Questions tagged [windbg]

A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.

Filter by
Sorted by
Tagged with
1
vote
0answers
195 views

How to call DebugActiveProcessStop from disassembled code?

I am debugging an application. Another process is debugged by this application. Here is the call 00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>] I want to ...
2
votes
0answers
374 views

How allocate memory on Kernel mode by windbg?

How allocate memory on Kernel mode by windbg? I use .dvalloc on user mode but not working on kernel mode thanks.
1
vote
1answer
380 views

How to find status and path of the specific module with C in the windows? [duplicate]

How to find status and path of the specific module with C in the windows? such as windbg lm (list loaded module) kd> lm m cdd start end module name 93ae0000 93afe000 cdd (...
4
votes
3answers
9k views

Kernel debugging - how to set breakpoint at DriverEntry?

I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
3
votes
2answers
10k views

When to use Windbg and Ollydbg?

According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is ...
1
vote
1answer
976 views

Longest x86 Instruction [closed]

I read the recent article "Longest x86 Instruction" http://blog.onlinedisassembler.com/blog/?p=23 I attempted to reproduce the curious disassembly issue on a Win7x86 development platform using masm ...
3
votes
2answers
5k views

Why doesn't WinDbg resolve the function names?

This is definitely a beginner question but the WinDbg docs didn't help me out much because most of it is oriented around debugging programs with PDB files available. I tried .reload but it didn't have ...
4
votes
1answer
3k views

at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?

Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out. I am reverse-engineering an application which at some point ...
2
votes
0answers
787 views

Attach to specific process using IDA + WINDBG in kernel debugging

I asked this question at the StackOverflow website and they referenced me here. (Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
1
vote
1answer
333 views

Getting MSRs from Windows Crash Dump

I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is ...
5
votes
2answers
5k views

windbg: How to determine the opcode for an assembly language instruction or set of instructions

I am working on an assignment to perform an exploit using a rop chain. While I understand the basics behind rop, I don't know how to convert instructions like xchg eax, esp; retn; to their opcodes. ...
2
votes
0answers
961 views

WinDbg is unable to communicate with the target after some time

Host and target are both Windows 7 x64. The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
3
votes
1answer
1k views

Windbg: going from vftable to c++ class

As part of an assignment, I am delving into the world of Internet Explorer, and am trying to figure out exactly what class(es) are being allocated on the heap. In the mshtml!CEventObj::...
1
vote
2answers
1k views

Determining the size of an object allocated on the heap

As part of an assignment, dealing with the operation aurora vulnerability, I am supposed to determine the size of C++ classes allocated on the heap. I used: 0:017> !heap -p -a <address of the ...
2
votes
1answer
124 views

windbg refferencing symbols is inconsistent

As part of an assignment, I am trying to do some debugging in iexplore.exe (Aurora vulnerability). After I load the test webpage in iexplorer 8, I open windbg and attach to the iexplore process. I ...
1
vote
2answers
844 views

Page Directory Pointer Table in WinDbg

The !pte command in WinDbg gives all the information one may need regarding a virtual address (PDE and PTE location and content), but even on systems with PAE it says nothing about the Page Directory ...
0
votes
1answer
750 views

Debugging and changing an enum value [closed]

I'm training reverse engineering and I'm creating some codes in C++ in other to reverse and see what I can do to learn. I've compiled this code: #include <iostream> enum Types { One, ...
3
votes
1answer
3k views

WinDbg Debugging without symbols

So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
5
votes
3answers
7k views

How can I view FS:[0] with windbg?

It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger. I am now using Windbg. But, I am unable to view FS (specifically FS:[0])....
1
vote
2answers
305 views

Which condition has to be met to execute this if branch

Right now I am playing around with a little training application I found on OpenSecurityTraining. So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is ...
3
votes
2answers
1k views

Manipulate EIP in Immunity Debugger

I just was playing around with Windbg, debugging some application. At some point I had to manipulate EIP which was pretty easy in Windbg. But then once I switched back to Immunity, I could not figure ...
3
votes
1answer
792 views

Windbg 'as' command in log breakpoint

I want to break the debugee as it opens a known file, using windbg. As $scmp doesn't accept direct address, I have to use as (windbg alias command). So, I put a conditional breakpoint at CreateFileA: ...
2
votes
2answers
2k views

Debugging Virtual Machine using Windbg

I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes. I was following the MSDN kernel mode debugging article, however bcdedit ...
3
votes
1answer
389 views

Prevent Windbg Log Breakpoint Fail by Memory Check

Following break point fails because of bad memory address in some situation and cause break in execution: bp 0x12345678 ".printf \"PID: %d, unkVar: %d\\n\", ..., poi(poi(ecx+1c)+8)+c;g" Is there any ...
2
votes
2answers
2k views

Windbg x64 setting breakpoint

My issue is all about setting the breakpoint on x64 Windbg. For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine. For ...
1
vote
1answer
809 views

How to get the EIP value right before WinDBG attach operation?

When WinDBG attach to a process, the EIP will point at ntdll!DbgBreakPoint in a dedicated thread different to the main process threads. Is it possible to get the EIP value right before the attach ...
3
votes
1answer
1k views

How to search for intermodular calls in WinDBG

In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG? Thanks
3
votes
1answer
584 views

Obfuscating dump files

Like in my previous question, I want to make some dump files available for learning dump analysis and reverse engineering. To organize my example programs from which I create the dumps, I give them ...
6
votes
2answers
1k views

Removing personal data from dump file

I want to publish a crash dump on the Internet for other people to learn from the dump. Usually I take dumps with .dump /ma which is fine. However, I'm a bit concerned about personal data included in ...
9
votes
2answers
2k views

Importing list of functions and addresses into WinDbg

When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in). Since I prefer my kernel debugging with plain ...
1
vote
1answer
1k views

How exploit write access-violation to a non-null address

I have found a vulnerability that write access-violation to a non-null address, but I don't know how exploit. I know that fault, is when pass to vulnerable function a value greater than 80000001, the ...
3
votes
1answer
237 views

Help on Exploitable response

I have a crash that is exploitable, the information is this: Exploitability Classification: EXPLOITABLE Recommended Bug Title: Exploitable - User Mode Write AV starting at myfunction!mycomponet+...
3
votes
1answer
125 views

Specifying an MMX register's value in WinDbg

i am analysing a crash, the crash occurs in a function that its always on use, if set a break point in this function always stop the program. When the crash occurs, overwrite mm3 register, i want ...
13
votes
2answers
3k views

Should I switch from WinDbg to OllyDbg?

I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I ...
4
votes
2answers
2k views

Find the kernel structure that contains device name

I'm using WinDbg to try enumerate drivers and their associated devices. Getting the driver name is very easy. It is found in the _DRIVER_OBJECT structure. Unfortunately, the _DEVICE_OBJECT does not ...
2
votes
1answer
3k views

Three threads in Windows

I wrote a little program which just shows a dialog. Basically an ASM Hello World. When the dialog is displayed and I break in WinDBG, I can see three threads even though the application doesn't use ...
9
votes
2answers
1k views

What impact does noninvasive debugging have?

What impact does noninvasive user mode debugging with WinDbg have on the process? Will it be detectable by the process? Of course I could imagine that if the threads are suspended, differences in ...
1
vote
0answers
1k views

Getting info for undocumented APIs called by StartServiceCtrlDispatcher

I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
4
votes
2answers
985 views

windbg crashdump process by pid from kernel

What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do ...
7
votes
3answers
5k views

windows kernel debugging on Mac host (using VMware fusion)

in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD. now the question is, is there any possibility of doing ...
13
votes
4answers
5k views

Debugger hiding plugin for WinDbg?

Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
11
votes
5answers
6k views

How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?

I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is: Unable to enumerate locals, HRESULT 0x80004005 ...
7
votes
1answer
7k views

WinDbg fails to connect to IDA Pro debugger server

Environment: Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg Guest: Win7 SP1 x64 I have VirtualKD setup correctly in my guest and host. I say this because ...

1 2
3