9
votes
Accepted
Faster Kernel debugging for Windows
You want VirtualKd. It is excellent and robust.
http://virtualkd.sysprogs.org
- 216
8
votes
Accepted
Find main() function of executable with windbg
no there is no shortcut loader knows only about the $exentry because it is an embedded pointer in the PeHeader
from there to main is mostly traversed by either single stepping or observing and ...
- 16.3k
8
votes
Accepted
How to change address in the hex view in IDA debugger?
Click on the hex view plane and press G to change the address.
- 1,759
8
votes
Accepted
Debugging a deadlock when the mutex owner thread is dead?
This is more of a SW dev problem than RE, but you can try using !htrace to find out where the mutex was originally allocated (creation stack trace).
Alternatively, try to figure why the thread #3 ...
- 36.4k
7
votes
Accepted
Unable to break at DriverEntry of malicious Driver
Try "break on module load" (e.g. sxe ld malicious_driver.sys). When it's hit, you can check the driver's load address and set breakpoint by address.
- 36.4k
7
votes
Tracing function calls in x64dbg
It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which ...
- 3,369
6
votes
Debugger hiding plugin for WinDbg?
You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
- 1,652
6
votes
WinDbg: Setting a breakpoint on every EXPORTED function of a module
I just set 465 bps in no time
0:000> bl
0:000> .foreach ( place { !showexports ollydbg } ) { bp place }
0:000> bl "*z*"
0 e Disable Clear 00406938 0001 (0001) 0:**** ollydbg!...
- 16.3k
6
votes
What is the difference between Windbg and local debugger in IDA
The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd.
The Windbg plugin is very similar to IDA Pro's Win32 ...
- 355
6
votes
Accepted
Are some special chars(<>) in function names not supported by windbg/cdb?
they are supported if you add the special escape sequence @!" symbol "
make sure you set a resolved breakpoints not an unresolved one
and be aware a single address may point to several ...
- 16.3k
6
votes
Accepted
Detecting protected processes and critical processes from windows driver
It seems the correct term is Critical System Service. There are API from userland but I can't find anything for the kernel. So I took a quick look into the RstrtMgr.dll and it seems the list is ...
- 1,124
6
votes
x64dbg (x32dbg) log registers every step like windbg
There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com.
In this ...
- 1,652
6
votes
Accepted
5
votes
Accepted
Can Windbg trace function calls within a module?
opening calc.exe in windbg
windbg calc
skipping all the ldrint system calls
bp calc!WinMain ; g
tracing only calc module from eip to some specific address and printing the return values
(...
- 16.3k
5
votes
Accepted
Can I set more than 4 memory access breakpoints in WinDbg?
Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
- 4,912
5
votes
How to configure IDA to load .pdb files from Microsoft public symbol server?
It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is:
Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables
Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set ...
- 151
4
votes
Accepted
WinDBG. How to catch first-chance exceptions?
In WinDbg: !gflag +soe
You can see http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions for more details.
- 20.7k
4
votes
Accepted
How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?
You need to switch to a different command line. Currently, you're using the WinDbg command line, which allows you to send commands to WinDbg instead of IDAPython:
Click on WinDbg, or press Ctrl↑ to ...
- 458
4
votes
Accepted
How to set breakpoint on C++ symbols?
Make sure your symbol is correct
Couldn't resolve means the symbol doesn't exist
first confirm with x /f /v (f shows only functions and v shows verbose information )
next set breakpoint on the symbol ...
- 16.3k
4
votes
Accepted
How can WinDbg be used to troubleshoot program loading?
I would suggest you to put a breakpoint on NtCreateSection function which is responsible on validating and mapping the PE image when called with SEC_IMAGE flag. Hopefully you can track down where it ...
- 36.4k
4
votes
Faster Kernel debugging for Windows
GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging.
The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4.
Around 34 min in the stream 1 he mentions ...
- 4,912
4
votes
Accepted
Resolve Addresses To Function Names
i dont know if i understood your query correctly but if you want to log the function names that are passed to getproc address you can log them like this in windbg
C:\>cdb calc
Microsoft (R) ...
- 16.3k
4
votes
Windbg .thread command is useless?
It works As Expected and Documented
Running a plain .thread resets context to CurrentThread as documented
Quote From Documentation
Thread
The address of the thread. If this is omitted or zero,
...
- 16.3k
4
votes
Accepted
WinDBG Hung on Shellcode Execution
can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ?
if that is the case then it means you allocate memory etc ...
- 16.3k
3
votes
Accepted
WinDbg - RVA of current instruction
put this is some txt file and save it somewhere like c:\myrva.txt
.foreach ( place { lm1ma ${$arg1} } ){ .printf "Rva for input is %x\n", ${$arg1}-${place} }
and use it like
0:000> $$>a< ...
- 16.3k
3
votes
How to set breakpoint on C++ symbols?
It looks like you have an extra colon at the end of your string (operator-:) and you may need to use bm instead of bp.
class TokenHandle
{
public:
int data;
TokenHandle(int i)
{
...
- 851
3
votes
Accepted
How to know which module am I currently in? (EIP/RIP pointer)
The top right window, the registers window, shows where each register points to and includes the module name of there is one. EIP is not shown in the picture but if you'll scroll down or resize it you'...
- 11.7k
3
votes
Accepted
how calculate size of memory that allocated from create specific windows object?
The allocation for most executive objects (like semaphores) is done inside the ObCreateObject() function. As you can see in ObCreateObject()'s prototype, one of the parameters is ObjectSizeToAllocate.
...
- 20.7k
3
votes
Accepted
How find address of specific pool allocated?
In WinDbg, you can use the !poolfind command:
The !poolfind extension finds all instances of a specific pool tag in
either nonpaged or paged memory pools.
...
kd> !poolfind SeSd 0
...
- 20.7k
3
votes
How to break on a clipboard operation in cmd.exe with IDA / WinDbg?
The actual console window is drawn and managed by conhost.exe, not cmd.exe.
- 36.4k
Only top scored, non community-wiki answers of a minimum length are eligible