Skip to main content
10 votes
Accepted

Faster Kernel debugging for Windows

You want VirtualKd. It is excellent and robust. http://virtualkd.sysprogs.org
Elias Bachaalany's user avatar
8 votes
Accepted

Debugging a deadlock when the mutex owner thread is dead?

This is more of a SW dev problem than RE, but you can try using !htrace to find out where the mutex was originally allocated (creation stack trace). Alternatively, try to figure why the thread #3 ...
Igor Skochinsky's user avatar
  • 36.8k
7 votes

Tracing function calls in x64dbg

It is possible using Trace->Trace into... option. After opening the executable, select this option and specify the message you want to log (in Log text field); for example {a:cip} {i:cip}, which ...
bart1e's user avatar
  • 3,409
6 votes

Debugger hiding plugin for WinDbg?

You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
mrexodia's user avatar
  • 1,652
6 votes

WinDbg: Setting a breakpoint on every EXPORTED function of a module

I just set 465 bps in no time 0:000> bl 0:000> .foreach ( place { !showexports ollydbg } ) { bp place } 0:000> bl "*z*" 0 e Disable Clear 00406938 0001 (0001) 0:**** ollydbg!...
blabb's user avatar
  • 16.4k
6 votes

What is the difference between Windbg and local debugger in IDA

The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd. The Windbg plugin is very similar to IDA Pro's Win32 ...
user22363's user avatar
  • 365
6 votes
Accepted

Are some special chars(<>) in function names not supported by windbg/cdb?

they are supported if you add the special escape sequence @!" symbol " make sure you set a resolved breakpoints not an unresolved one and be aware a single address may point to several ...
blabb's user avatar
  • 16.4k
6 votes
Accepted

Detecting protected processes and critical processes from windows driver

It seems the correct term is Critical System Service. There are API from userland but I can't find anything for the kernel. So I took a quick look into the RstrtMgr.dll and it seems the list is ...
wisk's user avatar
  • 1,154
6 votes

x64dbg (x32dbg) log registers every step like windbg

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this ...
mrexodia's user avatar
  • 1,652
6 votes
Accepted

How to disassemble an entire function in Windbg?

uf foo!blah unassemble full function
blabb's user avatar
  • 16.4k
5 votes
Accepted

Can Windbg trace function calls within a module?

opening calc.exe in windbg windbg calc skipping all the ldrint system calls bp calc!WinMain ; g tracing only calc module from eip to some specific address and printing the return values (...
blabb's user avatar
  • 16.4k
5 votes
Accepted

Can I set more than 4 memory access breakpoints in WinDbg?

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
Paweł Łukasik's user avatar
5 votes

How to configure IDA to load .pdb files from Microsoft public symbol server?

It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is: Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set ...
Steven Liang's user avatar
4 votes
Accepted

How can WinDbg be used to troubleshoot program loading?

I would suggest you to put a breakpoint on NtCreateSection function which is responsible on validating and mapping the PE image when called with SEC_IMAGE flag. Hopefully you can track down where it ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes
Accepted

How to set breakpoint on C++ symbols?

Make sure your symbol is correct Couldn't resolve means the symbol doesn't exist first confirm with x /f /v (f shows only functions and v shows verbose information ) next set breakpoint on the symbol ...
blabb's user avatar
  • 16.4k
4 votes
Accepted

How to get a entry point of loaded process with IDA Pro and WinDbg as a debugger?

You need to switch to a different command line. Currently, you're using the WinDbg command line, which allows you to send commands to WinDbg instead of IDAPython: Click on WinDbg, or press Ctrl↑ to ...
Martin's user avatar
  • 468
4 votes

Faster Kernel debugging for Windows

GynvaelColdwind had invited honorary_bot who had 4 streams about Kernel Debugging. The videos can be found here: Stream 1, Stream 2, Stream 3, Stream 4. Around 34 min in the stream 1 he mentions ...
Paweł Łukasik's user avatar
4 votes
Accepted

Resolve Addresses To Function Names

i dont know if i understood your query correctly but if you want to log the function names that are passed to getproc address you can log them like this in windbg C:\>cdb calc Microsoft (R) ...
blabb's user avatar
  • 16.4k
4 votes

Windbg .thread command is useless?

It works As Expected and Documented Running a plain .thread resets context to CurrentThread as documented Quote From Documentation Thread The address of the thread. If this is omitted or zero, ...
blabb's user avatar
  • 16.4k
4 votes
Accepted

WinDBG Hung on Shellcode Execution

can you clarify if the error you are getting is related to message that says this may be caused by another thread holding the LoaderLock ? if that is the case then it means you allocate memory etc ...
blabb's user avatar
  • 16.4k
3 votes

Understanding the output of Windbg's `dds esp`

The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't. If stack-frames are omitted, then it becomes very difficult to trace backwards without ...
peter ferrie's user avatar
  • 4,709
3 votes

Slow kernel dbg with VirtualBox and WinDBG

You should try VirtualKD which uses a fast VM-specific mechanism to communicate with the debugger instead of slow serial port emulation. Another option could be Ethernet or USB-based debugging but I'm ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

WinDbg - RVA of current instruction

put this is some txt file and save it somewhere like c:\myrva.txt .foreach ( place { lm1ma ${$arg1} } ){ .printf "Rva for input is %x\n", ${$arg1}-${place} } and use it like 0:000> $$>a< ...
blabb's user avatar
  • 16.4k
3 votes

How to set breakpoint on C++ symbols?

It looks like you have an extra colon at the end of your string (operator-:) and you may need to use bm instead of bp. class TokenHandle { public: int data; TokenHandle(int i) { ...
josh poley's user avatar
3 votes
Accepted

How to know which module am I currently in? (EIP/RIP pointer)

The top right window, the registers window, shows where each register points to and includes the module name of there is one. EIP is not shown in the picture but if you'll scroll down or resize it you'...
NirIzr's user avatar
  • 11.8k
3 votes

How to break on a clipboard operation in cmd.exe with IDA / WinDbg?

The actual console window is drawn and managed by conhost.exe, not cmd.exe.
Igor Skochinsky's user avatar
  • 36.8k
3 votes
Accepted

x64 Memory Pointer and Addressing modes

The main reason to align the data is for performance (some architectures will fault on misaligned data, but since you tagged this with windbg, we will assume amd/intel x64 + windows). Quoting from ...
josh poley's user avatar
3 votes
Accepted

how calculate size of memory that allocated from create specific windows object?

The allocation for most executive objects (like semaphores) is done inside the ObCreateObject() function. As you can see in ObCreateObject()'s prototype, one of the parameters is ObjectSizeToAllocate. ...
Jason Geffner's user avatar
3 votes
Accepted

How to step into kernel code from a user-mode code using IDA Pro and WinDbg as a debugger?

In order to step into syscall you must debug your machine from kernel mode debugger. https://www.hex-rays.com/products/ida/support/tutorials/debugging_windbg.pdf see Debugging the kernel with VMWare ...
Anton Kukoba's user avatar
  • 1,850
3 votes

Is it possible to use an xref on memory address in IDA Pro?

IDA's xref functionality only works for static references. The references it detects by statically analyzing the code. It cannot find any dynamic or runtime references to addresses using the xref ...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible