When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) to debug .exe file, or if I debug with IDA and choose Windbg debugger?
The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd.
The Windbg plugin is very similar to IDA Pro's Win32 debugger plugin, nonetheless by using The Windbg plugin, one can benefit from the command line facilities and the extensions that ship with the debugging tools.
For example, one can type “!chain” to see the registered Windbg extensions:
“!gle” is another command to get the last error value of a given Win32 API call.
Another benefit of using the Windbg debugger plugin is the use of symbolic information.
Normally, if the debugging symbols path is not set, then the module window will only show the
exported names. For example kernel32.dll displays 1359 names:
Let us configure a symbol source by adding this environment variable before running IDA:
set _NT_SYMBOL_PATH=srv*C:\Temp\pdb*http://msdl.microsoft.com/download/symbols
It is also possible to set the symbol path directly while debugging:
and then typing “.reload /f” to reload the symbols.
Now we try again and notice that more symbol names are retrieved from kernel32.dll:
Now we have 5818 symbols instead!
It is also possible to use the “x” command to quickly search for symbols:
(Looking for any symbol in any module that contains the word “continue”)
[source]
For the second part of your question, use IDA Pro debugger (Windbg debugger plugin) if you need IDA Pro features otherwise use Windbg.
From the standpoint of how IDA and Windbg connect to the debugged process, there's no difference. From the standpoint how IDA and Windbg handle debugging events while the program is running there's a difference. Up to some time IDA was very bad at it, and choosing windbg way was a better option. So using IDA local debugger is ok, unless you need to execute some windbg commands from IDA while debugging. But in case you have problems while debugging, you have a backup option to try.
