Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
44
questions with no upvoted or accepted answers
4
votes
0
answers
263
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 151
3
votes
0
answers
204
views
How find all kernel functions called by a driver in windows 11
I am working on a highly obfuscated driver that is virtualized. In an attempt to work on this driver I asked a question about some python scripts which turned out not to be effective at all so I ...
- 33
3
votes
0
answers
165
views
Adobe Reader JIT Pages
I use Adobe Reader XI for a little research project.
I know that Adobe use SpiderMonkey as its JS engine.
When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
- 31
2
votes
0
answers
60
views
What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?
What is the gdb command equivalent of bp MODULE_NAME+0x12345678 in WinDBG?
I found this command useful to debug with ASLR (w/o disabling it).
- 101
2
votes
0
answers
70
views
Windbg multiple memory windows
I have tried to open multiple memory windows but I can't.
I tried to find resolution for this on windbg help and on old version it is possible, however on new version I can't find how to open multiple ...
- 71
2
votes
0
answers
41
views
WinDbg Preview search is not returning results
I am attempting to manually unpack a malware sample. I am using the new WinDbg Preview (only thing that is available to download now). After letting the malware call VirtualAlloc I am trying to search ...
- 131
2
votes
0
answers
391
views
Windows kernel debugging using IDA & WinDbg
I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
- 151
2
votes
0
answers
557
views
How to search for String/Byte pattern in memory within a WinDBG Time Travel Debugging trace?
I'm currently practicing with WinDBG by playing around with a notepad trace. During recording the trace I have opened notepad, typed in "AAAABBBB" waited a few secs and then stopped the ...
2
votes
0
answers
38
views
Find the caption of VB5/6 Form Object in Memory Dump
I'm looking at a problem with app that has lost source code and the app crashes shortly after calling code that appears to be [Global Variable representing Form Object].ZOrder 0 (i.e. trying to make ...
- 1,235
2
votes
0
answers
108
views
Ignore some locations in Windbg Conditional breakpoints
I'm trying to set a conditional hardware breakpoint on Windows Kernel-Mode in Windbg by using the following syntax :
ba w1 ffff802312345678 "j(@rip==ffff802387654321 || @rip==ffff802387654330) 'gc';''...
- 21
2
votes
0
answers
642
views
How get a full memory dump of a running services.exe instance?
How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
- 121
2
votes
0
answers
453
views
Buffer overrun overwrittens dynamic function table
I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
- 41
2
votes
0
answers
2k
views
lm command on Windbg is not showing all modules
I'm trying to reverse-enginering a Win7 32bit legacy driver.
If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (!drvobj name ...
2
votes
0
answers
484
views
How allocate memory on Kernel mode by windbg?
How allocate memory on Kernel mode by windbg?
I use .dvalloc on user mode but not working on kernel mode
thanks.
- 121
2
votes
0
answers
868
views
Attach to specific process using IDA + WINDBG in kernel debugging
I asked this question at the StackOverflow website and they referenced me here.
(Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
- 668
2
votes
0
answers
1k
views
WinDbg is unable to communicate with the target after some time
Host and target are both Windows 7 x64.
The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
- 317
2
votes
0
answers
2k
views
Getting info for undocumented APIs called by StartServiceCtrlDispatcher
I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
- 325
1
vote
0
answers
57
views
Windbg command .call usage and syntax
I'm using Windbg to track all functions that could result in the blue screen errors. My method is to call certain suspects manually through windbg .call command. However, I always got syntax error. ...
- 313
1
vote
0
answers
299
views
How to find the fifth function argument on stack in windbg?
I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
- 313
1
vote
0
answers
461
views
c000001d (Illegal instruction)
My Windows crashed, don't understand it shows 'Illegal instruction' on a simple 'strlen' instruction:
*******************************************************************************
* ...
- 111
1
vote
0
answers
66
views
How does windbg correctly resolve symbol addresses for optimised code?
When you debug optimised code, I know that address arithmetic doesn't work correctly:
0:004> u dwmcore!CPartitionVerticalBlankScheduler::WaitForWork+0x69
u dwmcore!CPartitionVerticalBlankScheduler::...
- 295
1
vote
0
answers
85
views
windbg shows different instruction at address when you set the breakpoints in 2 different breaks but not the same break (nvd3d9wrapx thunk in user32)
In the first example I only set a breakpoint on user32!CreateWindowExW
In the second example, I set 2 breakpoints at the same time on user32!CreateWindowExW and notepad!WinMain
In the 3rd example I ...
- 295
1
vote
0
answers
250
views
Call stack in Windbg address with no modules associated
I've been working on figuring out the stack from a minidump [1]; but have put that on hold as I had other things to figure out. Coming back to this problem, I figured I'd go back and use Windbg to ...
- 135
1
vote
0
answers
299
views
Windbg memory access error when trying to edit a string value of a button
So i was trying to edit the string value of a button as a debugging practice using windbg. I'm still a complete novice in reverse engineering and debugging, when i try to edit the string value using ...
- 21
1
vote
0
answers
142
views
Nice way to get Windows API call arguments in WinDBG
How do I get a nice list of call arguments for well documented functions such as kernel32!CreateRemoteThread in windbg? Right now when a breakpoint hits I manually decode them considering the ...
- 193
1
vote
0
answers
231
views
Why rundll32.exe could be loading a DLL multiple times?
Since I started reverse engineering I've found multiple DLLs that when being debugged(IDA + WindDBG) would be unloaded and reloaded continuously without any evident reason.
Most of the time I use ...
- 11
1
vote
0
answers
36
views
Whats the difference between a MiNotMapped PFN entry with all 1s, and a MiNonCached PFN entry with all 0s and a 0 PteAddress?
On host (UEFI legacy mode):
lkd> !pfn 0xf0
PFN 000000F0 at address FFFFFA8000002D00
flink FFFFFFFFFFFFFFFF blink / share count FFFFFFFFFFFFFFFF pteaddress FFFFFFFFFFFFFFFF
...
- 295
1
vote
0
answers
97
views
Local KD -- can't access physical address 0xFFFFFFF0 but you can with RwEverything
I've never been able to access 0xf0000000 range using !db on local debug, and I've tried !db -m 00000000`fffffff0 and !db [uc] 00000000`fffffff0. I only get Physical memory read at fffffff0 failed. It ...
- 295
1
vote
0
answers
39
views
WinDbg pattern search not returning expected result
I'm searching for a string, say the old "This program cannot run".
Switching context to e.g. notepad, non invasive, with page translation
1: kd> !process 0 0 notepad.exe
PROCESS ...
- 111
1
vote
0
answers
260
views
Issues with Symbols when running windbg on windows xp sp3
I have been trying to debug a crash using windbg on windows xp sp3. I have been getting the below error while trying to debug. I googled around and found the Microsoft no longer offers symbols exe as ...
1
vote
0
answers
145
views
WinDbg does not shows all first chance exceptions
I have an application, which sometimes fails. I run procdump and see some first chance exceptions like this:
[14:29:38] Exception: E06D7363.?AVCServicesMDException@@
[14:29:38] Exception: E06D7363.?...
- 11
1
vote
0
answers
306
views
Prevent windbg from context switching when stepping into assembly instructions
When I'm using Windbg (in kernel mode) to step into assembly, I would encounter context switching once in a while - which is annoying.
So, for example, I placed a breakpoint for a process - let's ...
- 123
1
vote
0
answers
205
views
windbg stopped after I set up a breakpoint, keeping busing
I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly.
struct s {
int a;
int b;
int c;
};
struct s get_some_values(int ...
- 11
1
vote
0
answers
146
views
Using the AND operator to find a heap allocation size, Fermin's formula
I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation:
Lets say you have ...
- 11
1
vote
0
answers
1k
views
Symbols could not be loaded for win32k drivers
I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
- 153
1
vote
0
answers
97
views
How can I send a "Break" to the WinDbg backend when using IDA as a frontend?
When I use WinDbg and there's some long operation, I can press CtrlBreak to cancel the current operation (for instance, but not limited to, cancel PDB loading). Or use this:
However, whenever I use ...
- 458
1
vote
0
answers
212
views
How to call DebugActiveProcessStop from disassembled code?
I am debugging an application. Another process is debugged by this application.
Here is the call
00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>]
I want to ...
- 11
0
votes
0
answers
25
views
how to set flag in windbg
Let's say we have 2 functions funcA and funcB, funcA is the upstream of funcB. I want to view certain values and call stack in funcB only if funcA satisfies certain conditions. I can't achieve this ...
- 313
0
votes
0
answers
80
views
windbg fail to load symbol with UNC store
I'm debugging a qemu windows machine in docker and the windbg shows the file is missing. Windbg is attached to qemu
kd> .sympath
Symbol search path is: srv*
Expanded Symbol search path is: cache*;...
- 313
0
votes
0
answers
26
views
missing caller function in call stack
I'm trying to intercept and locate tcp packets in memory through debugging of windows 10. Suppose I set a break point at TcpReceive, the call stack looks like this
kd> kc
# Call Site
tcpip!...
- 313
0
votes
0
answers
39
views
Firmware not attached to WinDBG while debugging Windows boot process
I'm attempting to reproduce the cve-2022-21894 poc for educational purposes, however I'm getting stuck at the "hvloader" phase. The debugger cannot attach to the boot process.
Short ...
- 11
0
votes
0
answers
144
views
Heavens gate code
Recommend me please how and what better to reverse the code containing "heavens gate"? What tool to bypass protection? Thank you.
I use Intel Pin
push cs
push 0xa02829
jmp far ...
- 21
0
votes
0
answers
105
views
What kind of code creates this function call pattern?
While using WinDbg: u/uf to disassemble functions in ntoskrnl.exe there are functions that are used in system calls and exception handling that have these weird function call patterns and I can't ...
- 101
0
votes
0
answers
169
views
Windows time travel debugging performance bottleneck
First of all I wan to be clear, that this question is not about the collection performance, but indexing performance.
What is the performance bottleneck of the indexing step?
Some context:
Action in ...
- 1