I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:
0: kd> !process 0 0 WindowsProject1.exe PROCESS ffffcf07bad91080 SessionId: 1 Cid: 22c8 Peb: dd35f3e000 ParentCid: 1598 DirBase: 1b9b83000 ObjectTable: ffffe5829cb59b00 HandleCount: 145. Image: WindowsProject1.exe 0: kd> .process ffffcf07bad91080 Implicit process is now ffffcf07`bad91080 WARNING: .cache forcedecodeuser is not enabled
I also understand that I can do it like that:
0: kd> dx -s Debugger.Sessions.Processes.SwitchTo()
Anyway, I want to find the
SetWindowTextW function and set a breakpoint on that.
I tried to find it in the process context:
0: kd> dd user32!SetWindowTextW Couldn't resolve error at 'user32!SetWindowTextW'
Why it doesn't find it?