Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
195
questions
0
votes
1
answer
491
views
How to set bp in a dll which loads later in pykd?
I am using pykd to debug an application which loads a dll only when some condition is met. How do I set a breakpoint in the dll which has not loaded yet in pykd such that my handler gets the callback? ...
- 2,629
0
votes
1
answer
5k
views
[windbg]kd - sxe ld <dll> from a process context won't fire
I'm trying to stop at a specific module load from a kernel debugger inside a specific process context.
What i do is to first set sxe ld [process-name] let's say calc.exe.
Now, when I run calc it ...
- 3
3
votes
0
answers
165
views
Adobe Reader JIT Pages
I use Adobe Reader XI for a little research project.
I know that Adobe use SpiderMonkey as its JS engine.
When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT)...
- 31
1
vote
0
answers
205
views
windbg stopped after I set up a breakpoint, keeping busing
I'm studying reverse engineering, I wrote the following code to see how it is to pass struct variables in the disassembly.
struct s {
int a;
int b;
int c;
};
struct s get_some_values(int ...
- 11
1
vote
1
answer
513
views
Is it possible to use an xref on memory address in IDA Pro?
Say, if I have the following disassembly:
How do I find out where else is that byte at [eax+0xFCA] is referenced? I can't seem to use the IDA's xref command on it, but doing xref on fs:18h gives me ...
- 1,639
0
votes
1
answer
651
views
TOKEN structure in Kernel
I would like to know how WinDbg extracts all the user, group, privilege information about a process from a token when given the !token 0xaddress command so I can implement it in my driver code.
...
- 395
3
votes
1
answer
2k
views
How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger to step through a WinAPI from a user-mode code. I can do all this, except that when the assembly code encounters the syscall instruction (that enters ring-0 ...
- 1,639
1
vote
2
answers
14k
views
How can I receive DbgPrint messages in windbg on windows 10
I have been googling and I feel this answer should be a simple one. I think that the keywords are however, too generic and are bringing up a lot of things related but not what I am looking for.
I am ...
- 773
3
votes
1
answer
2k
views
Resolve Addresses To Function Names
I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
- 395
5
votes
3
answers
2k
views
Faster Kernel debugging for Windows
I am Kernel debugging in Windbg and it's slow , very slow stepping through.
My current setup is using VMWARE and Windbg through a com port on the Virtual Machine.
Is there a faster way to debug the ...
- 773
0
votes
2
answers
2k
views
Understanding the output of Windbg's `dds esp`
I am not sure if I am understanding the raw output of dds esp or its 64-bit counterpart dqs rsp properly. When I see a list of entries in the stack, I tend to assume that wherever I see return ...
- 135
6
votes
1
answer
3k
views
Debugging a deadlock when the mutex owner thread is dead?
Intro
I'm facing a peculiar deadlock scenario I never saw before.
I'm trying to debug this deadlock from 3 days and couldn't find how to fix it in a proper way. Hopefully someone would help me out.
...
4
votes
2
answers
640
views
Kernel debug - internet explorer in kernelmode?
My setup: Windows 10 with windbg and target machine is Windows 7 N SP1. I'm debugging via com (i know it's slow ;).
So I get the process list with !process, one active process is Internet Explorer:
...
- 43
2
votes
1
answer
985
views
Debugging EXE File in Windbg and How to set Breakpoints in Assembly
I am trying to set a breakpoint (created in assembly) and step into an EXE file line by line to watch registers and memory behavior. I have done this easily with gdb under Linux like this.
gdb -q ./...
- 87
3
votes
2
answers
2k
views
Slow kernel dbg with VirtualBox and WinDBG
I am trying to do windows kernel debugging with VirtualBox and WinDBG. But every time I hit a breakpoint the virtual machine CPU usage skyrockets and the CPU registers do not show up in WinDBG. Am I ...
- 51
3
votes
1
answer
1k
views
How can WinDbg be used to troubleshoot program loading?
I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try ...
- 1,830
1
vote
1
answer
717
views
windows kernel debugging on Mac host (using VirtualBox)
I'm running on MacOS Sierra (version 10.12.4). And I created two virtual machine on Virtualbox (version 5.1.22).
1- Host Machine : Windows 10 Pro x64 (I installed Windows Driver kit 10)
2- Target ...
- 11
1
vote
0
answers
146
views
Using the AND operator to find a heap allocation size, Fermin's formula
I came across this technique, leveraging the HPA feature (Heap Page Allocator, known as PageHeap) in gflags from Windows debugging tools, to find the size of a heap allocation:
Lets say you have ...
- 11
3
votes
3
answers
1k
views
How to debug ServiceMain function of a service?
I have a malware which is checking for keyboard type and locale information.
After that, it creates a service with BinaryPathName as malware's exe address. After creating a service, malware starts it ...
- 131
2
votes
1
answer
5k
views
Get address of where process mapped in Windbg
I'm looking for the start address of where myfile.exe mapped into memory using Windbg.
For this I connected to a VMWare for kernel debugging through serial port, after that I run myfile.exe in guest ...
0
votes
1
answer
187
views
Using breakpoints from OllyDbg in Windbg
I found a breakpoint in OllyDbg that works for my purposes. But now I want to use WinDbg for scripting and when I try to set the same breakpoint, I get no breaks.
In OllyDbg, the following ...
- 103
1
vote
1
answer
3k
views
Problem with symbols using WinDbg
I'm using Windows 7 Service Pack 1 x64, downloaded the symbols and installed them to C:\Windows\Symbols.
I insert C:\Windows\Symbols to File > Symbol File Path ... and _NT_SYMBOL_PATH.
0:000> ....
- 11
6
votes
1
answer
2k
views
How to know which module am I currently in? (EIP/RIP pointer)
I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode:
What ...
- 1,639
1
vote
0
answers
1k
views
Symbols could not be loaded for win32k drivers
I'm doing a kernel debugging on a VmWare installed Windows 10 corporate edition (x64 version 1607 build 14393.447). I use Ida Pro 6.6 with the WinDbg plugin. On my host i have the same OS , with ...
- 153
2
votes
1
answer
6k
views
How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?
I'm using IDA Pro and WinDbg as a debugger. So I loaded an executable process into it. And now I need to know the entry point (or base address) of that loaded executable, the same as I would get from ...
- 1,639
1
vote
0
answers
97
views
How can I send a "Break" to the WinDbg backend when using IDA as a frontend?
When I use WinDbg and there's some long operation, I can press CtrlBreak to cancel the current operation (for instance, but not limited to, cancel PDB loading). Or use this:
However, whenever I use ...
- 458
2
votes
5
answers
12k
views
IDA PRO + Windows 10 + WinDbg
I didn't know That we've got a Reverse Engineering community around here :D
I am very glad on that....
anyway...
I haven't used IDA Pro for quite some time, upgraded to win 10 in the mean time.
I am ...
- 131
2
votes
1
answer
896
views
WinDbg - RVA of current instruction
Do someone know a windbg command to display the RVA of a certain instruction within it's module?
Right now, if I want to find the RVA of the current instruction, let's say, the RVA of that test eax, ...
- 337
1
vote
2
answers
2k
views
How to set breakpoint on C++ symbols?
How to set breakpoint on this C++ symbol?
bp qmgr!TokenHandle::operator-:
Could not resolve error at 'qmgr!TokenHandle::operator-:'
in windbg?
- 121
4
votes
2
answers
552
views
How to break on a clipboard operation in cmd.exe with IDA / WinDbg?
My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
- 1,639
6
votes
1
answer
4k
views
Can Windbg trace function calls within a module?
I want to log any functions within a specific module that are called during an execution.
I tried !for_each_function and wt command. However, since the target module doesn't have any symbols, !...
- 253
1
vote
1
answer
250
views
x64 Memory Pointer and Addressing modes [closed]
I'm working through example from a Windows disassembly training guide. In the exercise rax is set to a byte ptr, then rbx a word ptr. I notice the next byte of memory is skipped before rcx is to a ...
- 155
3
votes
1
answer
268
views
Win32 x86 prologue disassembly
I have the following disassembly of a function prologue with comments. I'm unclear on what the author means in this line of disassembly "lea edi,[ebp-0xcc] ; getting the lowest address of stack ...
- 155
0
votes
1
answer
143
views
how calculate size of memory that allocated from create specific windows object? [closed]
how calculate size of memory that allocated from create specific windows object
e.g.
how memory allocated when createsemaphore API is called?
there are any document that describe for all objects?
- 121
2
votes
0
answers
642
views
How get a full memory dump of a running services.exe instance?
How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
- 121
0
votes
1
answer
2k
views
How find address of specific pool allocated? [closed]
How find address of specific pool that allocated by specific tag
e.g. address of pool that allocated by CM7 tag?
thanks
- 121
3
votes
1
answer
4k
views
WinDBG. How to catch first-chance exceptions?
I have to catch first-chance exceptions occurring in user-mode application during kernel-mode debugging session.
I have written simple example application called Exceptions.exe:
int WINAPI WinMain(...
- 33
6
votes
1
answer
6k
views
Find main() function of executable with windbg
I have an executable without debug symbols, and I want to get to its' main() function.
What I do is putting breakpoint at $exentry address, but this address of some CRT-initialization. To get to the ...
- 63
2
votes
1
answer
176
views
EIP not in known module, under WOW64
I'm using WinDbg to debug a program under WOW64 (OS is x64, app is 32-bit).
I came across some indirect call inside the process module (module created by the app and not Windows), and started ...
- 45
5
votes
1
answer
6k
views
How to change address in the hex view in IDA debugger?
I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
- 1,639
4
votes
1
answer
1k
views
Unable to break at DriverEntry of malicious Driver
I got a malicious kernel mode driver from VirusTotal. Now, I am trying to debug it using Windbg.
Below are the details of the setup:
Host OS: Win 7 Ultimate 64-bit, Windbg version 6.11.x, VMWare ...
- 765
2
votes
0
answers
453
views
Buffer overrun overwrittens dynamic function table
I'm trying to reverse engineer a library function code vulnerable to a buffer overrun to properly determine both the cause and the risks associated with it, but there is a behaviour I'm not sure to ...
- 41
3
votes
1
answer
2k
views
Kernel debugging between two virtual machines not working
i want to do kernel debugging on my vm from another vm.
My setup is pretty simple,
Debugged - VM:
Windows XP SP3 x32 (To be debugged)
Debugger - VM:
Windows 7 SP1 x64 (With Windbg installed - the ...
- 668
2
votes
1
answer
625
views
Are HBGary FastDump Pro dumps compatible with WinDbg?
I have read that HBGary's FastDump Pro (FDPro) can capture kernel dumps and include the page file contents.
Although I'm not sure if the tool is still available commercially (it's not listed on the ...
- 970
2
votes
0
answers
2k
views
lm command on Windbg is not showing all modules
I'm trying to reverse-enginering a Win7 32bit legacy driver.
If I break when the system is loaded I can see that the driver is loaded because the corresponding DRIVER_OBJECT is created (!drvobj name ...
0
votes
1
answer
796
views
dps win32k!W32pServiceTable windbg command returning "????"
i want to see all graphics functions from the win32k!W32pServiceTable function pointer Array but it only returns "????"
kd> dps nt!KeServiceDescriptorTableShadow L8
8298f980 8288b73c nt!...
- 17
1
vote
2
answers
177
views
Windows 7x86 System Freezes when running assembly program with int 3h
Recently was doing some pydbg testing, so I had to remove the AeDebug entry (which determines the JIT debugger) in the registry, and Windbg was (and is) my JIT debugger. Exported the key before ...
- 368
1
vote
1
answer
970
views
Windbg breakpoint counter
I set the following breakpoint:
bp MSPTLS!LsCreateLine 100
The program crashes before the break point is hit 100 times. When I do bl after the crash, I get the following:
0 e 5dca4b62 0072 (...
- 255
3
votes
2
answers
2k
views
Did Microsoft remove the _PEB and _TEB symbols from the ntdll's debug symbols permanently?
After updating a batch of Windows updates, it seems the ntdll.dll version got bumped from 6.1.7601.188869 (modified 25/5/15) to 6.1.7601.18933 (modified 15/07/2015).
Since then, !peb, !teb, !address ...
- 51
2
votes
1
answer
448
views
Windbg Scripting Issue
Debugging an application's use of msvcrt!_read. Found a nifty Windbg script online Reversing on Windows: intercepting ReadFile that I lightly edited:
$$ Windbg script to intercept when a file is ...
- 368