.
+`hMenu` Menu handle from a previously-added menu or from the main menu.
+
+`icon` 
 
 ## Return Value
 
-Return value description.
+This function does not return a value.
 
 ## Example
 
 ```c++
-Example code.
+ICONDATA rocket;
+rocket.data = icon_rocket;
+rocket.size = sizeof(icon_rocket);
+hNewMenuEntry = GuiMenuAddEntry(hMenu, &szMenuEntryText);
+GuiMenuSetIcon(hMenuDisasm,&rocket);
+
 ```
 
 ## Related functions
 
-- List of related functions
+- [GuiMenuAdd](./GuiMenuAdd.md)
+- [GuiMenuAddEntry](./GuiMenuAddEntry.md)
+- [GuiMenuAddSeparator](./GuiMenuAddSeparator.md)
+- [GuiMenuClear](./GuiMenuClear.md)
+- [GuiMenuSetEntryIcon](./GuiMenuSetEntryIcon.md)
+
+Note: Plugin developers should make use of the plugin functions provided:
+
+- [\_plugin\_menuadd](../../plugins/API/menuadd.rst)
+- [\_plugin\_menuaddentry](../../plugins/API/menuaddentry.rst)
+- [\_plugin\_menuaddseparator](../../plugins/API/menuaddseparator.rst)
+- [\_plugin\_menuclear](../../plugins/API/menuclear.rst)
+- [\_plugin\_menuentryseticon](../../plugins/API/menuentryseticon.rst)
+- [\_plugin\_menuseticon](../../plugins/API/menuseticon.rst)
+
+
+
+