3

I'm trying to leverage "gu" command in a conditional breakpoint or as a "CommandString" in a regular breakpoint. For example let's consider break on a malloc() function when we want to see in logs what pointer was allocated and what was the size of an allocation:

bp msvcrt!malloc "r $t1=@rcx; gu; .printf \"malloc: %p %08x\\n\",@rax,@$t1; gc"

tldr: So, we've created a temporary register $t1, assigned it to the size of allocation (the arch is x64, thus @rcx = "size"), steeped out of the function using "gu" command, and finally printed pointer at @rax plus our temp register value. You can try it yourself with a "notepad.exe" ;)

It's kind of working, we can see the data:

Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d42c0 00000100
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4700 00000088
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d47c0 00000088
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4880 00000038
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d4f10 000000f0
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d5030 00001124
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d6190 00002430
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d85f0 00000200
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d8820 00000080
Some commands were skipped because previous commands caused target execution inside an event handler.malloc: 000001d2e78d88d0 00000080

With the only small exception which is noisy string "Some commands were skipped because previous commands caused target execution inside an event handler.". It seems it's always in a logs when we're using "gu" as a "CommandString".

Any ideas how to get rid of it or what is the intended way of solving such a problem?

Regards!

Improve this question
2
  • UPD: Aforementioned example is working in windbg but not in windbg preview. It may be that "gu" is not intended to be used in this case :(
    – eXp
    Commented Apr 13, 2020 at 10:57
  • One way of solving this is to put two breakpoints: one at the start and second in the end of the function. ``` bp msvcrt!malloc "r $t1=@rcx; gc;" r $t0=msvcrt!malloc+cc bp @$t0 ".printf \"malloc: %p %08x\\n\",@rax,@$t1; gc" ``` This works but it certainly looses it's elegance
    – eXp
    Commented Apr 13, 2020 at 11:03

1 Answer 1

Reset to default
3

take a look at this

so you cannot use a command that alters the execution status inside a wait

I am not sure what your intent is

but windbg provides several PseudoRegisters to access state and act upon

one is @$ra which is the Return Address on the stack this is wher your gu will actually endup

others are @$retreg and @$retreg64
these are actually the returns from a function (or in layman's term eax and rax after a call is executed

so basically some xyz is calling malloc like malloc(size) you have set up a break on msvcrt!malloc @ra will contain the xyz + (size of call) that is the address of Return from the call and if you had issued gu you will land here and when you have landed here rax/eax as well as @$retreg/@$retreg64 will contain the Address of Allocated memory from the malloc call

you can also set a one shot breakpoint

you can combine all this to make a concise breakpoint that will print both the size as well as returned pointer 

0:002> bl
     1 e Disable Clear  00007ff8`c8199d30     0001 (0001)  0:**** msvcrt!malloc "bp /1 @$ra \"? @$t1;?@$retreg64;gc\";r $t1=@rcx;gc"
windbg> .hh
0:002> g
Evaluate expression: 40 = 00000000`00000028
Evaluate expression: 2051178946016 = 000001dd`93cadde0
Evaluate expression: 256 = 00000000`00000100
Evaluate expression: 2051178943712 = 000001dd`93cad4e0
Evaluate expression: 40 = 00000000`00000028
Evaluate expression: 2051178944016 = 000001dd`93cad610
Evaluate expression: 24 = 00000000`00000018
Evaluate expression: 2051178947056 = 000001dd`93cae1f0
Evaluate expression: 32 = 00000000`00000020
Evaluate expression: 2051178947328 = 000001dd`93cae300
Evaluate expression: 32 = 00000000`00000020
Evaluate expression: 2051178949536 = 000001dd`93caeba0
Evaluate expression: 72 = 00000000`00000048
Evaluate expression: 2051178946272 = 000001dd`93cadee0
Evaluate expression: 32 = 00000000`00000020
Evaluate expression: 2051178947056 = 000001dd`93cae1f0
Evaluate expression: 32 = 00000000`00000020
Evaluate expression: 2051178944016 = 000001dd`93cad610
Evaluate expression: 672 = 00000000`000002a0
Evaluate expression: 2051178949824 = 000001dd`93caecc0
Evaluate expression: 104 = 00000000`00000068
Evaluate expression: 2051178946272 = 000001dd`93cadee0
Evaluate expression: 32 = 00000000`00000020
Evaluate expression: 2051178946432 = 000001dd`93cadf80

notice the escaped command string in the bp

bp msvcrt!malloc "bp /1 @$ra \"? @$t1;?@$retreg64;gc\";r $t1=@rcx;gc"

if you need to use .printf you may need another level of quote escaping

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.