Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
1
vote
1answer
27 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
2
votes
1answer
60 views
Why IDA can't find the function named by windbg
This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like
SERVER+0x78123
When I return back to IDA to see the code ...
0
votes
0answers
67 views
windows kernel mode exceptions not caught in windbg
I've done a few tests and it seems WinDbg does not catch some exceptions triggered inside a __try/__except clause in kernel mode.
The code I run in kernel mode is as follows
__try {
/* code ...
1
vote
1answer
28 views
Windbg Break Points
I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space
1
vote
1answer
59 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
4
votes
2answers
54 views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
62 views
How to breakpoint atached process with ida when move on
In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the ...
2
votes
0answers
45 views
Ignore some locations in Windbg Conditional breakpoints
I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax :
ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
2
votes
2answers
238 views
What is the difference between Windbg and local debugger in IDA
When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) ...
3
votes
1answer
158 views
Question about the limit and base address in x86-64 segmentation model?
I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it.
So I was reviewing the ...
2
votes
2answers
253 views
Can I set more than 4 memory access breakpoints in WinDbg?
I can set a DWORD memory read/write access breakpoint in WinDbg with the following command:
ba r 4 0x0307F42C
But is there a way to set more than 4 of those?
4
votes
0answers
668 views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
1
vote
0answers
53 views
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.
So, for example, I placed a breakpoint for a process - let's ...
1
vote
2answers
192 views
WinDbg: Setting a breakpoint on every EXPORTED function of a module
Kinda new to WinDbg. I got an executable who loads a module later in the execution path, so at start I'm doing sxe ld:moduleName to break when the process loads the module.
Then I tried to just put a ...
1
vote
0answers
182 views
Windbg: How to directly view GS:[0x60]
Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)?
To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
1
vote
1answer
241 views
Break on driver loading with windbg
I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with ...
1
vote
0answers
435 views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2
votes
1answer
193 views
How to find the name of the method in Managed Code using Windbg and SOS?
I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension?
Currently ...
2
votes
1answer
76 views
Is there a command in Windbg which prints MINIDUMP_MISC_INFO_N from the Windows mini dumps?
There's time zone information in windows dumps stored in MINIDUMP_MISC_INFO_N, yet I couldn't find the command which prints this information in windbg. So, I have to extract this information from the ...
1
vote
1answer
125 views
How to set bp in a dll which loads later in pykd?
I am using pykd to debug an application which loads a dll only when some condition is met. How do I set a breakpoint in the dll which has not loaded yet in pykd such that my handler gets the callback? ...
0
votes
1answer
766 views
[windbg]kd - sxe ld <dll> from a process context won't fire
I'm trying to stop at a specific module load from a kernel debugger inside a specific process context.
What i do is to first set sxe ld [process-name] let's say calc.exe.
Now, when I run calc it ...
3
votes
0answers
75 views
Adobe Reader JIT Pages
I use Adobe Reader XI for a little research project.
I know that Adobe use SpiderMonkey as its JS engine.
When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
1
vote
0answers
73 views
windbg stopped after I set up a breakpoint, keeping busing
I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly.
struct s {
int a;
int b;
int c;
};
struct s get_some_values(int ...
0
votes
1answer
110 views
Is it possible to use an xref on memory address in IDA Pro?
Say, if I have the following disassembly:
How do I find out where else is that byte at [eax+0xFCA] is referenced? I can't seem to use the IDA's xref command on it, but doing xref on fs:18h gives me ...
0
votes
1answer
127 views
TOKEN structure in Kernel
I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code.
...
4
votes
1answer
631 views
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
3
votes
2answers
1k views
How can I receive DbgPrint messages in windbg on windows 10
I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for.
I am ...
3
votes
1answer
359 views
Resolve Addresses To Function Names
I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
4
votes
3answers
822 views
Faster Kernel debugging for Windows
I am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the ...
0
votes
2answers
308 views
Understanding the output of Windbg's `dds esp`
I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
5
votes
1answer
791 views
Debugging a deadlock when the mutex owner thread is dead?
Intro
I'm facing a peculiar deadlock scenario I never saw before.
I'm trying to debug this deadlock from 3 days and couldn't find how to fix it in a proper way. Hopefully someone would help me out.
...
4
votes
2answers
196 views
Kernel debug - internet explorer in kernelmode?
My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;).
So I get the process list with !process, one active process is Internet Explorer:
...
1
vote
1answer
302 views
Debugging EXE File in Windbg and How to set Breakpoints in Assembly
I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this.
gdb -q ./...
3
votes
2answers
672 views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
3
votes
1answer
152 views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
1
vote
1answer
334 views
windows kernel debugging on Mac host (using VirtualBox)
I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22).
1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10)
2- Target ...
1
vote
0answers
77 views
Using the AND operator to find a heap allocation size, Fermin's formula
I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation:
Lets say you have ...
3
votes
3answers
321 views
How to debug ServiceMain function of a service?
I have a malware which is checking for keyboard type and locale information.
After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
0
votes
0answers
426 views
IDA Pro + WinDBG incredibly slow single stepping
Using IDA Pro v6.8.150423 along with latest WinDBG (from SDK for 15063). When launching IDA with a 64-bit file, and WinDBG as a debugger, things like breaking process, single stepping (step into / ...
3
votes
1answer
1k views
Get address of where process mapped in Windbg
I'm looking for the start address of where myfile.exe mapped into memory using Windbg.
For this I connected to a VMWare for kernel debugging through serial port, after that I run myfile.exe in guest ...
0
votes
1answer
118 views
Using breakpoints from OllyDbg in Windbg
I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks.
In OllyDbg, the following ...
0
votes
1answer
745 views
Problem with symbols using WinDbg
I'm using Windows 7 Service Pack 1 x64, downloaded the symbols and installed them to C:\Windows\Symbols.
I insert C:\Windows\Symbols to File > Symbol File Path ... and _NT_SYMBOL_PATH.
0:000> ....
6
votes
1answer
713 views
How to know which module am I currently in? (EIP/RIP pointer)
I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode:
What ...
1
vote
0answers
518 views
Symbols could not be loaded for win32k drivers
I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
2
votes
1answer
2k views
How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger. So I loaded an executable process into it. And now I need to know the entry point (or base address) of that loaded executable, the same as I would get from ...
1
vote
0answers
72 views
How can I send a “Break” to the WinDbg backend when using IDA as a frontend?
When I use WinDbg and there's some long operation, I can press CtrlBreak to cancel the current operation (for instance, but not limited to, cancel PDB loading). Or use this:
However, whenever I use ...
2
votes
3answers
4k views
IDA PRO + Windows 10 + WinDbg
I didn't know That we've got a Reverse Engineering community around here :D
I am very glad on that....
anyway...
I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time.
I am ...
2
votes
1answer
415 views
WinDbg - RVA of current instruction
Do someone know a windbg command to display the RVA of a certain instruction within it's module?
Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, ...
1
vote
2answers
658 views
How to set breakpoint on C++ symbols?
How to set breakpoint on this C++ symbol?
bp qmgr!TokenHandle::operator-:
Could not resolve error at 'qmgr!TokenHandle::operator-:'
in windbg?
4
votes
2answers
324 views
How to break on a clipboard operation in cmd.exe with IDA / WinDbg?
My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
