Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
195
questions
14
votes
4
answers
7k
views
Debugger hiding plugin for WinDbg?
Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
- 685
13
votes
2
answers
3k
views
Should I switch from WinDbg to OllyDbg?
I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I ...
- 970
12
votes
5
answers
6k
views
How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?
I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is:
Unable to enumerate locals, HRESULT 0x80004005
...
- 325
10
votes
2
answers
1k
views
What impact does noninvasive debugging have?
What impact does noninvasive user mode debugging with WinDbg have on the process?
Will it be detectable by the process?
Of course I could imagine that if the threads are suspended, differences in ...
- 970
9
votes
2
answers
2k
views
Importing list of functions and addresses into WinDbg
When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in).
Since I prefer my kernel debugging with plain ...
- 193
8
votes
3
answers
6k
views
windows kernel debugging on Mac host (using VMware fusion)
in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD.
now the question is, is there any possibility of doing ...
- 581
8
votes
1
answer
1k
views
Detecting protected processes and critical processes from windows driver
I've got a driver that tamper user-space processes by sending APC calls upon process start using the call PsSetCreateProcessNotifyRoutine.
I wish to avoid tampering with any process that is critical ...
- 205
8
votes
1
answer
8k
views
WinDbg fails to connect to IDA Pro debugger server
Environment:
Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg
Guest: Win7 SP1 x64
I have VirtualKD setup correctly in my guest and host.
I say this because ...
7
votes
1
answer
4k
views
at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?
Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out.
I am reverse-engineering an application which at some point ...
- 668
6
votes
1
answer
3k
views
Debugging a deadlock when the mutex owner thread is dead?
Intro
I'm facing a peculiar deadlock scenario I never saw before.
I'm trying to debug this deadlock from 3 days and couldn't find how to fix it in a proper way. Hopefully someone would help me out.
...
6
votes
1
answer
6k
views
Find main() function of executable with windbg
I have an executable without debug symbols, and I want to get to its' main() function.
What I do is putting breakpoint at $exentry address, but this address of some CRT-initialization. To get to the ...
- 63
6
votes
1
answer
4k
views
Can Windbg trace function calls within a module?
I want to log any functions within a specific module that are called during an execution.
I tried !for_each_function and wt command. However, since the target module doesn't have any symbols, !...
- 253
6
votes
1
answer
493
views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
- 395
6
votes
2
answers
1k
views
Removing personal data from dump file
I want to publish a crash dump on the Internet for other people to learn from the dump. Usually I take dumps with .dump /ma which is fine.
However, I'm a bit concerned about personal data included in ...
- 970
6
votes
1
answer
2k
views
How to know which module am I currently in? (EIP/RIP pointer)
I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode:
What ...
- 1,639
6
votes
1
answer
1k
views
Windows 10 v.1803 boot failure after trying to install network kernel debugging with WinDbg Preview
I'm trying to set up kernel debugging on a physical hardware/desktop to test the new WinDbg Preview. Here's the steps:
I'm using a desktop with Intel DG41TY board.
Installed Windows 10 Pro build 1803....
- 1,639
5
votes
3
answers
8k
views
How can I view FS:[0] with windbg?
It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger.
I am now using Windbg. But, I am unable to view FS (specifically FS:[0])....
- 165
5
votes
3
answers
2k
views
Faster Kernel debugging for Windows
I am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the ...
- 773
5
votes
3
answers
12k
views
Kernel debugging - how to set breakpoint at DriverEntry?
I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
- 53
5
votes
1
answer
6k
views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
- 1,639
5
votes
2
answers
9k
views
Tracing function calls in x64dbg
I'm new with x64dbg and want to know if there is any way to get the trace of a functions inside a module?
I've used trace over option, but basically it just traces all the insturctions but doesn't "...
- 203
5
votes
3
answers
598
views
Is there a tool to see kernel space mapping of a Windows exe?
In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
- 391
5
votes
2
answers
6k
views
windbg: How to determine the opcode for an assembly language instruction or set of instructions
I am working on an assignment to perform an exploit using a rop chain.
While I understand the basics behind rop, I don't know how to convert instructions like
xchg eax, esp; retn;
to their opcodes.
...
- 379
5
votes
2
answers
1k
views
windbg crashdump process by pid from kernel
What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do ...
- 51
4
votes
2
answers
11k
views
When to use Windbg and Ollydbg?
According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is ...
- 391
4
votes
2
answers
2k
views
Find the kernel structure that contains device name
I'm using WinDbg to try enumerate drivers and their associated devices. Getting the driver name is very easy. It is found in the _DRIVER_OBJECT structure. Unfortunately, the _DEVICE_OBJECT does not ...
- 323
4
votes
3
answers
2k
views
WinDbg: Setting a breakpoint on every EXPORTED function of a module
Kinda new to WinDbg. I got an executable who loads a module later in the execution path, so at start I'm doing sxe ld:moduleName to break when the process loads the module.
Then I tried to just put a ...
4
votes
2
answers
2k
views
Manipulate EIP in Immunity Debugger
I just was playing around with Windbg, debugging some application.
At some point I had to manipulate EIP which was pretty easy in Windbg. But then once I switched back to Immunity, I could not figure ...
- 443
4
votes
1
answer
1k
views
Unable to break at DriverEntry of malicious Driver
I got a malicious kernel mode driver from VirusTotal. Now, I am trying to debug it using Windbg.
Below are the details of the setup:
Host OS: Win 7 Ultimate 64-bit, Windbg version 6.11.x, VMWare ...
- 765
4
votes
2
answers
552
views
How to break on a clipboard operation in cmd.exe with IDA / WinDbg?
My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
- 1,639
4
votes
2
answers
640
views
Kernel debug - internet explorer in kernelmode?
My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;).
So I get the process list with !process, one active process is Internet Explorer:
...
- 43
4
votes
1
answer
1k
views
Question about the limit and base address in x86-64 segmentation model?
I'm trying to understand how segmentation works under x86-64. From what I see, it's mostly disabled, but not entirely. It looks like GS and FS registers are still using it.
So I was reviewing the ...
- 1,639
4
votes
0
answers
263
views
Comparison of Windows Debuggers
I have some experience reverse engineering ELF files using tools like GDB, radare2, and Ghidra, but I am new to Windows debugging. There are quite a few different debuggers out there for Windows and ...
- 151
3
votes
2
answers
183
views
Are some special chars(<>) in function names not supported by windbg/cdb?
I have a function in a binary like this class<class1::class2>::function. I can't directly use commands like bp, u, x on the function. The only option I have right now is x class* and then look ...
- 2,629
3
votes
1
answer
3k
views
WinDbg Debugging without symbols
So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
- 665
3
votes
1
answer
13k
views
How to configure IDA to load .pdb files from Microsoft public symbol server?
I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA.
So when I ...
- 1,639
3
votes
2
answers
3k
views
windbg - Why does the GS register resolve to offset 0x0?
I'm trying to understand how to resolve segment addressing (specifically the GS register in X64).
My toy program:
int main()
{
unsigned long long x;
__debugbreak();
x = __readgsqword(...
- 145
3
votes
2
answers
2k
views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
- 51
3
votes
2
answers
2k
views
Did Microsoft remove the _PEB and _TEB symbols from the ntdll's debug symbols permanently?
After updating a batch of Windows updates, it seems the ntdll.dll version got bumped from 6.1.7601.188869 (modified 25/5/15) to 6.1.7601.18933 (modified 15/07/2015).
Since then, !peb, !teb, !address ...
- 51
3
votes
1
answer
2k
views
Resolve Addresses To Function Names
I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
- 395
3
votes
1
answer
1k
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,830
3
votes
1
answer
4k
views
WinDBG. How to catch first-chance exceptions?
I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session.
I have written simple example application called Exceptions.exe:
int WINAPI WinMain(...
- 33
3
votes
1
answer
1k
views
How to use windbg to view assembly code of kernel function?
I am using windbg for local kernel debugging. I want to view the disassembly of a kernel function (eg. AuxKlibQueryModuleInformation). I am not familiar with kernel debugging. Please help me do this.
- 31
3
votes
1
answer
2k
views
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
- 1,639
3
votes
3
answers
1k
views
How to debug ServiceMain function of a service?
I have a malware which is checking for keyboard type and locale information.
After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
- 131
3
votes
1
answer
2k
views
Kernel debugging between two virtual machines not working
i want to do kernel debugging on my vm from another vm.
My setup is pretty simple,
Debugged - VM:
Windows XP SP3 x32 (To be debugged)
Debugger - VM:
Windows 7 SP1 x64 (With Windbg installed - the ...
- 668
3
votes
2
answers
7k
views
Why doesn't WinDbg resolve the function names?
This is definitely a beginner question but the WinDbg docs didn't help me out much because most of it is oriented around debugging programs with PDB files available. I tried .reload but it didn't have ...
- 31
3
votes
1
answer
924
views
Windbg 'as' command in log breakpoint
I want to break the debugee as it opens a known file, using windbg. As $scmp doesn't accept direct address, I have to use as (windbg alias command). So, I put a conditional breakpoint at CreateFileA:
...
- 291
3
votes
1
answer
424
views
Prevent Windbg Log Breakpoint Fail by Memory Check
Following break point fails because of bad memory address in some situation and cause break in execution:
bp 0x12345678 ".printf \"PID: %d, unkVar: %d\\n\", ..., poi(poi(ecx+1c)+8)+c;g"
Is there any ...
- 291
3
votes
1
answer
137
views
Specifying an MMX register's value in WinDbg
i am analysing a crash, the crash occurs in a function that its always on use, if set a break point in this function always stop the program.
When the crash occurs, overwrite mm3 register, i want ...
- 95