1

I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:

0: kd> !process 0 0 WindowsProject1.exe
PROCESS ffffcf07bad91080
    SessionId: 1  Cid: 22c8    Peb: dd35f3e000  ParentCid: 1598
    DirBase: 1b9b83000  ObjectTable: ffffe5829cb59b00  HandleCount: 145.
    Image: WindowsProject1.exe  
0: kd> .process ffffcf07bad91080
Implicit process is now ffffcf07`bad91080
WARNING: .cache forcedecodeuser is not enabled

I also understand that I can do it like that:

0: kd> dx -s Debugger.Sessions[0].Processes[8904].SwitchTo()  

Anyway, I want to find the SetWindowTextW function and set a breakpoint on that.
I tried to find it in the process context:

0: kd> dd user32!SetWindowTextW
Couldn't resolve error at 'user32!SetWindowTextW'

Why it doesn't find it?

1
  • 1
    use process specific breakpoint like bu /p ffffcf07bad91080 user32!SetWindowTextA
    – blabb
    May 4, 2021 at 14:18

1 Answer 1

1

After I ran:

0: kd> .symfix C:\debug\symbols
*** Unable to resolve unqualified symbol in Bp expression 'user32.SetWindowTextW'.
*** Unable to resolve unqualified symbol in Bp expression 'user32.SetWindowTextW'.
0: kd> !sym noisy
noisy mode - symbol prompts on
0: kd> .reload /f  

Now I was able to use it:

0: kd> dd user32!SetWindowTextW
00007ffc`243c1cb0  245c8948 83485708 8b4830ec 108ae8fa
00007ffc`243c1cc0  8b480000 c08548d8 8b483c74 035ae8c8
1
  • Hehe, a classic among kernel mode devs.
    – 0xC0000022L
    Jan 29, 2022 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.