Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
16
questions
14
votes
4
answers
7k
views
Debugger hiding plugin for WinDbg?
Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
- 685
12
votes
5
answers
6k
views
How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?
I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is:
Unable to enumerate locals, HRESULT 0x80004005
...
- 325
3
votes
1
answer
13k
views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
- 1,639
13
votes
2
answers
3k
views
Should I switch from WinDbg to OllyDbg?
I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I ...
- 970
7
votes
1
answer
4k
views
at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?
Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out.
I am reverse-engineering an application which at some point ...
- 668
6
votes
1
answer
4k
views
Can Windbg trace function calls within a module?
I want to log any functions within a specific module that are called during an execution.
I tried !for_each_function and wt command. However, since the target module doesn't have any symbols, !...
- 253
6
votes
2
answers
1k
views
Removing personal data from dump file
I want to publish a crash dump on the Internet for other people to learn from the dump. Usually I take dumps with .dump /ma which is fine.
However, I'm a bit concerned about personal data included in ...
- 970
5
votes
3
answers
8k
views
How can I view FS:[0] with windbg?
It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger.
I am now using Windbg. But, I am unable to view FS (specifically FS:[0])....
- 165
5
votes
1
answer
6k
views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
- 1,639
3
votes
2
answers
7k
views
Why doesn't WinDbg resolve the function names?
This is definitely a beginner question but the WinDbg docs didn't help me out much because most of it is oriented around debugging programs with PDB files available. I tried .reload but it didn't have ...
- 31
3
votes
1
answer
1k
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,830
3
votes
2
answers
2k
views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
- 51
2
votes
5
answers
12k
views
IDA PRO + Windows 10 + WinDbg
I didn't know That we've got a Reverse Engineering community around here :D
I am very glad on that....
anyway...
I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time.
I am ...
- 131
1
vote
1
answer
149
views
Trying to reverse engineer CmpFindNlsData of winload
I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is ...
- 17
1
vote
2
answers
2k
views
How to set breakpoint on C++ symbols?
How to set breakpoint on this C++ symbol?
bp qmgr!TokenHandle::operator-:
Could not resolve error at 'qmgr!TokenHandle::operator-:'
in windbg?
- 121
1
vote
1
answer
1k
views
How to get the EIP value right before WinDBG attach operation?
When WinDBG attach to a process, the EIP will point at ntdll!DbgBreakPoint in a dedicated thread different to the main process threads.
Is it possible to get the EIP value right before the attach ...
- 111