I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:
0: kd> !process 0 0 WindowsProject1.exe
PROCESS ffffcf07bad91080
SessionId: 1 Cid: 22c8 Peb: dd35f3e000 ParentCid: 1598
DirBase: 1b9b83000 ObjectTable: ffffe5829cb59b00 HandleCount: 145.
Image: WindowsProject1.exe
0: kd> .process ffffcf07bad91080
Implicit process is now ffffcf07`bad91080
WARNING: .cache forcedecodeuser is not enabled
I also understand that I can do it like that:
0: kd> dx -s Debugger.Sessions[0].Processes[8904].SwitchTo()
Anyway, I want to find the SetWindowTextW
function and set a breakpoint on that.
I tried to find it in the process context:
0: kd> dd user32!SetWindowTextW
Couldn't resolve error at 'user32!SetWindowTextW'
Why it doesn't find it?