WinDbg Debugging without symbols

Question

So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the executable it breaks on ntdll32!LdrpDoDebuggerBreak+0x2c. Nothing in the call stack gives any useful information. If I issue g again, the executable runs to termination.

Any advice on how to get to main() without manually stepping through all the startup code?

Answer 1

Make sure if you have the correct breakpoint address

issue lm an exe without symbol will be shown as

0:000> lm
start    end        module name
00400000 0040f000   image00400000   (no symbols)    

compare the NtHeader->AddresssOfEntrypoint with @$exentry

0:000> r $t0 = image00400000
0:000> ?? ((ntdll!_IMAGE_NT_HEADERS *) @@( poi( @$t0 + 0x3c ) + @$t0 ))->OptionalHeader.AddressOfEntryPoint + @$t0
unsigned int64 0x401280
0:000> ? @$exentry
Evaluate expression: 4199040 = 00401280

if they are same setting a breakpoint with bp @$exentry or bp 401280 should both break properly at that address only if there is no Debugger Detection in you Binary

if your binary has Debugger Detection then you may need to examine the DllInitRoutines Tls Callbacks and other cute tricks

output sample exe without any Anti Debugging Tricks breaking properly at @$exentry below

0:000> .lastevent
Last event: bc.a70: Break instruction exception - code 80000003 (first chance)
  debugger time: Sun Sep 21 01:10:42.015 2014 (UTC + 5:30)
0:000> lm M *im*
start    end        module name
00400000 0040f000   image00400000   (no symbols)
0:000> $ binary without symbols whose module name is normally shown as imageXXXXXX

0:000> r $t0 = image00400000 ; $ set Pseudo Register to start

0:000> r $t1 = poi(@$t0+3c)  ; $ find pointer to Ntheader

0:000> r? $t2 = (ntdll!_IMAGE_NT_HEADERS *) (@$t0 + @$t1)  ; set c++ pseudo Register

0:000> ?? @$t2->OptionalHeader.AddressOfEntryPoint + @$t0  ; Find AddressofEntryPoint
unsigned int64 0x401280

0:000> ? @$exentry
Evaluate expression: 4199040 = 00401280

0:000> bp @$exentry

0:000> bl
 0 e 00401280     0001 (0001)  0:**** image00400000+0x1280

0:000> g
Breakpoint 0 hit    
image00400000+0x1280:
00401280 55              push    ebp
0:000>

this is not main() it will be the start of c runtime init code usually termed as XYZ_MainCrtStartUp() you may need to inspect the binary to find the Main() if you know the compiler you can usually spot the initialisation code it would be common code