Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
0
votes
0answers
23 views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
0
votes
1answer
36 views
How to call WinApi from a breakpoint in IDA Pro?
When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):
//C++ code
SCROLLINFO s;
s....
0
votes
1answer
85 views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1
vote
0answers
22 views
WinDbg does not shows all first chance exceptions
I have an application, which sometimes fails. I run procdump and see some first chance exceptions like this:
[14:29:38] Exception: E06D7363.?AVCServicesMDException@@
[14:29:38] Exception: E06D7363.?...
0
votes
0answers
11 views
Forwarding Debug messages to winDbg from specific processes
The command ed nt!Kd_Default_Mask 8 in winDbg will get all printouts that generate from OutputDebugStringW from remote machine to the console
But In my scenario there are significantly large number ...
1
vote
2answers
109 views
windbg - Why does the GS register resolve to offset 0x0?
I'm trying to understand how to resolve segment addressing (specifically the GS register in X64).
My toy program:
int main()
{
unsigned long long x;
__debugbreak();
x = __readgsqword(...
0
votes
0answers
24 views
windbg - What does the “Commit” column of the !vad command output mean?
[cross-posted (but closed the original) from https://stackoverflow.com/q/55438678/254959]
As above, when I do a !vad in windbg, what do the values in under the Commit column mean?
kd> !vad
VAD ...
1
vote
1answer
38 views
windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?
[cross-posted (but closed the original) from https://stackoverflow.com/q/55438806/254959]
I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the ...
5
votes
1answer
79 views
Detecting protected processes and critical processes from windows driver
I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine.
I wish to avoid tampering with any process that is critical ...
3
votes
1answer
81 views
How to use windbg to view assembly code of kernel function?
I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
1
vote
1answer
156 views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
2
votes
1answer
84 views
Why IDA can't find the function named by windbg
This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like
SERVER+0x78123
When I return back to IDA to see the code ...
1
vote
1answer
42 views
Windbg Break Points
I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space
1
vote
1answer
67 views
Windbg's “dt” equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
4
votes
2answers
57 views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
195 views
How to breakpoint atached process with ida when move on
In IDA pro, there is an option to attach to a process using the WinDbg backend.
When I want is to see the process' control flow when the IDA attaches to it.
The only way (that I know) to see the ...
2
votes
0answers
64 views
Ignore some locations in Windbg Conditional breakpoints
I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax :
ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
2
votes
2answers
424 views
What is the difference between Windbg and local debugger in IDA
When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) ...
3
votes
1answer
277 views
Question about the limit and base address in x86-64 segmentation model?
I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it.
So I was reviewing the ...
2
votes
2answers
382 views
Can I set more than 4 memory access breakpoints in WinDbg?
I can set a DWORD memory read/write access breakpoint in WinDbg with the following command:
ba r 4 0x0307F42C
But is there a way to set more than 4 of those?
4
votes
0answers
736 views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
1
vote
0answers
81 views
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.
So, for example, I placed a breakpoint for a process - let's ...
1
vote
3answers
301 views
WinDbg: Setting a breakpoint on every EXPORTED function of a module
Kinda new to WinDbg. I got an executable who loads a module later in the execution path, so at start I'm doing sxe ld:moduleName to break when the process loads the module.
Then I tried to just put a ...
1
vote
1answer
315 views
Windbg: How to directly view GS:[0x60]
Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)?
To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
1
vote
1answer
296 views
Break on driver loading with windbg
I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with ...
1
vote
1answer
575 views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2
votes
1answer
318 views
How to find the name of the method in Managed Code using Windbg and SOS?
I've got a crash dump, the application definitely crash in JIT optimized assembler code. I know the start address of the method. How do I find its name using using Windbg and SOS extension?
Currently ...
2
votes
1answer
97 views
Is there a command in Windbg which prints MINIDUMP_MISC_INFO_N from the Windows mini dumps?
There's time zone information in windows dumps stored in MINIDUMP_MISC_INFO_N, yet I couldn't find the command which prints this information in windbg. So, I have to extract this information from the ...
1
vote
1answer
178 views
How to set bp in a dll which loads later in pykd?
I am using pykd to debug an application which loads a dll only when some condition is met. How do I set a breakpoint in the dll which has not loaded yet in pykd such that my handler gets the callback? ...
0
votes
1answer
1k views
[windbg]kd - sxe ld <dll> from a process context won't fire
I'm trying to stop at a specific module load from a kernel debugger inside a specific process context.
What i do is to first set sxe ld [process-name] let's say calc.exe.
Now, when I run calc it ...
3
votes
0answers
87 views
Adobe Reader JIT Pages
I use Adobe Reader XI for a little research project.
I know that Adobe use SpiderMonkey as its JS engine.
When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
1
vote
0answers
102 views
windbg stopped after I set up a breakpoint, keeping busing
I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly.
struct s {
int a;
int b;
int c;
};
struct s get_some_values(int ...
0
votes
1answer
150 views
Is it possible to use an xref on memory address in IDA Pro?
Say, if I have the following disassembly:
How do I find out where else is that byte at [eax+0xFCA] is referenced? I can't seem to use the IDA's xref command on it, but doing xref on fs:18h gives me ...
0
votes
1answer
169 views
TOKEN structure in Kernel
I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code.
...
3
votes
1answer
816 views
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
2
votes
2answers
3k views
How can I receive DbgPrint messages in windbg on windows 10
I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for.
I am ...
3
votes
1answer
467 views
Resolve Addresses To Function Names
I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
3
votes
3answers
1k views
Faster Kernel debugging for Windows
I am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the ...
0
votes
2answers
415 views
Understanding the output of Windbg's `dds esp`
I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
5
votes
1answer
1k views
Debugging a deadlock when the mutex owner thread is dead?
Intro
I'm facing a peculiar deadlock scenario I never saw before.
I'm trying to debug this deadlock from 3 days and couldn't find how to fix it in a proper way. Hopefully someone would help me out.
...
4
votes
2answers
245 views
Kernel debug - internet explorer in kernelmode?
My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;).
So I get the process list with !process, one active process is Internet Explorer:
...
1
vote
1answer
363 views
Debugging EXE File in Windbg and How to set Breakpoints in Assembly
I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this.
gdb -q ./...
3
votes
2answers
933 views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
3
votes
1answer
186 views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
1
vote
1answer
417 views
windows kernel debugging on Mac host (using VirtualBox)
I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22).
1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10)
2- Target ...
1
vote
0answers
101 views
Using the AND operator to find a heap allocation size, Fermin's formula
I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation:
Lets say you have ...
3
votes
3answers
418 views
How to debug ServiceMain function of a service?
I have a malware which is checking for keyboard type and locale information.
After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
2
votes
1answer
2k views
Get address of where process mapped in Windbg
I'm looking for the start address of where myfile.exe mapped into memory using Windbg.
For this I connected to a VMWare for kernel debugging through serial port, after that I run myfile.exe in guest ...
0
votes
1answer
124 views
Using breakpoints from OllyDbg in Windbg
I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks.
In OllyDbg, the following ...
0
votes
1answer
1k views
Problem with symbols using WinDbg
I'm using Windows 7 Service Pack 1 x64, downloaded the symbols and installed them to C:\Windows\Symbols.
I insert C:\Windows\Symbols to File > Symbol File Path ... and _NT_SYMBOL_PATH.
0:000> ....
