Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
136
questions
1
vote
1answer
75 views
Getting NTSTATUS 0xC0000022 when attempting to debug a process
I am attempting to debug a process with windbg (with admin privileges) and I am getting the following error:
Could not attach to process XXXX =, NTSTATUS 0xC0000022
{Access Denied} A process has ...
0
votes
0answers
48 views
Use WinDbg to bypass file open checks
I'm using an evaluation version of a program that opens custom filetypes (a combination of text/midi like a karaoke helper).
The evaluation version will only open certain files bundled with it.
When I ...
0
votes
0answers
21 views
Symbol Information on wcscpy_s in WinDbg - Why references across so many DLLs?
I am using Time Travel Debugging feature of WinDbg to log string output with position of trace to help me more easily isolate sections of codes I want to analyse, using command like below:
bp ...
0
votes
1answer
137 views
How to calculate the size of a PE from headers?
What I am trying to do is calculate the size of a PE through it's headers. I am using WinDbg's Javascripting and in this case, it will mostly be for drivers. The idea is to dump a driver from memory ...
-1
votes
1answer
64 views
How to find each interrupt's line in the Interrupt Descriptor Table
I'm trying to find the line number of the 0f05 syscall interrupt with no success.
I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
0
votes
2answers
130 views
Disassembling only given function
I'm looking for some disassembler that has feature similar to WinDbg uf function, it produces output that is really easy transferable to compilable NASM listing. The problem with WinDbg is that it's ...
0
votes
0answers
61 views
Issues with Symbols when running windbg on windows xp sp3
I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
0
votes
1answer
296 views
Remote debugging using IDA, connecting to windbg server (kernel mode)
I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
0
votes
2answers
78 views
Predicting Memory locations of arguments within a function
I'm trying to write a script that would help display the memory contents of the arguments passed within a function. For example, in the function below, the first argument starts at the EAX register. ...
1
vote
1answer
44 views
What does -c mean in this Windbg Command Syntax?
kd> u win32k!impPsIsThreadTerminating+0xe4-c L5
| \ \ \ \ \
/ \ \ \ \ \
/ \ \ \ \ \
...
0
votes
2answers
400 views
x64dbg (x32dbg) log registers every step like windbg
So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
1
vote
1answer
94 views
Setting a conditional kernel breakpoint in WinDbg grinds the debuggee OS to a halt
My setup:
Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001
Debuggee: Win7 Pro (running in a VM using VMWare Workstation)
I'm trying to follow the SendMessage call from the user space:
Into the ...
0
votes
0answers
2k views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
0
votes
1answer
97 views
How to call WinApi from a breakpoint in IDA Pro?
When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):
//C++ code
SCROLLINFO s;
s....
0
votes
1answer
207 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1
vote
0answers
41 views
WinDbg does not shows all first chance exceptions
I have an application, which sometimes fails. I run procdump and see some first chance exceptions like this:
[14:29:38] Exception: E06D7363.?AVCServicesMDException@@
[14:29:38] Exception: E06D7363.?...
0
votes
0answers
17 views
Forwarding Debug messages to winDbg from specific processes
The command ed nt!Kd_Default_Mask 8 in winDbg will get all printouts that generate from OutputDebugStringW from remote machine to the console
But In my scenario there are significantly large number ...
1
vote
2answers
473 views
windbg - Why does the GS register resolve to offset 0x0?
I'm trying to understand how to resolve segment addressing (specifically the GS register in X64).
My toy program:
int main()
{
unsigned long long x;
__debugbreak();
x = __readgsqword(...
0
votes
0answers
54 views
windbg - What does the “Commit” column of the !vad command output mean?
[cross-posted (but closed the original) from https://stackoverflow.com/q/55438678/254959]
As above, when I do a !vad in windbg, what do the values in under the Commit column mean?
kd> !vad
VAD ...
1
vote
1answer
322 views
windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?
[cross-posted (but closed the original) from https://stackoverflow.com/q/55438806/254959]
I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the ...
6
votes
1answer
292 views
Detecting protected processes and critical processes from windows driver
I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine.
I wish to avoid tampering with any process that is critical ...
3
votes
1answer
291 views
How to use windbg to view assembly code of kernel function?
I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
1
vote
1answer
444 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
2
votes
1answer
119 views
Why IDA can't find the function named by windbg
This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like
SERVER+0x78123
When I return back to IDA to see the code ...
1
vote
1answer
63 views
Windbg Break Points
I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space
1
vote
1answer
82 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
4
votes
2answers
81 views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
630 views
How to breakpoint atached process with ida when move on
In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the ...
2
votes
0answers
78 views
Ignore some locations in Windbg Conditional breakpoints
I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax :
ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
2
votes
2answers
875 views
What is the difference between Windbg and local debugger in IDA
When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) ...
3
votes
1answer
505 views
Question about the limit and base address in x86-64 segmentation model?
I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it.
So I was reviewing the ...
2
votes
2answers
654 views
Can I set more than 4 memory access breakpoints in WinDbg?
I can set a DWORD memory read/write access breakpoint in WinDbg with the following command:
ba r 4 0x0307F42C
But is there a way to set more than 4 of those?
4
votes
0answers
800 views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
1
vote
0answers
136 views
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.
So, for example, I placed a breakpoint for a process - let's ...
1
vote
3answers
607 views
WinDbg: Setting a breakpoint on every EXPORTED function of a module
Kinda new to WinDbg. I got an executable who loads a module later in the execution path, so at start I'm doing sxe ld:moduleName to break when the process loads the module.
Then I tried to just put a ...
2
votes
1answer
540 views
Windbg: How to directly view GS:[0x60]
Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)?
To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
1
vote
1answer
431 views
Break on driver loading with windbg
I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with ...
1
vote
1answer
1k views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2
votes
1answer
604 views
How to find the name of the method in Managed Code using Windbg and SOS?
I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension?
Currently ...
2
votes
1answer
121 views
Is there a command in Windbg which prints MINIDUMP_MISC_INFO_N from the Windows mini dumps?
There's time zone information in windows dumps stored in MINIDUMP_MISC_INFO_N, yet I couldn't find the command which prints this information in windbg. So, I have to extract this information from the ...
1
vote
1answer
239 views
How to set bp in a dll which loads later in pykd?
I am using pykd to debug an application which loads a dll only when some condition is met. How do I set a breakpoint in the dll which has not loaded yet in pykd such that my handler gets the callback? ...
0
votes
1answer
3k views
[windbg]kd - sxe ld <dll> from a process context won't fire
I'm trying to stop at a specific module load from a kernel debugger inside a specific process context.
What i do is to first set sxe ld [process-name] let's say calc.exe.
Now, when I run calc it ...
3
votes
0answers
110 views
Adobe Reader JIT Pages
I use Adobe Reader XI for a little research project.
I know that Adobe use SpiderMonkey as its JS engine.
When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
1
vote
0answers
137 views
windbg stopped after I set up a breakpoint, keeping busing
I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly.
struct s {
int a;
int b;
int c;
};
struct s get_some_values(int ...
0
votes
1answer
211 views
Is it possible to use an xref on memory address in IDA Pro?
Say, if I have the following disassembly:
How do I find out where else is that byte at [eax+0xFCA] is referenced? I can't seem to use the IDA's xref command on it, but doing xref on fs:18h gives me ...
0
votes
1answer
317 views
TOKEN structure in Kernel
I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code.
...
3
votes
1answer
1k views
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
2
votes
2answers
6k views
How can I receive DbgPrint messages in windbg on windows 10
I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for.
I am ...
3
votes
1answer
631 views
Resolve Addresses To Function Names
I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
4
votes
3answers
1k views
Faster Kernel debugging for Windows
I am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the ...
