Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windbg]

A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.

1
vote
1answer
56 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
2
votes
1answer
67 views

Why IDA can't find the function named by windbg

This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like SERVER+0x78123 When I return back to IDA to see the code ...
1
vote
1answer
31 views

Windbg Break Points

I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space
1
vote
1answer
61 views

Windbg's “dt” equivalent in IDA?

I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)? Assuming of course I have the pdb file. Thank you :)
4
votes
2answers
55 views

Are some special chars(<>) in function names not supported by windbg/cdb?

I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
81 views

How to breakpoint atached process with ida when move on

In IDA pro, there is an option to attach to a process using the WinDbg backend. When I want is to see the process' control flow when the IDA attaches to it. The only way (that I know) to see the ...
2
votes
0answers
50 views

Ignore some locations in Windbg Conditional breakpoints

I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax : ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
2
votes
2answers
294 views

What is the difference between Windbg and local debugger in IDA

When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger. What is the difference? By the way, is there any difference if I use Windbg tool (windows software) ...
3
votes
1answer
191 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
2
votes
2answers
287 views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
4
votes
0answers
700 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
1
vote
0answers
59 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...
1
vote
2answers
222 views

WinDbg: Setting a breakpoint on every EXPORTED function of a module

Kinda new to WinDbg. I got an executable who loads a module later in the execution path, so at start I'm doing sxe ld:moduleName to break when the process loads the module. Then I tried to just put a ...
1
vote
0answers
214 views

Windbg: How to directly view GS:[0x60]

Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)? To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
1
vote
1answer
262 views

Break on driver loading with windbg

I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with ...
1
vote
0answers
467 views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2
votes
1answer
233 views

How to find the name of the method in Managed Code using Windbg and SOS?

I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension? Currently ...
2
votes
1answer
79 views

Is there a command in Windbg which prints MINIDUMP_MISC_INFO_N from the Windows mini dumps?

There's time zone information in windows dumps stored in MINIDUMP_MISC_INFO_N, yet I couldn't find the command which prints this information in windbg. So, I have to extract this information from the ...
1
vote
1answer
139 views

How to set bp in a dll which loads later in pykd?

I am using pykd to debug an application which loads a dll only when some condition is met. How do I set a breakpoint in the dll which has not loaded yet in pykd such that my handler gets the callback? ...
0
votes
1answer
924 views

[windbg]kd - sxe ld <dll> from a process context won't fire

I'm trying to stop at a specific module load from a kernel debugger inside a specific process context. What i do is to first set sxe ld [process-name] let's say calc.exe. Now, when I run calc it ...
3
votes
0answers
76 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
1
vote
0answers
80 views

windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly. struct s { int a; int b; int c; }; struct s get_some_values(int ...
0
votes
1answer
117 views

Is it possible to use an xref on memory address in IDA Pro?

Say, if I have the following disassembly: How do I find out where else is that byte at [eax+0xFCA] is referenced? I can't seem to use the IDA's xref command on it, but doing xref on fs:18h gives me ...
0
votes
1answer
135 views

TOKEN structure in Kernel

I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code. ...
4
votes
1answer
691 views

How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?

I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
3
votes
2answers
2k views

How can I receive DbgPrint messages in windbg on windows 10

I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for. I am ...
3
votes
1answer
390 views

Resolve Addresses To Function Names

I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
4
votes
3answers
895 views

Faster Kernel debugging for Windows

I am Kernel debugging in Windbg and it's slow , very slow stepping through. My current setup is using VMWARE and Windbg through a com port on the Virtual Machine. Is there a faster way to debug the ...
0
votes
2answers
338 views

Understanding the output of Windbg's `dds esp`

I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
5
votes
1answer
850 views

Debugging a deadlock when the mutex owner thread is dead?

Intro I'm facing a peculiar deadlock scenario I never saw before. I'm trying to debug this deadlock from 3 days and couldn't find how to fix it in a proper way. Hopefully someone would help me out. ...
4
votes
2answers
205 views

Kernel debug - internet explorer in kernelmode?

My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;). So I get the process list with !process, one active process is Internet Explorer: ...
1
vote
1answer
316 views

Debugging EXE File in Windbg and How to set Breakpoints in Assembly

I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this. gdb -q ./...
3
votes
2answers
728 views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
3
votes
1answer
164 views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
1
vote
1answer
364 views

windows kernel debugging on Mac host (using VirtualBox)

I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22). 1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10) 2- Target ...
1
vote
0answers
77 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
3
votes
3answers
346 views

How to debug ServiceMain function of a service?

I have a malware which is checking for keyboard type and locale information. After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
-1
votes
0answers
446 views

IDA Pro + WinDBG incredibly slow single stepping

Using IDA Pro v6.8.150423 along with latest WinDBG (from SDK for 15063). When launching IDA with a 64-bit file, and WinDBG as a debugger, things like breaking process, single stepping (step into / ...
3
votes
1answer
1k views

Get address of where process mapped in Windbg

I'm looking for the start address of where myfile.exe mapped into memory using Windbg. For this I connected to a VMWare for kernel debugging through serial port, after that I run myfile.exe in guest ...
0
votes
1answer
120 views

Using breakpoints from OllyDbg in Windbg

I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks. In OllyDbg, the following ...
0
votes
1answer
830 views

Problem with symbols using WinDbg

I'm using Windows 7 Service Pack 1 x64, downloaded the symbols and installed them to C:\Windows\Symbols. I insert C:\Windows\Symbols to File > Symbol File Path ... and _NT_SYMBOL_PATH. 0:000> ....
6
votes
1answer
770 views

How to know which module am I currently in? (EIP/RIP pointer)

I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode: What ...
1
vote
0answers
547 views

Symbols could not be loaded for win32k drivers

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
2
votes
1answer
2k views

How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?

I'm using IDA Pro and WinDbg as a debugger. So I loaded an executable process into it. And now I need to know the entry point (or base address) of that loaded executable, the same as I would get from ...
1
vote
0answers
77 views

How can I send a “Break” to the WinDbg backend when using IDA as a frontend?

When I use WinDbg and there's some long operation, I can press CtrlBreak to cancel the current operation (for instance, but not limited to, cancel PDB loading). Or use this: However, whenever I use ...
2
votes
3answers
5k views

IDA PRO + Windows 10 + WinDbg

I didn't know That we've got a Reverse Engineering community around here :D I am very glad on that.... anyway... I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time. I am ...
2
votes
1answer
434 views

WinDbg - RVA of current instruction

Do someone know a windbg command to display the RVA of a certain instruction within it's module? Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, ...
1
vote
2answers
706 views

How to set breakpoint on C++ symbols?

How to set breakpoint on this C++ symbol? bp qmgr!TokenHandle::operator-: Could not resolve error at 'qmgr!TokenHandle::operator-:' in windbg?
4
votes
2answers
328 views

How to break on a clipboard operation in cmd.exe with IDA / WinDbg?

My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
6
votes
1answer
2k views

Can Windbg trace function calls within a module?

I want to log any functions within a specific module that are called during an execution. I tried !for_each_function and wt command. However, since the target module doesn't have any symbols, !...