Questions tagged [windbg]

A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.

Filter by
Sorted by
Tagged with
1
vote
1answer
229 views

x64 Memory Pointer and Addressing modes [closed]

I'm working through example from a Windows disassembly training guide. In the exercise rax is set to a byte ptr, then rbx a word ptr. I notice the next byte of memory is skipped before rcx is to a ...
3
votes
1answer
177 views

Win32 x86 Prolog disassembly

I have the following disassembly of a function prolog with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack frame"...
0
votes
1answer
96 views

how calculate size of memory that allocated from create specific windows object? [closed]

how calculate size of memory that allocated from create specific windows object e.g. how memory allocated when createsemaphore API is called? there are any document that describe for all objects?
1
vote
0answers
331 views

Analyzing stack trace for vulnerability analysis using WIndbg [closed]

While analyzing root cause analysis of a vulnerability using windbg we use to put a command kb to view the stack trace. But after viewing the stack trace how to analyze or confirm the presence of ...
2
votes
0answers
586 views

How get a full memory dump of a running services.exe instance?

How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
0
votes
1answer
1k views

How find address of specific pool allocated? [closed]

How find address of specific pool that allocated by specific tag e.g. address of pool that allocated by CM7 tag? thanks
3
votes
1answer
3k views

WinDBG. How to catch first-chance exceptions?

I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session. I have written simple example application called Exceptions.exe: int WINAPI WinMain(...
5
votes
1answer
4k views

Find main() function of executable with windbg

I have an executable without debug symbols, and I want to get to its' main() function. What I do is putting breakpoint at $exentry address, but this address of some CRT-initialization. To get to the ...
2
votes
1answer
148 views

EIP not in known module, under WOW64

I'm using WinDbg to debug a program under WOW64 (OS is x64, app is 32-bit). I came across some indirect call inside the process module (module created by the app and not Windows), and started ...
3
votes
1answer
4k views

How to change address in the hex view in IDA debugger?

I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
4
votes
1answer
964 views

Unable to break at DriverEntry of malicious Driver

I got a malicious kernel mode driver from VirusTotal. Now, I am trying to debug it using Windbg. Below are the details of the setup: Host OS: Win 7 Ultimate 64-bit, Windbg version 6.11.x, VMWare ...
2
votes
0answers
414 views

Buffer overrun overwrittens dynamic function table

I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
3
votes
1answer
2k views

Kernel debugging between two virtual machines not working

i want to do kernel debugging on my vm from another vm. My setup is pretty simple, Debugged - VM: Windows XP SP3 x32 (To be debugged) Debugger - VM: Windows 7 SP1 x64 (With Windbg installed - the ...
2
votes
1answer
587 views

Are HBGary FastDump Pro dumps compatible with WinDbg?

I have read that HBGary's FastDump Pro (FDPro) can capture kernel dumps and include the page file contents. Although I'm not sure if the tool is still available commercially (it's not listed on the ...
2
votes
0answers
2k views

lm command on Windbg is not showing all modules

I'm trying to reverse-enginering a Win7 32bit legacy driver. If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (!drvobj name ...
0
votes
1answer
706 views

dps win32k!W32pServiceTable windbg command returning "????"

i want to see all graphics functions from the win32k!W32pServiceTable function pointer Array but it only returns "????" kd> dps nt!KeServiceDescriptorTableShadow L8 8298f980 8288b73c nt!...
1
vote
2answers
168 views

Windows 7x86 System Freezes when running assembly program with int 3h

Recently was doing some pydbg testing, so I had to remove the AeDebug entry (which determines the JIT debugger) in the registry, and Windbg was (and is) my JIT debugger. Exported the key before ...
1
vote
1answer
680 views

Windbg breakpoint counter

I set the following breakpoint: bp MSPTLS!LsCreateLine 100 The program crashes before the break point is hit 100 times. When I do bl after the crash, I get the following: 0 e 5dca4b62 0072 (...
2
votes
2answers
1k views

Did Microsoft remove the _PEB and _TEB symbols from the ntdll's debug symbols permanently?

After updating a batch of Windows updates, it seems the ntdll.dll version got bumped from 6.1.7601.188869 (modified 25/5/15) to 6.1.7601.18933 (modified 15/07/2015). Since then, !peb, !teb, !address ...
2
votes
1answer
350 views

Windbg Scripting Issue

Debugging an application's use of msvcrt!_read. Found a nifty Windbg script online Reversing on Windows: intercepting ReadFile that I lightly edited: $$ Windbg script to intercept when a file is ...
4
votes
3answers
532 views

Is there a tool to see kernel space mapping of a Windows exe?

In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
0
votes
2answers
1k views

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ? Also,I was debugging an exe which has PTRD at 0x600 and AEP at ...
1
vote
0answers
206 views

How to call DebugActiveProcessStop from disassembled code?

I am debugging an application. Another process is debugged by this application. Here is the call 00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] I want to ...
2
votes
0answers
399 views

How allocate memory on Kernel mode by windbg?

How allocate memory on Kernel mode by windbg? I use .dvalloc on user mode but not working on kernel mode thanks.
1
vote
1answer
443 views

How to find status and path of the specific module with C in the windows? [duplicate]

How to find status and path of the specific module with C in the windows? such as windbg lm (list loaded module) kd> lm m cdd start end module name 93ae0000 93afe000 cdd (...
4
votes
3answers
10k views

Kernel debugging - how to set breakpoint at DriverEntry?

I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
4
votes
2answers
10k views

When to use Windbg and Ollydbg?

According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is ...
1
vote
1answer
1k views

Longest x86 Instruction [closed]

I read the recent article "Longest x86 Instruction" http://blog.onlinedisassembler.com/blog/?p=23 I attempted to reproduce the curious disassembly issue on a Win7x86 development platform using masm ...
3
votes
2answers
5k views

Why doesn't WinDbg resolve the function names?

This is definitely a beginner question but the WinDbg docs didn't help me out much because most of it is oriented around debugging programs with PDB files available. I tried .reload but it didn't have ...
6
votes
1answer
3k views

at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?

Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out. I am reverse-engineering an application which at some point ...
2
votes
0answers
794 views

Attach to specific process using IDA + WINDBG in kernel debugging

I asked this question at the StackOverflow website and they referenced me here. (Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
1
vote
1answer
363 views

Getting MSRs from Windows Crash Dump

I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is ...
5
votes
2answers
5k views

windbg: How to determine the opcode for an assembly language instruction or set of instructions

I am working on an assignment to perform an exploit using a rop chain. While I understand the basics behind rop, I don't know how to convert instructions like xchg eax, esp; retn; to their opcodes. ...
2
votes
0answers
1k views

WinDbg is unable to communicate with the target after some time

Host and target are both Windows 7 x64. The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
3
votes
1answer
2k views

Windbg: going from vftable to c++ class

As part of an assignment, I am delving into the world of Internet Explorer, and am trying to figure out exactly what class(es) are being allocated on the heap. In the mshtml!CEventObj::...
1
vote
2answers
1k views

Determining the size of an object allocated on the heap

As part of an assignment, dealing with the operation aurora vulnerability, I am supposed to determine the size of C++ classes allocated on the heap. I used: 0:017> !heap -p -a <address of the ...
2
votes
1answer
127 views

windbg refferencing symbols is inconsistent

As part of an assignment, I am trying to do some debugging in iexplore.exe (Aurora vulnerability). After I load the test webpage in iexplorer 8, I open windbg and attach to the iexplore process. I ...
1
vote
2answers
908 views

Page Directory Pointer Table in WinDbg

The !pte command in WinDbg gives all the information one may need regarding a virtual address (PDE and PTE location and content), but even on systems with PAE it says nothing about the Page Directory ...
0
votes
1answer
901 views

Debugging and changing an enum value [closed]

I'm training reverse engineering and I'm creating some codes in C++ in other to reverse and see what I can do to learn. I've compiled this code: #include <iostream> enum Types { One, ...
3
votes
1answer
3k views

WinDbg Debugging without symbols

So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
5
votes
3answers
7k views

How can I view FS:[0] with windbg?

It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger. I am now using Windbg. But, I am unable to view FS (specifically FS:[0])....
1
vote
2answers
306 views

Which condition has to be met to execute this if branch

Right now I am playing around with a little training application I found on OpenSecurityTraining. So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is ...
3
votes
2answers
1k views

Manipulate EIP in Immunity Debugger

I just was playing around with Windbg, debugging some application. At some point I had to manipulate EIP which was pretty easy in Windbg. But then once I switched back to Immunity, I could not figure ...
3
votes
1answer
827 views

Windbg 'as' command in log breakpoint

I want to break the debugee as it opens a known file, using windbg. As $scmp doesn't accept direct address, I have to use as (windbg alias command). So, I put a conditional breakpoint at CreateFileA: ...
2
votes
2answers
2k views

Debugging Virtual Machine using Windbg

I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes. I was following the MSDN kernel mode debugging article, however bcdedit ...
3
votes
1answer
400 views

Prevent Windbg Log Breakpoint Fail by Memory Check

Following break point fails because of bad memory address in some situation and cause break in execution: bp 0x12345678 ".printf \"PID: %d, unkVar: %d\\n\", ..., poi(poi(ecx+1c)+8)+c;g" Is there any ...
2
votes
2answers
2k views

Windbg x64 setting breakpoint

My issue is all about setting the breakpoint on x64 Windbg. For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine. For ...
1
vote
1answer
871 views

How to get the EIP value right before WinDBG attach operation?

When WinDBG attach to a process, the EIP will point at ntdll!DbgBreakPoint in a dedicated thread different to the main process threads. Is it possible to get the EIP value right before the attach ...
3
votes
1answer
1k views

How to search for intermodular calls in WinDBG

In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG? Thanks
3
votes
1answer
683 views

Obfuscating dump files

Like in my previous question, I want to make some dump files available for learning dump analysis and reverse engineering. To organize my example programs from which I create the dumps, I give them ...