Questions tagged [windbg]

A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.

Filter by
Sorted by
Tagged with
1
vote
1answer
314 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
2
votes
1answer
76 views

WinDBG doesn't resolve function names when debugging kernel module

I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically). Here is a picture ...
9
votes
2answers
2k views

Importing list of functions and addresses into WinDbg

When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in). Since I prefer my kernel debugging with plain ...
1
vote
1answer
82 views

Trying to reverse engineer CmpFindNlsData of winload

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
0
votes
0answers
23 views

Connection to Microsoft Symbol Server reset in windbg

I'm using windbg version 6.12.0002.633 X86 on Windows XP SP3 in a VM. I've configured the environment variable, _NT_SYMBOL_PATH as shown below: _NT_SYMBOL_PATH=symsrv*symsrv.dll*c:\symbols*http://msdl....
0
votes
0answers
32 views

Is there an event log to check when WinDbg kernel debugger fails to attach on OS load?

I'm using the latest WinDbg (Preview) to do kernel debugging on a Windows 10 client (v 1909) via a network connection in a VM. And I'm wondering if there's a log that the kernel debugger maintains? I ...
1
vote
0answers
24 views

WinDbg pattern search not returning expected result

I'm searching for a string, say the old "This program cannot run". Switching context to e.g. notepad, non invasive, with page translation 1: kd> !process 0 0 notepad.exe PROCESS ...
2
votes
0answers
18 views

Find the caption of VB5/6 Form Object in Memory Dump

I'm looking at a problem with app that has lost source code and the app crashes shortly after calling code that appears to be [Global Variable representing Form Object].ZOrder 0 (i.e. trying to make ...
0
votes
1answer
4k views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
0
votes
0answers
28 views

bad memory mapping in case of MEMORY dump IDA <-> WinDbg

when I open the debug dump (IDA x64) , I don't have the memory ranges. Exactly like in this question: ESP out of range of "Stack View" in IDA It used to be fine, but I don't have the menu ...
2
votes
1answer
77 views

Get return address from syscall

I'm debugging some 32-bit process using windbg kernel debugger. This process calls some syscalls, so I set few breakpoints at kernel functions like nt!NtQuerySystemInformation. So after breakpoint hit,...
1
vote
1answer
112 views

Windbg: “gu” command inside of a breakpoint causes warning

I'm trying to leverage "gu" command in a conditional breakpoint or as a "CommandString" in a regular breakpoint. For example let's consider break on a malloc() function when we want to see in logs ...
1
vote
1answer
126 views

Getting NTSTATUS 0xC0000022 when attempting to debug a process

I am attempting to debug a process with windbg (with admin privileges) and I am getting the following error: Could not attach to process XXXX =, NTSTATUS 0xC0000022 {Access Denied} A process has ...
0
votes
0answers
49 views

Use WinDbg to bypass file open checks

I'm using an evaluation version of a program that opens custom filetypes (a combination of text/midi like a karaoke helper). The evaluation version will only open certain files bundled with it. When I ...
2
votes
4answers
9k views

IDA PRO + Windows 10 + WinDbg

I didn't know That we've got a Reverse Engineering community around here :D I am very glad on that.... anyway... I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time. I am ...
0
votes
0answers
31 views

Symbol Information on wcscpy_s in WinDbg - Why references across so many DLLs?

I am using Time Travel Debugging feature of WinDbg to log string output with position of trace to help me more easily isolate sections of codes I want to analyse, using command like below: bp ...
2
votes
1answer
744 views

Windbg: How to directly view GS:[0x60]

Win10x64: In Windbg, how may I view a pointer to the PEB by directly using GS:[0x60] (and not by Windbg extensions)? To test, I assembled a program via masm64 that throws an interrupt, clears r8 then ...
0
votes
1answer
381 views

How to calculate the size of a PE from headers?

What I am trying to do is calculate the size of a PE through it's headers. I am using WinDbg's Javascripting and in this case, it will mostly be for drivers. The idea is to dump a driver from memory ...
0
votes
2answers
156 views

Disassembling only given function

I'm looking for some disassembler that has feature similar to WinDbg uf function, it produces output that is really easy transferable to compilable NASM listing. The problem with WinDbg is that it's ...
-1
votes
1answer
94 views

How to find each interrupt's line in the Interrupt Descriptor Table

I'm trying to find the line number of the 0f05 syscall interrupt with no success. I searched everywhere and couldn't find any way of doing that, it seems like this information is hard coded in the ...
0
votes
0answers
111 views

Issues with Symbols when running windbg on windows xp sp3

I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
0
votes
2answers
80 views

Predicting Memory locations of arguments within a function

I'm trying to write a script that would help display the memory contents of the arguments passed within a function. For example, in the function below, the first argument starts at the EAX register. ...
0
votes
1answer
458 views

Remote debugging using IDA, connecting to windbg server (kernel mode)

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
0
votes
2answers
781 views

x64dbg (x32dbg) log registers every step like windbg

So I just switched to x64dbg (really using x32 atm) from windbg and so far I like it but the one thing I'm missing is windbg printing all the registers every step in the command window. Anyone know ...
1
vote
1answer
46 views

What does -c mean in this Windbg Command Syntax?

kd> u win32k!impPsIsThreadTerminating+0xe4-c L5 | \ \ \ \ \ / \ \ \ \ \ / \ \ \ \ \ ...
1
vote
1answer
166 views

Setting a conditional kernel breakpoint in WinDbg grinds the debuggee OS to a halt

My setup: Debugger: Win10 Pro, WinDbg Preview v.1.0.1904.18001 Debuggee: Win7 Pro (running in a VM using VMWare Workstation) I'm trying to follow the SendMessage call from the user space: Into the ...
0
votes
1answer
137 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
1
vote
1answer
2k views

Tracing function calls in x64dbg

I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module? I've used trace over option, but basically it just traces all the insturctions but doesn't "...
1
vote
0answers
49 views

WinDbg does not shows all first chance exceptions

I have an application, which sometimes fails. I run procdump and see some first chance exceptions like this: [14:29:38] Exception: E06D7363.?AVCServicesMDException@@ [14:29:38] Exception: E06D7363.?...
2
votes
2answers
876 views

windbg - Why does the GS register resolve to offset 0x0?

I'm trying to understand how to resolve segment addressing (specifically the GS register in X64). My toy program: int main() { unsigned long long x; __debugbreak(); x = __readgsqword(...
1
vote
1answer
599 views

windbg - What is the relation between the VAD (!vad), the PTEs (!pte), and loaded modules and sections (lm and !dh)?

[cross-posted (but closed the original) from https://stackoverflow.com/q/55438806/254959] I'm trying to gain a better understanding on Windows process memory, and have some gaps with regards to the ...
6
votes
1answer
468 views

Detecting protected processes and critical processes from windows driver

I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine. I wish to avoid tampering with any process that is critical ...
3
votes
1answer
471 views

How to use windbg to view assembly code of kernel function?

I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
1
vote
3answers
975 views

WinDbg: Setting a breakpoint on every EXPORTED function of a module

Kinda new to WinDbg. I got an executable who loads a module later in the execution path, so at start I'm doing sxe ld:moduleName to break when the process loads the module. Then I tried to just put a ...
2
votes
1answer
668 views

Debugger Win32 Local vs WinDbg in Ida vs Ollydbg

When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages. I know that Ida designated for static analyze , but there are some debugger in ...
2
votes
1answer
147 views

Why IDA can't find the function named by windbg

This is definitely a beginner question,I'm doing static and dynamic analysis on certain dll file and the WinDbg give me call stack like SERVER+0x78123 When I return back to IDA to see the code ...
1
vote
1answer
70 views

Windbg Break Points

I need to set a break point when a specific module address space is being overwritten? I need to specify this by module name not address space
3
votes
1answer
3k views

WinDbg Debugging without symbols

So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
1
vote
1answer
94 views

Windbg's “dt” equivalent in IDA?

I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)? Assuming of course I have the pdb file. Thank you :)
3
votes
3answers
816 views

How to debug ServiceMain function of a service?

I have a malware which is checking for keyboard type and locale information. After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
4
votes
2answers
95 views

Are some special chars(<>) in function names not supported by windbg/cdb?

I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
0
votes
1answer
868 views

How to breakpoint atached process with ida when move on

In IDA pro, there is an option to attach to a process using the WinDbg backend. When I want is to see the process' control flow when the IDA attaches to it. The only way (that I know) to see the ...
3
votes
2answers
1k views

Manipulate EIP in Immunity Debugger

I just was playing around with Windbg, debugging some application. At some point I had to manipulate EIP which was pretty easy in Windbg. But then once I switched back to Immunity, I could not figure ...
1
vote
1answer
508 views

Break on driver loading with windbg

I try to debug a driver used by malware ( without source code of course ), to see what IOCTLS it uses and for what. I have issues breaking on driver loading, it has a proper driver structure, with ...
2
votes
0answers
85 views

Ignore some locations in Windbg Conditional breakpoints

I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax : ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
2
votes
2answers
1k views

What is the difference between Windbg and local debugger in IDA

When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger. What is the difference? By the way, is there any difference if I use Windbg tool (windows software) ...
3
votes
1answer
645 views

Question about the limit and base address in x86-64 segmentation model?

I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it. So I was reviewing the ...
2
votes
2answers
850 views

Can I set more than 4 memory access breakpoints in WinDbg?

I can set a DWORD memory read/write access breakpoint in WinDbg with the following command: ba r 4 0x0307F42C But is there a way to set more than 4 of those?
4
votes
0answers
849 views

Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview

I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps: I'm using a desktop with Intel DG41TY board. Installed Windows 10 Pro build 1803....
1
vote
0answers
159 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...