Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
168
questions
1
vote
0
answers
39
views
How to search for String/Byte pattern in memory within a WinDBG Time Travel Debugging trace?
I'm currently practicing with WinDBG by playing around with a notepad trace. During recording the trace I have opened notepad, typed in "AAAABBBB" waited a few secs and then stopped the ...
0
votes
1
answer
74
views
recovering a process dump from a memory dump with WinDbg
I have a crush dump (memory.dmp), and I want to extract process (calc.exe) from it.
I tried:
!process 0 0 calc.exe
PROCESS ffffb501f8c23580 <-- this is the address
SessionId: 0 Cid: 035c ...
- 143
1
vote
1
answer
50
views
Does opening a crash dump run a file in memory?
I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
- 11
0
votes
0
answers
88
views
Heavens gate code
Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you.
I use Intel Pin
push cs
push 0xa02829
jmp far ...
- 21
0
votes
2
answers
163
views
Why windbg skips syscall on kernel mode?
I have a VM running windows with notepad open, I did list the modules with lm:
start end module name
00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
- 49
1
vote
0
answers
38
views
Call stack in Windbg address with no modules associated
I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out. Coming back to this problem, I figured I'd go back and use Windbg to ...
- 125
0
votes
0
answers
112
views
Trying to debug with IDA Pro + Windbg on remote VM: It won't break or step
I'm new to remote debugging so plz bare with me.
I'm trying to break and step through code on driver loading, during windows boot. So I'm using a windows 10 host, running IDA pro with windbg. This is ...
- 51
0
votes
0
answers
63
views
IDA + Windbg does not break on sxe commands
I'm new to remote debugging, so I have no idea why it isn't breaking. My setup is a Windows 10 x64 host running IDA pro with its built-in windbg debugger. The virtual machine is a vmware running ...
- 51
0
votes
0
answers
49
views
viewing debugging symbols in windbg
I am currently learning Malware Analysis using the book "Practical Malware Analysis", and I am going along with the chapter on Kernel debugging.
When viewing the same code snippet on WinDbg ...
- 1
1
vote
0
answers
60
views
'... Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript
I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error
Unable to get property 'Debugger' of undefined or null reference.
Line was simply var ctl = host....
- 11
1
vote
1
answer
126
views
What is the structure of the Stack in a minidump?
I'm currently using Python3.9 in Linux to obtain the necessary information from a minidump file. I used WinDBG on my windows system to check whether the information I got was right.
While [1], [2] ...
- 125
0
votes
0
answers
95
views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
- 101
0
votes
0
answers
149
views
Windbg memory access error when trying to edit a string value of a button
So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
- 11
1
vote
1
answer
57
views
Why is process object is shown as desktop object in nt!_object_type
I try to extract the object type of notepad.exe in windbg but the nt!_object_type is showing it as Desktop object instead of Process object.
Any idea why is it so?
4: kd> !process 0 0 notepad.exe
...
- 135
0
votes
0
answers
138
views
Windows time travel debugging performance bottleneck
First of all I wan to be clear, that this question is not about the collection performance, but indexing performance.
What is the performance bottleneck of the indexing step?
Some context:
Action in ...
- 1
1
vote
2
answers
203
views
How to search for process by name with WinDBG
I know how to list all the processes in the system by running:
0: kd>dx -r1 Debugger.Sessions[0].Processes
OR
0: kd>.tlist
But how can I search for a process by name?
I tried to use the ...
- 461
1
vote
1
answer
122
views
Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"
I have a WinForm project in C++.
I attached a kernel debugger to my VMware machine.
I set a breakpoint on the kernel and switched context to my application:
0: kd> !process 0 0 WindowsProject1.exe
...
- 461
1
vote
0
answers
58
views
Nice way to get Windows API call arguments in WinDBG
How do I get a nice list of call arguments for well documented functions such as kernel32!CreateRemoteThread in windbg? Right now when a breakpoint hits I manually decode them considering the ...
- 193
2
votes
1
answer
170
views
Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"
I tried to debug a C++ that I created but I am getting the following error:
I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
- 461
0
votes
0
answers
109
views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
1
vote
0
answers
28
views
Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?
On host (UEFI legacy mode):
lkd> !pfn 0xf0
PFN 000000F0 at address FFFFFA8000002D00
flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF
...
- 205
1
vote
1
answer
144
views
Reverse engineer sticky notes to allow external script to open new notes
For a silly little project I wanted to do, I wanted to make it so that I could open new notes (Microsoft Sticky Notes) from an external script - preferably python. Although I'm not good at reverse ...
1
vote
0
answers
55
views
Local KD -- can't access physical address 0xFFFFFFF0 but you can with RwEverything
I've never been able to access 0xf0000000 range using !db on local debug, and I've tried !db -m 00000000`fffffff0 and !db [uc] 00000000`fffffff0. I only get Physical memory read at fffffff0 failed. It ...
- 205
0
votes
1
answer
79
views
How much of the kernel does remote kernel debugging allow you to debug?
This is a theoretical question because I've never set up remote kernel debugging before -- but I will do at some point, which should hopefully answer some of the experimental questions I have.
What ...
- 205
0
votes
2
answers
144
views
kd live local debugging !pte and db don't work (only shows context of the debugger for all contexts), but !vtop works
Says the PDPT and PDs of the process are at the same physcial frames (pfns) in both processes.
The first process is winword.exe and the second process is calc.exe
The virtual address in the first case ...
- 205
0
votes
1
answer
51
views
Defining frame manually windbg
I wonder why defining frame manually keeps failing on range error.
As far as I understand the syntax is :
.frame /c = BASE STACK RIP where if inside MyFunc there is a call OtherFunc, the RIP should ...
- 228
1
vote
1
answer
708
views
How to find encrypted strings in an executable?
I am trying to reverse engineer an executable.
I am using Process explorer to dump all strings present in the exe image, and from the process's RAM when it is running.
The two dumps return a ...
- 111
5
votes
1
answer
298
views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
- 345
1
vote
1
answer
97
views
Windbg .thread command is useless?
The ".thread" command is used to change the thread context in Windows kernel debugging.
MSDN
But I encountered the below situation:
Execute the following two commands consecutively.
The ...
- 117
2
votes
1
answer
91
views
Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?
The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on ...
- 136
2
votes
1
answer
404
views
WinDBG doesn't resolve function names when debugging kernel module
I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically).
Here is a picture ...
- 461
1
vote
1
answer
112
views
Trying to reverse engineer CmpFindNlsData of winload
I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
- 17
1
vote
0
answers
32
views
WinDbg pattern search not returning expected result
I'm searching for a string, say the old "This program cannot run".
Switching context to e.g. notepad, non invasive, with page translation
1: kd> !process 0 0 notepad.exe
PROCESS ...
- 111
2
votes
0
answers
27
views
Find the caption of VB5/6 Form Object in Memory Dump
I'm looking at a problem with app that has lost source code and the app crashes shortly after calling code that appears to be [Global Variable representing Form Object].ZOrder 0 (i.e. trying to make ...
- 1,111
1
vote
1
answer
69
views
bad memory mapping in case of MEMORY dump IDA <-> WinDbg
when I open the debug dump (IDA x64) , I don't have the memory ranges. Exactly like in this question:
ESP out of range of "Stack View" in IDA
It used to be fine, but I don't have the menu ...
- 228
2
votes
1
answer
270
views
Get return address from syscall
I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
- 103
2
votes
1
answer
349
views
Windbg: "gu" command inside of a breakpoint causes warning
I'm trying to leverage "gu" command in a conditional breakpoint or as a "CommandString" in a regular breakpoint. For example let's consider break on a malloc() function when we want to see in logs ...
- 111
1
vote
1
answer
488
views
Getting NTSTATUS 0xC0000022 when attempting to debug a process
I am attempting to debug a process with windbg (with admin privileges) and I am getting the following error:
Could not attach to process XXXX =, NTSTATUS 0xC0000022
{Access Denied} A process has ...
- 225
0
votes
1
answer
971
views
How to calculate the size of a PE from headers?
What I am trying to do is calculate the size of a PE through it's headers. I am using WinDbg's Javascripting and in this case, it will mostly be for drivers. The idea is to dump a driver from memory ...
- 91
-1
votes
1
answer
140
views
How to find each interrupt's line in the Interrupt Descriptor Table
I'm trying to find the line number of the 0f05 syscall interrupt with no success.
I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
0
votes
2
answers
281
views
Disassembling only given function
I'm looking for some disassembler that has feature similar to WinDbg uf function, it produces output that is really easy transferable to compilable NASM listing. The problem with WinDbg is that it's ...
- 15
0
votes
0
answers
215
views
Issues with Symbols when running windbg on windows xp sp3
I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
0
votes
1
answer
861
views
Remote debugging using IDA, connecting to windbg server (kernel mode)
I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
- 228
0
votes
2
answers
89
views
Predicting Memory locations of arguments within a function
I'm trying to write a script that would help display the memory contents of the arguments passed within a function. For example, in the function below, the first argument starts at the EAX register. ...
- 53
1
vote
1
answer
55
views
What does -c mean in this Windbg Command Syntax?
kd> u win32k!impPsIsThreadTerminating+0xe4-c L5
| \ \ \ \ \
/ \ \ \ \ \
/ \ \ \ \ \
...
- 113
1
vote
2
answers
2k
views
x64dbg (x32dbg) log registers every step like windbg
So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
- 11
1
vote
1
answer
356
views
Setting a conditional kernel breakpoint in WinDbg grinds the debuggee OS to a halt
My setup:
Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001
Debuggee: Win7 Pro (running in a VM using VMWare Workstation)
I'm trying to follow the SendMessage call from the user space:
Into the ...
- 1,305
3
votes
1
answer
9k
views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
- 1,305
0
votes
1
answer
255
views
How to call WinApi from a breakpoint in IDA Pro?
When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):
//C++ code
SCROLLINFO s;
s....
- 1,305
2
votes
2
answers
531
views
Analyzing Windows kernel driver
I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
- 103