WinDbg: Setting a breakpoint on every EXPORTED function of a module

Question

Kinda new to WinDbg. I got an executable who loads a module later in the execution path, so at start I'm doing sxe ld:moduleName to break when the process loads the module.

Then I tried to just put a breakpoint on every method but it takes for ages because there are around 30k methods and just about 300 exported methods.

I'm trying to put a breakpoint only on the exported ones but no luck so far.

I was also trying to use pykd but the module is so poorly documented that I didnt manage to do that either.

Answer 1

I just set 465 bps in no time

0:000> bl
0:000> .foreach ( place { !showexports ollydbg } ) { bp place }
0:000> bl "*z*"
     0 e Disable Clear  00406938     0001 (0001)  0:**** ollydbg!Absolutizepath
    118 e Disable Clear  004a9274     0001 (0001)  0:**** ollydbg!Finalizetaggedfile
    206 e Disable Clear  004a8e1c     0001 (0001)  0:**** ollydbg!Getoriginaldatasize
    237 e Disable Clear  004a9510     0001 (0001)  0:**** ollydbg!Gettaggedrecordsize
    268 e Disable Clear  00403918     0001 (0001)  0:**** ollydbg!Iszero
    319 e Disable Clear  004068cc     0001 (0001)  0:**** ollydbg!Relativizepath
    356 e Disable Clear  00487d74     0001 (0001)  0:**** ollydbg!Squeezename
    375 e Disable Clear  00487dfc     0001 (0001)  0:**** ollydbg!Uncapitalize
    449 e Disable Clear  0053000c     0001 (0001)  0:**** ollydbg!sizeatt
    450 e Disable Clear  0052ff88     0001 (0001)  0:**** ollydbg!sizekey
    451 e Disable Clear  0052ff04     0001 (0001)  0:**** ollydbg!sizename
    465 e Disable Clear  005d552c     0001 (0001)  0:**** ollydbg!zwcontinue

just be aware that exports may be data exports too and you may corrupt your session by mass break-pointing like this

To avoid setting breakpoints on data you can run a shell script like this and copy paste the output (it is a hack but it would reduce setting bp's on symbols whose size is < 16 (for example a GUID )

.shell -ci "x /v /Z /f ollydbg!*" awk "{ if ( strtonum(\"0x\"$4) > 16 ) print \"bp \"$3 \" 5000\"   }"

This command would print a series of bp addr 5000 (5000 is pass count so you wont be bothered for the first 5000 hits to this address)

copy the series and paste it back to set bps

for me this set ~ 440 bps issued a g to continue execution
and after a few minutes hit ctrl+break and issued a bl

copy pasted and grepped the hits

grep -v "5000 (5000)" bl.txt
     3 e Disable Clear  004de7c4     4ef9 (5000)  0:**** ollydbg!T
    11 e Disable Clear  00409e74     4fff (5000)  0:**** ollydbg!Setstatus
    34 e Disable Clear  0041e444     4fff (5000)  0:**** ollydbg!Setautoupdate
    50 e Disable Clear  00419208     4fff (5000)  0:**** ollydbg!Addtolist
    70 e Disable Clear  00473ca4     4ffe (5000)  0:**** ollydbg!Setactivetab
    84 e Disable Clear  00418afc     4fff (5000)  0:**** ollydbg!Issortedinit
    90 e Disable Clear  00417980     4fc0 (5000)  0:**** ollydbg!Addsorteddata
    175 e Disable Clear  0041214c     4ffc (5000)  0:**** ollydbg!Sunkenframe
    178 e Disable Clear  0041742c     4ffe (5000)  0:**** ollydbg!Createsorteddata
    206 e Disable Clear  004109d4     4fd3 (5000)  0:**** ollydbg!StrcopyW
    215 e Disable Clear  004071f8     4ffe (5000)  0:**** ollydbg!Readfile
    233 e Disable Clear  00403c70     4ffc (5000)  0:**** ollydbg!Memalloc
    235 e Disable Clear  00409b98     4fff (5000)  0:**** ollydbg!Message
    253 e Disable Clear  00404070     4ffe (5000)  0:**** ollydbg!Virtalloc
    259 e Disable Clear  00406938     4ff6 (5000)  0:**** ollydbg!Absolutizepath
    262 e Disable Clear  00417350     4fe2 (5000)  0:**** ollydbg!Destroysorteddata
    268 e Disable Clear  00403440     4fff (5000)  0:**** ollydbg!Unicodetoutf
    269 e Disable Clear  00412078     4fff (5000)  0:**** ollydbg!Getmonitorrect
    315 e Disable Clear  0040261c     4f96 (5000)  0:**** ollydbg!Stringfromini
    331 e Disable Clear  004026a0     4ff3 (5000)  0:**** ollydbg!Filefromini
    332 e Disable Clear  00402718     4d95 (5000)  0:**** ollydbg!Getfromini
    392 e Disable Clear  00403d7c     4fff (5000)  0:**** ollydbg!Memfree
    411 e Disable Clear  0043ac10     4ffe (5000)  0:**** ollydbg!Destroysimpledata
    421 e Disable Clear  00402978     4fff (5000)  0:**** ollydbg!Getfromsettings
    425 e Disable Clear  00471cd8     4ffe (5000)  0:**** ollydbg!Initset

Answer 2

My variant with pykd + pykdwin
https://githomelab.ru/pykd/pykdwin

from pykdwin.pe import get_exports

bps = list()
for name, addr in get_exports('kernel32'):
  bps.append( setBp(addr) )

Try to run this script with --global option:

!py --global set_allbp.py

Answer 3

If the module does not have symbols loaded, set the symbol path to an empty folder .sympath c:\empty and issue bm moduleName!*. With no symbols available, windbg will set breakpoint only on the exported functions. Then set the symbol path to the previous value.