Skip to main content

Questions tagged [windbg]

A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.

Filter by
Sorted by
Tagged with
2 votes
1 answer
61 views

WinDbg command to retrieve TTBR registers for Aarch64?

Aarch64 architecture has the following registers, that contain physical base addresses for the virtual-to-physical translation tables for different exception levels: TTBR0_EL1, TTBR1_EL1, TTBR0_EL2, ...
0 votes
1 answer
68 views

Windbg conditional breakpoint issue

Can't get a conditional breakpoint to fire in Windbg. I tried: bp xxxxxxxx "j (@ebp+0C==115) ''; 'gc' " bp xxxxxxxx "j (ebp+0C==115) ''; 'gc' " bp xxxxxxxx "j (poi(ebp+0C)==...
0 votes
0 answers
39 views

Dynamic analysis of cmd dependent software

There is a PE file, which can't run by itself, and can only be called from cmd.exe, it doesn't create independent processes, and can be launched independently only with .bat scripts, which without &...
0 votes
0 answers
31 views

Processor breakpoint not triggers in write operation - WinDbg

Following a specific address, i can't see the content on that address because i am getting "??" on memory section, which isn't an issue because it's supposed to be an invalid address in the ...
2 votes
1 answer
97 views

What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?

What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG? I found this command useful to debug with ASLR (w/o disabling it).
0 votes
0 answers
48 views

Reversing SYSTEM Process

I'm doing some vulnerability research against a Windows server application that serves some update files that clients can download. Using TcpView/netstat, I can see that there is an open port ...
0 votes
0 answers
55 views

Windbg set conditional breakpoint

Can't get this to work. I want to set a conditional breakpoint in Windbg with the condition to be when eax is 11h (17). I tried: bu xxxxxxxx ".if(eax != 17){gc}" bu xxxxxxxx ".if(@eax !=...
0 votes
0 answers
52 views

(IDA/Windbg) break after run

I want to break/debug/stop execution on the first line just after I run/go. So, in other words, I debug a executable with a dialog box and a command button. I wait for the program to load the dialog ...
0 votes
0 answers
46 views

how to set flag in windbg

Let's say we have 2 functions funcA and funcB, funcA is the upstream of funcB. I want to view certain values and call stack in funcB only if funcA satisfies certain conditions. I can't achieve this ...
1 vote
1 answer
82 views

Should shell32.dll be in executable search path for winword.exe with WinDBG?

I'm threat hunting and I'm curious if there should be a shell32.dll in the executable search path in windbg for winword.exe.
2 votes
1 answer
269 views

Is there an easier way to break on a rootkit driver load, other than disassembling IopLoadDriver?

The only method i know to break on a DriverEntry of a rootkit driver when its loaded is to disassmble nt!IopLoadDriver and find an indirect call in it and break on it. Setting a break point on ...
1 vote
1 answer
47 views

windbg conditional breakpoint equal always get 0

I want to set a conditional breakpoint on function argument at the entry of a function. Here is the value I want which is c0 a8 89 01. I want to break the function when that register holds this ...
1 vote
2 answers
108 views

how to access the initialized data in windbg through offset from IDA

In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the ...
0 votes
1 answer
59 views

unable to figure out how a windbg extension work

I'm trying to figure out how the below windbg extension works !ndiskd.nbl addr -hexcap(or -data) kd> !ndiskd.nbl ffffce8c96bde070 -hexcap # NET_BUFFER_LIST ffffce8c96bde070 # NET_BUFFER ...
0 votes
3 answers
326 views

how to stop windbg when register value changes

I'm using windbg to find the memory of a specific structure in windows. The way is to look at certain values stored in stack and registers in entry function. I notice that register ax holds that value ...
0 votes
0 answers
141 views

windbg fail to load symbol with UNC store

I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu kd> .sympath Symbol search path is: srv* Expanded Symbol search path is: cache*;...
0 votes
0 answers
29 views

missing caller function in call stack

I'm trying to intercept and locate tcp packets in memory through debugging of windows 10. Suppose I set a break point at TcpReceive, the call stack looks like this kd> kc # Call Site tcpip!...
0 votes
0 answers
54 views

Firmware not attached to WinDBG while debugging Windows boot process

I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process. Short ...
0 votes
1 answer
229 views

windbg command to search all functions that take in certain arguments

I want to use the x command to search for functions that take _NET_BUFFER_LIST as an argument(maybe they will take more than one argument). Its symbol is ndis!_NET_BUFFER_LIST. The command I use 0:000&...
1 vote
0 answers
94 views

Windbg command .call usage and syntax

I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. ...
6 votes
1 answer
1k views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
5 votes
2 answers
10k views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
2 votes
0 answers
107 views

Windbg multiple memory windows

I have tried to open multiple memory windows but I can't. I tried to find resolution for this on windbg help and on old version it is possible, however on new version I can't find how to open multiple ...
2 votes
1 answer
328 views

'... Debugger undefined or null reference' error when WinDBG TTD Scripting with Javascript

I tried Javascript scripting on WinDbg (TTD specifically); but even in simple example I get error Unable to get property 'Debugger' of undefined or null reference. Line was simply var ctl = host....
3 votes
1 answer
200 views

Ida+Windbg alternative of Olly's "Back to user code" feature

I'm learning lena151's materials and in 4 lesson she uses Olly's Back-to-user feature to find where the MassegeBox is creating. It works fine under x32 windows server 2003. But what about nowadays?! ...
2 votes
0 answers
56 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
1 vote
1 answer
126 views

windbg: the name of a function displayed by the command "x" is unusable with the command "u"

I start with Windbg. In a "kernel debugger" session, I place myself in the context of a service (I chose audiosrv for my learning). I would like to disassemble a function that I easily ...
1 vote
1 answer
248 views

How works k command in windbg

I am studying a Windows x86 binary in windbg. When i debug a function, in can see the call stack with « k » command. My question is: how works windbg internaly to get this call stack ? I was thinking ...
5 votes
0 answers
630 views

Comparison of Windows Debuggers

I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
2 votes
0 answers
670 views

Windows kernel debugging using IDA & WinDbg

I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
3 votes
1 answer
282 views

Win32 x86 prologue disassembly

I have the following disassembly of a function prologue with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack ...
2 votes
1 answer
82 views

How to investigate in a program of type /SUBSYSTEM:NATIVE that crashes with the RtlFreeAnsiString API?

I compiled a very simple example of an application of type /SUBSYSTEM:NATIVE writing "hello world". It is launched thanks to the "BootExecute" key. The program works without errors....
2 votes
1 answer
203 views

write a windbg sript for a table of linkedlist

I'm writing a script for an array of LIST_ENTRY. Each LIST_ENTRY is a header of linkedlist. From reference, I can use !list to perform the same operation for each element in the linkedlist. 0:000> !...
3 votes
0 answers
243 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
1 vote
1 answer
1k views

How to disassemble an entire function in Windbg?

I am trying to disassemble the function ExAcquireFastMutex using WinDbg but it gives me only 8 rows: 3: kd> u nt!ExAcquireFastMutex nt!ExAcquireFastMutex: fffff805`456e3820 4053 push ...
0 votes
1 answer
111 views

Find out which struct RaGetUnitStorageDeviceProperty use by reverse engineering

I am trying to find out which struct storport!RaGetUnitStorageDeviceProperty uses by myself. I know I can use google and find out the correct answer is _RAID_UNIT_EXTENSION. However i want to do it ...
1 vote
0 answers
397 views

How to find the fifth function argument on stack in windbg?

I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
0 votes
1 answer
511 views

which command in windbg to use to display the struct in function argument

The struct looks like this. typedef struct _RTL_DYNAMIC_HASH_TABLE_ENUMERATOR { struct _RTL_DYNAMIC_HASH_TABLE_ENTRY HashEntry; struct _LIST_ENTRY* CurEntry; struct _LIST_ENTRY* ChainHead; ULONG ...
1 vote
0 answers
645 views

c000001d (Illegal instruction)

My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction: ******************************************************************************* * ...
0 votes
1 answer
77 views

Symbol name tcpip!IppInitializePathSet found in windbg but unable to find function IppInitializePathSet in tcpip.sys

I'm debugging windows server 2019 in windbg and I want to find function IppInitializePathSet. However, I can't find the function in IDA but I can find the symbol named tcpip!IppInitializePathSet. How ...
1 vote
0 answers
83 views

How does windbg correctly resolve symbol addresses for optimised code?

When you debug optimised code, I know that address arithmetic doesn't work correctly: 0:004> u dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x69 u dwmcore!CPartitionVerticalBlankScheduler::...
1 vote
1 answer
469 views

recovering a process dump from a memory dump with WinDbg

I have a crash dump (memory.dmp), and I want to extract process (calc.exe) from it. I tried: !process 0 0 calc.exe PROCESS ffffb501f8c23580 <-- this is the address SessionId: 0 Cid: 035c ...
1 vote
0 answers
97 views

windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)

In the first example I only set a breakpoint on user32!CreateWindowExW In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain In the 3rd example I ...
2 votes
0 answers
761 views

How to search for String/Byte pattern in memory within a WinDBG Time Travel Debugging trace?

I'm currently practicing with WinDBG by playing around with a notepad trace. During recording the trace I have opened notepad, typed in "AAAABBBB" waited a few secs and then stopped the ...
2 votes
2 answers
870 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1 vote
1 answer
286 views

Does opening a crash dump run a file in memory?

I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
1 vote
1 answer
463 views

Can't resolve a function from a process module (user32.dll): "Couldn't resolve error at '<module>!<function>'"

I have a WinForm project in C++. I attached a kernel debugger to my VMware machine. I set a breakpoint on the kernel and switched context to my application: 0: kd> !process 0 0 WindowsProject1.exe ...
0 votes
0 answers
153 views

Heavens gate code

Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you. I use Intel Pin push cs push 0xa02829 jmp far ...
1 vote
2 answers
838 views

Why windbg skips syscall on kernel mode?

I have a VM running windows with notepad open, I did list the modules with lm: start end module name 00007ffc`60fb0000 00007ffc`60fe2000 vertdll (deferred) ...
1 vote
0 answers
330 views

Call stack in Windbg address with no modules associated

I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out. Coming back to this problem, I figured I'd go back and use Windbg to ...

1
2 3 4 5