Questions tagged [windbg]
A graphical stand-alone multipurpose debugger for Microsoft Windows, distributed on the web by Microsoft.
195
questions
5
votes
3
answers
598
views
Is there a tool to see kernel space mapping of a Windows exe?
In Microsoft Windows, a 32bits process calc.exe has 0x0-0x80000000 (2GB) reserved as its user-space and the rest is kernel-space (2GB). So, a process has 2+2 = 4GB of virtual space. This ratio could ...
- 391
0
votes
2
answers
2k
views
Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?
I can access the FS:[0h] which points to the SEH chain but cannot do the same for other segment registers.What is the reason for it ?
Also,I was debugging an exe which has PTRD at 0x600 and AEP at ...
- 391
1
vote
0
answers
212
views
How to call DebugActiveProcessStop from disassembled code?
I am debugging an application. Another process is debugged by this application.
Here is the call
00705435 FF15 C0007500 CALL DWORD PTR DS [<&KERNEL32.ContinueDebugEvent>]
I want to ...
- 11
2
votes
0
answers
484
views
How allocate memory on Kernel mode by windbg?
How allocate memory on Kernel mode by windbg?
I use .dvalloc on user mode but not working on kernel mode
thanks.
- 121
1
vote
1
answer
568
views
How to find status and path of the specific module with C in the windows? [duplicate]
How to find status and path of the specific module with C in the windows?
such as windbg lm (list loaded module)
kd> lm m cdd
start end module name
93ae0000 93afe000 cdd (...
- 121
5
votes
3
answers
12k
views
Kernel debugging - how to set breakpoint at DriverEntry?
I'm sorry for my bad English. I'm a beginner in Reverse Engineering. I have a problem like this. I was given two files, one is driver's .inf file and the other is driver's .sys file. My mission is to ...
- 53
4
votes
2
answers
11k
views
When to use Windbg and Ollydbg?
According to what I know :WinDbg uses debugging information (pdb/symbol files) for debugging.So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb. Is ...
- 391
1
vote
1
answer
1k
views
Longest x86 Instruction [closed]
I read the recent article "Longest x86 Instruction"
http://blog.onlinedisassembler.com/blog/?p=23
I attempted to reproduce the curious disassembly issue on a Win7x86 development platform using masm ...
- 368
3
votes
2
answers
7k
views
Why doesn't WinDbg resolve the function names?
This is definitely a beginner question but the WinDbg docs didn't help me out much because most of it is oriented around debugging programs with PDB files available. I tried .reload but it didn't have ...
- 31
7
votes
1
answer
4k
views
at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?
Hey i have a very time consuming problem, and i thought i might find someone here with better experience than mine that could help me out.
I am reverse-engineering an application which at some point ...
- 668
2
votes
0
answers
868
views
Attach to specific process using IDA + WINDBG in kernel debugging
I asked this question at the StackOverflow website and they referenced me here.
(Previous topic: https://stackoverflow.com/questions/27917592/attach-to-specific-process-using-ida-windbg-in-kernel-...
- 668
1
vote
1
answer
424
views
Getting MSRs from Windows Crash Dump
I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is ...
- 1,022
5
votes
2
answers
6k
views
windbg: How to determine the opcode for an assembly language instruction or set of instructions
I am working on an assignment to perform an exploit using a rop chain.
While I understand the basics behind rop, I don't know how to convert instructions like
xchg eax, esp; retn;
to their opcodes.
...
- 379
2
votes
0
answers
1k
views
WinDbg is unable to communicate with the target after some time
Host and target are both Windows 7 x64.
The session goes well, but sometimes after 15-20 minutes the target freezes (like a break point was hit), but WinDbg reports that the debuggee is running and it ...
- 317
3
votes
1
answer
2k
views
Windbg: going from vftable to c++ class
As part of an assignment, I am delving into the world of Internet Explorer, and am trying to figure out exactly what class(es) are being allocated on the heap.
In the mshtml!CEventObj::...
- 379
1
vote
2
answers
2k
views
Determining the size of an object allocated on the heap
As part of an assignment, dealing with the operation aurora vulnerability, I am supposed to determine the size of C++ classes allocated on the heap.
I used:
0:017> !heap -p -a <address of the ...
- 379
2
votes
1
answer
142
views
windbg refferencing symbols is inconsistent
As part of an assignment, I am trying to do some debugging in iexplore.exe (Aurora vulnerability).
After I load the test webpage in iexplorer 8, I open windbg and attach to the iexplore process.
I ...
- 379
1
vote
2
answers
1k
views
Page Directory Pointer Table in WinDbg
The !pte command in WinDbg gives all the information one may need regarding a virtual address (PDE and PTE location and content), but even on systems with PAE it says nothing about the Page Directory ...
- 317
0
votes
1
answer
1k
views
Debugging and changing an enum value [closed]
I'm training reverse engineering and I'm creating some codes in C++ in other to reverse and see what I can do to learn.
I've compiled this code:
#include <iostream>
enum Types
{
One,
...
- 101
3
votes
1
answer
3k
views
WinDbg Debugging without symbols
So I am trying to learn how to debug files that I don't have the symbol files for. The most common advice is to issue bp $exentry or bu @$exentry. However, neither of these work. Once I g the ...
- 665
5
votes
3
answers
8k
views
How can I view FS:[0] with windbg?
It seems that Windows 8 broke Ollydbg as several ntdll functions keep throwing exception 0xC0000008 and crashing my debugger.
I am now using Windbg. But, I am unable to view FS (specifically FS:[0])....
- 165
1
vote
2
answers
312
views
Which condition has to be met to execute this if branch
Right now I am playing around with a little training application I found on OpenSecurityTraining.
So, I analyzed this code and I think I understand this pretty well. The only thing I don't get is ...
- 443
4
votes
2
answers
2k
views
Manipulate EIP in Immunity Debugger
I just was playing around with Windbg, debugging some application.
At some point I had to manipulate EIP which was pretty easy in Windbg. But then once I switched back to Immunity, I could not figure ...
- 443
3
votes
1
answer
924
views
Windbg 'as' command in log breakpoint
I want to break the debugee as it opens a known file, using windbg. As $scmp doesn't accept direct address, I have to use as (windbg alias command). So, I put a conditional breakpoint at CreateFileA:
...
- 291
2
votes
2
answers
2k
views
Debugging Virtual Machine using Windbg
I am trying to connect to a Windows XP Professional Virtual Machine running under Microsoft Virtual PC for debugging purposes.
I was following the MSDN kernel mode debugging article, however bcdedit ...
- 143
3
votes
1
answer
424
views
Prevent Windbg Log Breakpoint Fail by Memory Check
Following break point fails because of bad memory address in some situation and cause break in execution:
bp 0x12345678 ".printf \"PID: %d, unkVar: %d\\n\", ..., poi(poi(ecx+1c)+8)+c;g"
Is there any ...
- 291
2
votes
2
answers
3k
views
Windbg x64 setting breakpoint
My issue is all about setting the breakpoint on x64 Windbg.
For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine.
For ...
- 23
1
vote
1
answer
1k
views
How to get the EIP value right before WinDBG attach operation?
When WinDBG attach to a process, the EIP will point at ntdll!DbgBreakPoint in a dedicated thread different to the main process threads.
Is it possible to get the EIP value right before the attach ...
- 111
3
votes
1
answer
1k
views
How to search for intermodular calls in WinDBG
In Olly/Immunity Debugger, I can search for "All intermodular calls". Is there a way to do this using WinDBG?
Thanks
- 31
3
votes
1
answer
845
views
Obfuscating dump files
Like in my previous question, I want to make some dump files available for learning dump analysis and reverse engineering.
To organize my example programs from which I create the dumps, I give them ...
- 970
6
votes
2
answers
1k
views
Removing personal data from dump file
I want to publish a crash dump on the Internet for other people to learn from the dump. Usually I take dumps with .dump /ma which is fine.
However, I'm a bit concerned about personal data included in ...
- 970
9
votes
2
answers
2k
views
Importing list of functions and addresses into WinDbg
When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in).
Since I prefer my kernel debugging with plain ...
- 193
2
votes
1
answer
1k
views
How exploit write access-violation to a non-null address
I have found a vulnerability that write access-violation to a non-null address, but I don't know how exploit.
I know that fault, is when pass to vulnerable function a value greater than 80000001, the ...
- 95
3
votes
1
answer
271
views
Help on Exploitable response
I have a crash that is exploitable, the information is this:
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at myfunction!mycomponet+...
- 95
3
votes
1
answer
137
views
Specifying an MMX register's value in WinDbg
i am analysing a crash, the crash occurs in a function that its always on use, if set a break point in this function always stop the program.
When the crash occurs, overwrite mm3 register, i want ...
- 95
13
votes
2
answers
3k
views
Should I switch from WinDbg to OllyDbg?
I am fairly familiar with WinDbg and didn't know about OllyDbg before. From the statistics in this forum, it seems that OllyDbg is twice as popular as WinDbg. Sometimes WinDbg can be frustrating, so I ...
- 970
4
votes
2
answers
2k
views
Find the kernel structure that contains device name
I'm using WinDbg to try enumerate drivers and their associated devices. Getting the driver name is very easy. It is found in the _DRIVER_OBJECT structure. Unfortunately, the _DEVICE_OBJECT does not ...
- 323
3
votes
1
answer
3k
views
Three threads in Windows
I wrote a little program which just shows a dialog. Basically an ASM Hello World. When the dialog is displayed and I break in WinDBG, I can see three threads even though the application doesn't use ...
- 963
10
votes
2
answers
1k
views
What impact does noninvasive debugging have?
What impact does noninvasive user mode debugging with WinDbg have on the process?
Will it be detectable by the process?
Of course I could imagine that if the threads are suspended, differences in ...
- 970
2
votes
0
answers
2k
views
Getting info for undocumented APIs called by StartServiceCtrlDispatcher
I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# ...
- 325
5
votes
2
answers
1k
views
windbg crashdump process by pid from kernel
What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do ...
- 51
8
votes
3
answers
6k
views
windows kernel debugging on Mac host (using VMware fusion)
in windows host we can use WinDBG and serial port communication for connection to windows kernel and the most easiest way is using VirtualKD.
now the question is, is there any possibility of doing ...
- 581
14
votes
4
answers
7k
views
Debugger hiding plugin for WinDbg?
Are there any good WinDbg hiding plugins like OllyDbg's? Or a plugin that's open source and still in development for this purpose?
- 685
12
votes
5
answers
6k
views
How do I see the parameters passed to RegOpenKeyEx, and set a conditional breakpoint?
I have WinDbg attached to a process I don't have the source code for. I've set a breakpoint with bm ADVAPI32!_RegOpenKeyExW@20. The output of dv is:
Unable to enumerate locals, HRESULT 0x80004005
...
- 325
8
votes
1
answer
8k
views
WinDbg fails to connect to IDA Pro debugger server
Environment:
Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg
Guest: Win7 SP1 x64
I have VirtualKD setup correctly in my guest and host.
I say this because ...
