I've set breakpoints on some Windows kernel functions using WinDBG. When the breakpoints are hit, I can query information about the invoking user-mode process using the !process or !peb commands.

How are these commands implemented? How can I find the relevant memory structures and "manually" trace back to the user-mode caller when one of my BPs hit?

1 Answer 1


currentprocess KPROCESS offset is returned by


peb is returned by

IDebugSystemObjects::GetCurrentProcessPeb method

both are implemented in dbgeng

you can set process specific breakpoints so that the kernel api will break only in the correct process context

bp /p [eprocess] {kernel api}

to look at the stack use kb when the breakpoint is hit

windbg comes with sample src code that shows various forms of implementation right from the very old wdbgext extensions to the latest engextcpp extension

a basic implementation is simple and straightforward Call DebugCreate() to obtain a IDebugClient Interface Query the Other Interfaces from this Client Interface and call the methods

to find a series of articles that show how to use the dbgeng functions explore here http://www.woodmann.com/forum/entry.php?246-A-Simple-Dbgeng-Based-User-Mode-Debugger

  • Thanks! Can you point me to any implementation details of the mentioned debug methods?
    – buherator
    Oct 31, 2015 at 14:49
  • added some details and a link explore
    – blabb
    Oct 31, 2015 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.