Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
192
questions
0
votes
3
answers
71
views
how to stop windbg when register value changes
I'm using windbg to find the memory of a specific structure in windows. The way is to look at certain values stored in stack and registers in entry function. I notice that register ax holds that value ...
- 301
0
votes
1
answer
55
views
unable to figure out how a windbg extension work
I'm trying to figure out how the below windbg extension works
!ndiskd.nbl addr -hexcap(or -data)
kd> !ndiskd.nbl ffffce8c96bde070 -hexcap
# NET_BUFFER_LIST ffffce8c96bde070
# NET_BUFFER ...
- 301
0
votes
0
answers
31
views
windbg fail to load symbol with UNC store
I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu
kd> .sympath
Symbol search path is: srv*
Expanded Symbol search path is: cache*;...
- 301
1
vote
2
answers
80
views
how to access the initialized data in windbg through offset from IDA
In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the ...
- 301
0
votes
0
answers
23
views
missing caller function in call stack
I'm trying to intercept and locate tcp packets in memory through debugging of windows 10. Suppose I set a break point at TcpReceive, the call stack looks like this
kd> kc
# Call Site
tcpip!...
- 301
0
votes
0
answers
37
views
Firmware not attached to WinDBG while debugging Windows boot process
I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process.
Short ...
- 11
0
votes
1
answer
54
views
windbg command to search all functions that take in certain arguments
I want to use the x command to search for functions that take _NET_BUFFER_LIST as an argument(maybe they will take more than one argument). Its symbol is ndis!_NET_BUFFER_LIST.
The command I use
0:000&...
- 301
1
vote
0
answers
41
views
Windbg command .call usage and syntax
I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. ...
- 301
0
votes
1
answer
50
views
Should shell32.dll be in executable search path for winword.exe with WinDBG?
I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
2
votes
0
answers
64
views
Windbg multiple memory windows
I have tried to open multiple memory windows but I can't.
I tried to find resolution for this on windbg help and on old version it is possible, however on new version I can't find how to open multiple ...
- 71
3
votes
1
answer
132
views
Ida+Windbg alternative of Olly's "Back to user code" feature
I'm learning lena151's materials and in 4 lesson she uses Olly's Back-to-user feature to find where the MassegeBox is creating.
It works fine under x32 windows server 2003.
But what about nowadays?!
...
- 51
2
votes
0
answers
39
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 131
1
vote
1
answer
94
views
windbg: the name of a function displayed by the command "x" is unusable with the command "u"
I start with Windbg.
In a "kernel debugger" session, I place myself in the context of a service (I chose audiosrv for my learning).
I would like to disassemble a function that I easily ...
- 61
4
votes
0
answers
174
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 151
1
vote
1
answer
133
views
How works k command in windbg
I am studying a Windows x86 binary in windbg.
When i debug a function, in can see the call stack with « k » command.
My question is: how works windbg internaly to get this call stack ?
I was thinking ...
- 787
2
votes
0
answers
310
views
Windows kernel debugging using IDA & WinDbg
I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
- 151
3
votes
0
answers
188
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
2
votes
1
answer
73
views
How to investigate in a program of type /SUBSYSTEM:NATIVE that crashes with the RtlFreeAnsiString API?
I compiled a very simple example of an application of type /SUBSYSTEM:NATIVE writing "hello world".
It is launched thanks to the "BootExecute" key. The program works without errors....
- 61
2
votes
1
answer
152
views
write a windbg sript for a table of linkedlist
I'm writing a script for an array of LIST_ENTRY. Each LIST_ENTRY is a header of linkedlist.
From reference, I can use !list to perform the same operation for each element in the linkedlist.
0:000> !...
- 301
1
vote
1
answer
628
views
How to disassemble an entire function in Windbg?
I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows:
3: kd> u nt!ExAcquireFastMutex
nt!ExAcquireFastMutex:
fffff805`456e3820 4053 push ...
- 573
0
votes
1
answer
92
views
Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering
I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
- 33
1
vote
0
answers
270
views
How to find the fifth function argument on stack in windbg?
I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
- 301
0
votes
1
answer
294
views
which command in windbg to use to display the struct in function argument
The struct looks like this.
typedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR {
struct _RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry;
struct _LIST_ENTRY* CurEntry;
struct _LIST_ENTRY* ChainHead;
ULONG ...
- 301
1
vote
0
answers
400
views
c000001d (Illegal instruction)
My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction:
*******************************************************************************
* ...
- 111
0
votes
1
answer
69
views
Symbol name tcpip!IppInitializePathSet found in windbg but unable to find function IppInitializePathSet in tcpip.sys
I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How ...
- 301
1
vote
0
answers
59
views
How does windbg correctly resolve symbol addresses for optimised code?
When you debug optimised code, I know that address arithmetic doesn't work correctly:
0:004> u dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x69
u dwmcore!CPartitionVerticalBlankScheduler::...
- 285
1
vote
0
answers
81
views
windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)
In the first example I only set a breakpoint on user32!CreateWindowExW
In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain
In the 3rd example I ...
- 285
2
votes
0
answers
477
views
How to search for String/Byte pattern in memory within a WinDBG Time Travel Debugging trace?
I'm currently practicing with WinDBG by playing around with a notepad trace. During recording the trace I have opened notepad, typed in "AAAABBBB" waited a few secs and then stopped the ...
1
vote
1
answer
297
views
recovering a process dump from a memory dump with WinDbg
I have a crash dump (memory.dmp), and I want to extract process (calc.exe) from it.
I tried:
!process 0 0 calc.exe
PROCESS ffffb501f8c23580 <-- this is the address
SessionId: 0 Cid: 035c ...
- 153
1
vote
1
answer
198
views
Does opening a crash dump run a file in memory?
I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
- 11
0
votes
0
answers
137
views
Heavens gate code
Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you.
I use Intel Pin
push cs
push 0xa02829
jmp far ...
- 21
1
vote
2
answers
648
views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
- 69
1
vote
0
answers
222
views
Call stack in Windbg address with no modules associated
I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out. Coming back to this problem, I figured I'd go back and use Windbg to ...
- 135
2
votes
1
answer
223
views
'... Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript
I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error
Unable to get property 'Debugger' of undefined or null reference.
Line was simply var ctl = host....
- 21
2
votes
1
answer
284
views
What is the structure of the Stack in a minidump?
I'm currently using Python3.9 in Linux to obtain the necessary information from a minidump file. I used WinDBG on my windows system to check whether the information I got was right.
While [1], [2] ...
- 135
0
votes
0
answers
104
views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
- 101
1
vote
0
answers
284
views
Windbg memory access error when trying to edit a string value of a button
So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
- 21
1
vote
1
answer
67
views
Why is process object is shown as desktop object in nt!_object_type
I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object.
Any idea why is it so?
4: kd> !process 0 0 notepad.exe
...
- 205
0
votes
0
answers
164
views
Windows time travel debugging performance bottleneck
First of all I wan to be clear, that this question is not about the collection performance, but indexing performance.
What is the performance bottleneck of the indexing step?
Some context:
Action in ...
- 1
1
vote
2
answers
816
views
How to search for process by name with WinDBG
I know how to list all the processes in the system by running:
0: kd>dx -r1 Debugger.Sessions[0].Processes
OR
0: kd>.tlist
But how can I search for a process by name?
I tried to use the ...
- 573
1
vote
1
answer
362
views
Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"
I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:
0: kd> !process 0 0 WindowsProject1.exe
...
- 573
1
vote
0
answers
135
views
Nice way to get Windows API call arguments in WinDBG
How do I get a nice list of call arguments for well documented functions such as kernel32!CreateRemoteThread in windbg? Right now when a breakpoint hits I manually decode them considering the ...
- 193
2
votes
1
answer
497
views
Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"
I tried to debug a C++ that I created but I am getting the following error:
I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
- 573
1
vote
0
answers
215
views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
- 11
1
vote
0
answers
35
views
Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?
On host (UEFI legacy mode):
lkd> !pfn 0xf0
PFN 000000F0 at address FFFFFA8000002D00
flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF
...
- 285
1
vote
1
answer
293
views
Reverse engineer sticky notes to allow external script to open new notes
For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse ...
1
vote
0
answers
87
views
Local KD -- can't access physical address 0xFFFFFFF0 but you can with RwEverything
I've never been able to access 0xf0000000 range using !db on local debug, and I've tried !db -m 00000000`fffffff0 and !db [uc] 00000000`fffffff0. I only get Physical memory read at fffffff0 failed. It ...
- 285
0
votes
1
answer
126
views
How much of the kernel does remote kernel debugging allow you to debug?
This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have.
What ...
- 285
0
votes
2
answers
233
views
kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works
Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes.
The first process is winword.exe and the second process is calc.exe
The virtual address in the first case ...
- 285
0
votes
1
answer
114
views
Defining frame manually windbg
I wonder why defining frame manually keeps failing on range error.
As far as I understand the syntax is :
.frame /c = BASE STACK RIP where if inside MyFunc there is a call OtherFunc, the RIP should ...
- 228