Questions tagged [windbg]

A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.

Filter by
Sorted by
Tagged with
13 votes
4 answers
6k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
  • 655
11 votes
5 answers
6k views

How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?

I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is: Unable to enumerate locals, HRESULT 0x80004005 ...
5 votes
3 answers
8k views

How can I view FS:[0] with windbg?

It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger. I am now using Windbg. But, I am unable to view FS (specifically FS:[0])....
  • 165
13 votes
2 answers
3k views

Should I switch from WinDbg to OllyDbg?

I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I ...
6 votes
1 answer
3k views

at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?

Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out. I am reverse-engineering an application which at some point ...
  • 658
3 votes
1 answer
9k views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
  • 1,335
3 votes
2 answers
2k views

Slow kernel dbg with VirtualBox and WinDBG

I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
  • 51
1 vote
1 answer
115 views

Trying to reverse engineer CmpFindNlsData of winload

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
6 votes
1 answer
4k views

Can Windbg trace function calls within a module?

I want to log any functions within a specific module that are called during an execution. I tried !for_each_function and wt command. However, since the target module doesn't have any symbols, !...
  • 243
6 votes
2 answers
1k views

Removing personal data from dump file

I want to publish a crash dump on the Internet for other people to learn from the dump. Usually I take dumps with .dump /ma which is fine. However, I'm a bit concerned about personal data included in ...
3 votes
1 answer
678 views

How can WinDbg be used to troubleshoot program loading?

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
  • 1,625
3 votes
1 answer
5k views

How to change address in the hex view in IDA debugger?

I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
  • 1,335
3 votes
2 answers
6k views

Why doesn't WinDbg resolve the function names?

This is definitely a beginner question but the WinDbg docs didn't help me out much because most of it is oriented around debugging programs with PDB files available. I tried .reload but it didn't have ...
  • 31
2 votes
5 answers
11k views

IDA PRO + Windows 10 + WinDbg

I didn't know That we've got a Reverse Engineering community around here :D I am very glad on that.... anyway... I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time. I am ...
  • 131
1 vote
2 answers
2k views

How to set breakpoint on C++ symbols?

How to set breakpoint on this C++ symbol? bp qmgr!TokenHandle::operator-: Could not resolve error at 'qmgr!TokenHandle::operator-:' in windbg?
1 vote
1 answer
928 views

How to get the EIP value right before WinDBG attach operation?

When WinDBG attach to a process, the EIP will point at ntdll!DbgBreakPoint in a dedicated thread different to the main process threads. Is it possible to get the EIP value right before the attach ...
  • 111