Skip to main content

Questions tagged [windbg]

A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.

50 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5 votes
0 answers
633 views

Comparison of Windows Debuggers

I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
jinscoe123's user avatar
3 votes
0 answers
243 views

How find all kernel functions called by a driver in windows 11

I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
user19819208's user avatar
3 votes
0 answers
167 views

Adobe Reader JIT Pages

I use Adobe Reader XI for a little research project. I know that Adobe use SpiderMonkey as its JS engine. When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
kvmN00bsky's user avatar
2 votes
1 answer
109 views

What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?

What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG? I found this command useful to debug with ASLR (w/o disabling it).
alond22's user avatar
  • 113
2 votes
0 answers
107 views

Windbg multiple memory windows

I have tried to open multiple memory windows but I can't. I tried to find resolution for this on windbg help and on old version it is possible, however on new version I can't find how to open multiple ...
short dragon's user avatar
2 votes
0 answers
57 views

WinDbg Preview search is not returning results

I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
Jason Crosby's user avatar
2 votes
0 answers
673 views

Windows kernel debugging using IDA & WinDbg

I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
millionmilesaway's user avatar
2 votes
0 answers
770 views

How to search for String/Byte pattern in memory within a WinDBG Time Travel Debugging trace?

I'm currently practicing with WinDBG by playing around with a notepad trace. During recording the trace I have opened notepad, typed in "AAAABBBB" waited a few secs and then stopped the ...
programmerskitchen's user avatar
2 votes
0 answers
47 views

Find the caption of VB5/6 Form Object in Memory Dump

I'm looking at a problem with app that has lost source code and the app crashes shortly after calling code that appears to be [Global Variable representing Form Object].ZOrder 0 (i.e. trying to make ...
chentiangemalc's user avatar
2 votes
0 answers
111 views

Ignore some locations in Windbg Conditional breakpoints

I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax : ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
Migo Lopak's user avatar
2 votes
0 answers
644 views

How get a full memory dump of a running services.exe instance?

How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
forbiddenhi's user avatar
2 votes
0 answers
461 views

Buffer overrun overwrittens dynamic function table

I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
davidfm's user avatar
  • 41
2 votes
0 answers
2k views

lm command on Windbg is not showing all modules

I'm trying to reverse-enginering a Win7 32bit legacy driver. If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (!drvobj name ...
Marco Ramsay Qualcuno's user avatar
2 votes
0 answers
501 views

How allocate memory on Kernel mode by windbg?

How allocate memory on Kernel mode by windbg? I use .dvalloc on user mode but not working on kernel mode thanks.
forbiddenhi's user avatar
2 votes
0 answers
882 views

Attach to specific process using IDA + WINDBG in kernel debugging

I asked this question at the StackOverflow website and they referenced me here. (Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
0xAK's user avatar
  • 668
2 votes
0 answers
1k views

WinDbg is unable to communicate with the target after some time

Host and target are both Windows 7 x64. The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
user3002428's user avatar
2 votes
0 answers
2k views

Getting info for undocumented APIs called by StartServiceCtrlDispatcher

I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
Justin Dearing's user avatar
1 vote
1 answer
79 views

Windbg conditional breakpoint issue

Can't get a conditional breakpoint to fire in Windbg. I tried: bp xxxxxxxx "j (@ebp+0C==115) ''; 'gc' " bp xxxxxxxx "j (ebp+0C==115) ''; 'gc' " bp xxxxxxxx "j (poi(ebp+0C)==...
Uddie's user avatar
  • 11
1 vote
0 answers
95 views

Windbg command .call usage and syntax

I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. ...
anonymous bear's user avatar
1 vote
0 answers
398 views

How to find the fifth function argument on stack in windbg?

I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
anonymous bear's user avatar
1 vote
0 answers
648 views

c000001d (Illegal instruction)

My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction: ******************************************************************************* * ...
GreenTea's user avatar
  • 111
1 vote
0 answers
83 views

How does windbg correctly resolve symbol addresses for optimised code?

When you debug optimised code, I know that address arithmetic doesn't work correctly: 0:004> u dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x69 u dwmcore!CPartitionVerticalBlankScheduler::...
Lewis Kelsey's user avatar
1 vote
0 answers
97 views

windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)

In the first example I only set a breakpoint on user32!CreateWindowExW In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain In the 3rd example I ...
Lewis Kelsey's user avatar
1 vote
0 answers
332 views

Call stack in Windbg address with no modules associated

I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out. Coming back to this problem, I figured I'd go back and use Windbg to ...
ewokx's user avatar
  • 135
1 vote
0 answers
357 views

Windbg memory access error when trying to edit a string value of a button

So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
Someone's user avatar
  • 21
1 vote
0 answers
159 views

Nice way to get Windows API call arguments in WinDBG

How do I get a nice list of call arguments for well documented functions such as kernel32!CreateRemoteThread in windbg? Right now when a breakpoint hits I manually decode them considering the ...
Konrads's user avatar
  • 193
1 vote
0 answers
254 views

Why rundll32.exe could be loading a DLL multiple times?

Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason. Most of the time I use ...
hariseldon's user avatar
1 vote
0 answers
38 views

Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?

On host (UEFI legacy mode): lkd> !pfn 0xf0 PFN 000000F0 at address FFFFFA8000002D00 flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF ...
Lewis Kelsey's user avatar
1 vote
0 answers
122 views

Local KD -- can't access physical address 0xFFFFFFF0 but you can with RwEverything

I've never been able to access 0xf0000000 range using !db on local debug, and I've tried !db -m 00000000`fffffff0 and !db [uc] 00000000`fffffff0. I only get Physical memory read at fffffff0 failed. It ...
Lewis Kelsey's user avatar
1 vote
0 answers
49 views

WinDbg pattern search not returning expected result

I'm searching for a string, say the old "This program cannot run". Switching context to e.g. notepad, non invasive, with page translation 1: kd> !process 0 0 notepad.exe PROCESS ...
Assaf Levy's user avatar
1 vote
0 answers
277 views

Issues with Symbols when running windbg on windows xp sp3

I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
sinpingsegfaults's user avatar
1 vote
0 answers
157 views

WinDbg does not shows all first chance exceptions

I have an application, which sometimes fails. I run procdump and see some first chance exceptions like this: [14:29:38] Exception: E06D7363.?AVCServicesMDException@@ [14:29:38] Exception: E06D7363.?...
dartNNN's user avatar
  • 11
1 vote
0 answers
349 views

Prevent windbg from context switching when stepping into assembly instructions

When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying. So, for example, I placed a breakpoint for a process - let's ...
Kyoma's user avatar
  • 123
1 vote
0 answers
212 views

windbg stopped after I set up a breakpoint, keeping busing

I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly. struct s { int a; int b; int c; }; struct s get_some_values(int ...
Michael's user avatar
  • 11
1 vote
0 answers
147 views

Using the AND operator to find a heap allocation size, Fermin's formula

I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation: Lets say you have ...
Steve's user avatar
  • 11
1 vote
0 answers
1k views

Symbols could not be loaded for win32k drivers

I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
Vlad's user avatar
  • 153
1 vote
0 answers
98 views

How can I send a "Break" to the WinDbg backend when using IDA as a frontend?

When I use WinDbg and there's some long operation, I can press CtrlBreak to cancel the current operation (for instance, but not limited to, cancel PDB loading). Or use this: However, whenever I use ...
Martin's user avatar
  • 468
1 vote
0 answers
212 views

How to call DebugActiveProcessStop from disassembled code?

I am debugging an application. Another process is debugged by this application. Here is the call 00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] I want to ...
ASD's user avatar
  • 11
0 votes
0 answers
40 views

Dynamic analysis of cmd dependent software

There is a PE file, which can't run by itself, and can only be called from cmd.exe, it doesn't create independent processes, and can be launched independently only with .bat scripts, which without &...
flying_meatball's user avatar
0 votes
0 answers
32 views

Processor breakpoint not triggers in write operation - WinDbg

Following a specific address, i can't see the content on that address because i am getting "??" on memory section, which isn't an issue because it's supposed to be an invalid address in the ...
deon cagadoes's user avatar
0 votes
0 answers
52 views

Reversing SYSTEM Process

I'm doing some vulnerability research against a Windows server application that serves some update files that clients can download. Using TcpView/netstat, I can see that there is an open port ...
BobNewby's user avatar
0 votes
0 answers
55 views

Windbg set conditional breakpoint

Can't get this to work. I want to set a conditional breakpoint in Windbg with the condition to be when eax is 11h (17). I tried: bu xxxxxxxx ".if(eax != 17){gc}" bu xxxxxxxx ".if(@eax !=...
Uddie's user avatar
  • 11
0 votes
0 answers
52 views

(IDA/Windbg) break after run

I want to break/debug/stop execution on the first line just after I run/go. So, in other words, I debug a executable with a dialog box and a command button. I wait for the program to load the dialog ...
Uddie's user avatar
  • 11
0 votes
0 answers
47 views

how to set flag in windbg

Let's say we have 2 functions funcA and funcB, funcA is the upstream of funcB. I want to view certain values and call stack in funcB only if funcA satisfies certain conditions. I can't achieve this ...
anonymous bear's user avatar
0 votes
0 answers
141 views

windbg fail to load symbol with UNC store

I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu kd> .sympath Symbol search path is: srv* Expanded Symbol search path is: cache*;...
anonymous bear's user avatar
0 votes
0 answers
29 views

missing caller function in call stack

I'm trying to intercept and locate tcp packets in memory through debugging of windows 10. Suppose I set a break point at TcpReceive, the call stack looks like this kd> kc # Call Site tcpip!...
anonymous bear's user avatar
0 votes
0 answers
55 views

Firmware not attached to WinDBG while debugging Windows boot process

I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process. Short ...
gergeerew's user avatar
0 votes
0 answers
153 views

Heavens gate code

Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you. I use Intel Pin push cs push 0xa02829 jmp far ...
ALex's user avatar
  • 21
0 votes
0 answers
107 views

What kind of code creates this function call pattern?

While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
Arush Agarampur's user avatar
0 votes
0 answers
184 views

Windows time travel debugging performance bottleneck

First of all I wan to be clear, that this question is not about the collection performance, but indexing performance. What is the performance bottleneck of the indexing step? Some context: Action in ...
Jakub's user avatar
  • 1