Hot answers tagged

15

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs: 0:000> dg fs P Si Gr Pr Lo Sel Base Limit Type l ze an es ng Flags ---- -------- -------- ---------- - -- -- -- -- -------- 003B 7ffdf000 00000fff Data RW Ac 3 ...


10

Given your requirements, you'd be much better off sticking with WinDbg. OllyDbg doesn't do .NET, nor is it capable of directly analyzing minidumps. It does have the ability to log its run traces, but this is likely not the type of logging that you need. OdbgScript is nice, but it sounds like that's not enough of a reason for you to make the change.


8

So assuming like you said, you have the linear address of your device object, use the windbg extension !object 0xlinearaddress. Based on your windows build, it will display the linear address of the object header. Which in memory exists right below the object. Use windbg to parse the OBJECT_HEADER structure for you. Starting with Windows 7 you are going to ...


8

It is effectively true that there is no additional impact. Non-invasive debugging is simply suspending the process, and then reading the register context and memory. Since there are no alterations to the memory, there isn't any physical thing to detect. The timing discrepancies that it introduces are detectable, but the same effects can be produced by a ...


8

So how exactly do i figure out what is the remote process it is going to communicate with, or what pipe it is using to communicate? The first step is to find the RPC client interface. This can be found via the first argument to NdrClientCall2(), named pStubDescriptor. In your question, pStubDescriptor points to SspiCli!sspirpc_StubDesc: And here is how ...


8

This is more of a SW dev problem than RE, but you can try using !htrace to find out where the mutex was originally allocated (creation stack trace). Alternatively, try to figure why the thread #3 exits without releasing the lock. This may be a bit tricky, but if you can repro the two scenartios (with and without releasing the lock), differential debugging ...


8

You want VirtualKd. It is excellent and robust. http://virtualkd.sysprogs.org


7

This page contains an IDC script And a Windbg Extension to dump the names and a WinDbg extension to load those names into WinDbg. Edit To Address the comment by @OzgurH yes the idc as well as AddSyntheticSymbol are slow in fact getting a list of Names along with the boundaries from idc is tedious (also it was done in idafree 5 which isn't available for ...


7

SEH chain can be viewed in WinDbg by issuing !exchain command. 0:000> !exchain # display the SEH chain 0012ffb0: wireshark!_except_handler4+0 (00522555) 0012ffe0: kernel32!_except_handler3+0 (7c839ac0) CRT scope 0, filter: kernel32!BaseProcessStart+29 (7c843882) func: kernel32!BaseProcessStart+3a (7c843898) Invalid exception stack ...


7

Make sure if you have the correct breakpoint address issue lm an exe without symbol will be shown as 0:000> lm start end module name 00400000 0040f000 image00400000 (no symbols) compare the NtHeader->AddresssOfEntrypoint with @$exentry 0:000> r $t0 = image00400000 0:000> ?? ((ntdll!_IMAGE_NT_HEADERS *) @@( poi( @$t0 + 0x3c ...


7

no there is no shortcut loader knows only about the $exentry because it is an embedded pointer in the PeHeader from there to main is mostly traversed by either single stepping or observing and recognizing known functions by practice and experience the crt code is fairly common and the source for crt is available in crt folder of any visual studio ...


6

You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you want a 64 bit process, replace every x86 with x64): Extract ScyllaHide (download) anywhere; Run NtApiTool\x86\PDBReaderx86.exe and when it's finished, copy ...


6

It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html However, Virtual PC is extremely outdated (7 years old) and it's much easier nowadays to do VM kernel debugging with VirtualKD along with VMware or VirtualBox.


6

Right click the code, select 'New Origin here' done


6

Even the free version of IDA Pro is worth having. Finding the general structure of an unknown binary is much easier with it than with anything else. If you have an unknown DLL, it will show you which exports it has, and looking at the assembly code helps you guess the parameters. In most cases, to debug a .dll, you'll want to write a small program to call ...


6

0072 (0100) : 0072 - this is the number of passes remaining before the breakpoint is hit. (0100) - this is the original limit passed in. Note that these are hexidecimal values, so the crash was hit on the 142nd iteration (0x100-0x72). 0x80 is smaller than 142 (0x8E), so it expected that you would hit the breakpoint before the crash with that setting. ...


6

Try "break on module load" (e.g. sxe ld malicious_driver.sys). When it's hit, you can check the driver's load address and set breakpoint by address.


6

Click on the hex view plane and press G to change the address.


6

The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd. The Windbg plugin is very similar to IDA Pro's Win32 debugger plugin, nonetheless by using The Windbg plugin, one can benefit from the command line facilities and the extensions that ship with the debugging tools. For ...


6

they are supported if you add the special escape sequence @!" symbol " make sure you set a resolved breakpoints not an unresolved one and be aware a single address may point to several instantiations of these classes windbg version Microsoft (R) Windows Debugger Version 10.0.17744.1001 X86 lets look for some functions with angle brackets in them 0:...


5

Extended Base Pointer, as the name suggests, is usually used as a frame pointer. That, among other things, means that it's used to access function parameters and local variables. If you think about how stack works, you can conclude the following: local variables will be on the negative offset from the base pointer address in the frame pointer will be the ...


5

you can try breaking on driver load instead on just the entry: sxe ld drv.sys This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else fails.


5

VirtualQueryEx() is the way to go if you want a memory map of a target process. However, if you want information about modules only, you can extract it from the PEB of the target process. Get the PEB address using NtQueryInformationProcess, using ProcessBasicInformation for the ProcessInformationClass, so it writes a PROCESS_BASIC_INFORMATION. This ...


5

opening calc.exe in windbg windbg calc skipping all the ldrint system calls bp calc!WinMain ; g tracing only calc module from eip to some specific address and printing the return values (please note using arbitrary values as EndAddress may possibly corrupt the code by inserting 0xcc in middle of instruction ) 0:000> wt -l 2 -oR -m calc =@...


5

I just set 465 bps in no time 0:000> bl 0:000> .foreach ( place { !showexports ollydbg } ) { bp place } 0:000> bl "*z*" 0 e Disable Clear 00406938 0001 (0001) 0:**** ollydbg!Absolutizepath 118 e Disable Clear 004a9274 0001 (0001) 0:**** ollydbg!Finalizetaggedfile 206 e Disable Clear 004a8e1c 0001 (0001) 0:**** ...


5

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.


5

It seems the correct term is Critical System Service. There are API from userland but I can't find anything for the kernel. So I took a quick look into the RstrtMgr.dll and it seems the list is actually hardcoded... For the processes: system32\csrss.exe system32\smss.exe system32\lsass.exe system32\wininit.exe system32\logonui.exe system32\services.exe ...


4

Kernel Debugging with VMWare Fusion Power on the target VM, in an elevated command prompt: bcdedit /debug on bcdedit /dbgsettings serial debugport:1 baudrate:115200 Power off both the target (debuggee) and development (debugger) VMs. Navigate to the .vmwarevm package for each VM, right click, select "Show Package Contents" (or cd into the VM's package)...


4

RTA is an easy to use tool that allows you to enter either opcodes or mnemonics and will convert them from one to the other. In the example below, I entered XCHG EAX,ESP and RETN on the right, and RTA produced 94 and C3 on the left: If, on the other hand, you really want to use WinDbg, then you need to do the following: Load a target into WinDbg Type a, ...


4

WinDbg uses debugging information (pdb/symbol files) for debugging. So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb Yes. Symbols are one of Windbg's main strength, but it can also debug anything without symbolic information. Is WinDbg best suited to analyze memory dumps and crash issues only? Once ...


Only top voted, non community-wiki answers of a minimum length are eligible