0

I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:

0: kd> !process 0 0 WindowsProject1.exe
PROCESS ffffcf07bad91080
    SessionId: 1  Cid: 22c8    Peb: dd35f3e000  ParentCid: 1598
    DirBase: 1b9b83000  ObjectTable: ffffe5829cb59b00  HandleCount: 145.
    Image: WindowsProject1.exe  
0: kd> .process ffffcf07bad91080
Implicit process is now ffffcf07`bad91080
WARNING: .cache forcedecodeuser is not enabled

I also understand that I can do it like that:

0: kd> dx -s Debugger.Sessions[0].Processes[8904].SwitchTo()  

Anyway, I want to find the SetWindowTextW function and set a breakpoint on that.
I tried to find it in the process context:

0: kd> dd user32!SetWindowTextW
Couldn't resolve error at 'user32!SetWindowTextW'

Why it doesn't find it?

1
  • 1
    use process specific breakpoint like bu /p ffffcf07bad91080 user32!SetWindowTextA
    – blabb
    May 4 at 14:18
0

After I ran:

0: kd> .symfix C:\debug\symbols
*** Unable to resolve unqualified symbol in Bp expression 'user32.SetWindowTextW'.
*** Unable to resolve unqualified symbol in Bp expression 'user32.SetWindowTextW'.
0: kd> !sym noisy
noisy mode - symbol prompts on
0: kd> .reload /f  

Now I was able to use it:

0: kd> dd user32!SetWindowTextW
00007ffc`243c1cb0  245c8948 83485708 8b4830ec 108ae8fa
00007ffc`243c1cc0  8b480000 c08548d8 8b483c74 035ae8c8

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .