Hot answers tagged

15 votes

How can I view FS:[0] with windbg?

If you're looking to find the base address of a segment based on its selector, you can use dg<selector>; in this context you would use dg fs: 0:000> dg fs P ...
user avatar
9 votes
Accepted

at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?

So how exactly do i figure out what is the remote process it is going to communicate with, or what pipe it is using to communicate? The first step is to find the RPC client interface. This can be ...
user avatar
8 votes
Accepted

Debugging a deadlock when the mutex owner thread is dead?

This is more of a SW dev problem than RE, but you can try using !htrace to find out where the mutex was originally allocated (creation stack trace). Alternatively, try to figure why the thread #3 ...
user avatar
  • 34.8k
8 votes
Accepted

Faster Kernel debugging for Windows

You want VirtualKd. It is excellent and robust. http://virtualkd.sysprogs.org
user avatar
7 votes

WinDbg Debugging without symbols

Make sure if you have the correct breakpoint address issue lm an exe without symbol will be shown as 0:000> lm start end module name 00400000 0040f000 image00400000 (no symbols) ...
user avatar
  • 14.9k
7 votes
Accepted

How can I view FS:[0] with windbg?

SEH chain can be viewed in WinDbg by issuing !exchain command. 0:000> !exchain # display the SEH chain 0012ffb0: wireshark!_except_handler4+0 (00522555) 0012ffe0: kernel32!_except_handler3+0 (...
user avatar
  • 595
7 votes
Accepted

Find main() function of executable with windbg

no there is no shortcut loader knows only about the $exentry because it is an embedded pointer in the PeHeader from there to main is mostly traversed by either single stepping or observing and ...
user avatar
  • 14.9k
6 votes

Debugger hiding plugin for WinDbg?

You can use ScyllaHide. There are plugins for many debuggers, but it is also possible to use InjectorCLI.exe to inject ScyllaHide into any process. Here are the steps (for a 32 bit process, if you ...
user avatar
  • 1,602
6 votes
Accepted

Debugging Virtual Machine using Windbg

It has been a while since I've used Virtual PC, but I remember the instructions in this guide worked well: http://silverstr.ufies.org/lotr0/windbg-vmware.html However, Virtual PC is extremely ...
user avatar
6 votes
Accepted

Manipulate EIP in Immunity Debugger

Right click the code, select 'New Origin here' done
user avatar
  • 2,265
6 votes
Accepted

When to use Windbg and Ollydbg?

Even the free version of IDA Pro is worth having. Finding the general structure of an unknown binary is much easier with it than with anything else. If you have an unknown DLL, it will show you which ...
user avatar
6 votes
Accepted

Windbg breakpoint counter

0072 (0100) : 0072 - this is the number of passes remaining before the breakpoint is hit. (0100) - this is the original limit passed in. Note that these are hexidecimal values, so the crash was hit ...
user avatar
6 votes
Accepted

Unable to break at DriverEntry of malicious Driver

Try "break on module load" (e.g. sxe ld malicious_driver.sys). When it's hit, you can check the driver's load address and set breakpoint by address.
user avatar
  • 34.8k
6 votes
Accepted

How to change address in the hex view in IDA debugger?

Click on the hex view plane and press G to change the address.
user avatar
  • 1,731
6 votes

What is the difference between Windbg and local debugger in IDA

The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine (dbgeng) that is used by Windbg, Cdb or Kd. The Windbg plugin is very similar to IDA Pro's Win32 ...
user avatar
  • 313
6 votes
Accepted

Are some special chars(<>) in function names not supported by windbg/cdb?

they are supported if you add the special escape sequence @!" symbol " make sure you set a resolved breakpoints not an unresolved one and be aware a single address may point to several ...
user avatar
  • 14.9k
5 votes

Kernel debugging - how to set breakpoint at DriverEntry?

you can try breaking on driver load instead on just the entry: sxe ld drv.sys This will stop windbg when the image gets loaded, so you'll be able to set breakpoints using raw addresses if all else ...
user avatar
  • 34.8k
5 votes
Accepted

Which condition has to be met to execute this if branch

Extended Base Pointer, as the name suggests, is usually used as a frame pointer. That, among other things, means that it's used to access function parameters and local variables. If you think about ...
user avatar
  • 4,624
5 votes

How to find status and path of the specific module with C in the windows?

VirtualQueryEx() is the way to go if you want a memory map of a target process. However, if you want information about modules only, you can extract it from the PEB of the target process. Get the ...
user avatar
  • 578
5 votes
Accepted

Why can I access FS:[0] in OllyDbg but not offsets to CS,DS,SS?

In Windows, the total space the process is intended to see is the same in the CS, DS, and SS registers. Windows makes the executable file, as well as any DLLs, open files, allocated memory segments, ...
user avatar
5 votes
Accepted

Can Windbg trace function calls within a module?

opening calc.exe in windbg windbg calc skipping all the ldrint system calls bp calc!WinMain ; g tracing only calc module from eip to some specific address and printing the return values (...
user avatar
  • 14.9k
5 votes

WinDbg: Setting a breakpoint on every EXPORTED function of a module

I just set 465 bps in no time 0:000> bl 0:000> .foreach ( place { !showexports ollydbg } ) { bp place } 0:000> bl "*z*" 0 e Disable Clear 00406938 0001 (0001) 0:**** ollydbg!...
user avatar
  • 14.9k
5 votes
Accepted

Can I set more than 4 memory access breakpoints in WinDbg?

Those are called hardware breakpoints and are related to debug registers in the CPU. There are usually 6 of them but only DR0-DR3 used to specify an address for hardware breakpoints.
user avatar
5 votes
Accepted

Detecting protected processes and critical processes from windows driver

It seems the correct term is Critical System Service. There are API from userland but I can't find anything for the kernel. So I took a quick look into the RstrtMgr.dll and it seems the list is ...
user avatar
  • 1,074
5 votes

How to configure IDA to load .pdb files from Microsoft public symbol server?

It seems IDA recognizes _NT_SYMBOL_PATH so all you only need to is: Start -> RUN -> RUNDLL32 sysdm.cpl,EditEnvironmentVariables Under "System variables", add an entry named "_NT_SYMBOL_PATH" and set ...
user avatar
5 votes

x64dbg (x32dbg) log registers every step like windbg

There is no such functionality in x64dbg out of the box, but we can make your own by writing a plugin! There are many examples (often with source code) available on http://plugins.x64dbg.com. In this ...
user avatar
  • 1,602
4 votes
Accepted

windbg: How to determine the opcode for an assembly language instruction or set of instructions

RTA is an easy to use tool that allows you to enter either opcodes or mnemonics and will convert them from one to the other. In the example below, I entered XCHG EAX,ESP and RETN on the right, and ...
user avatar
4 votes

When to use Windbg and Ollydbg?

WinDbg uses debugging information (pdb/symbol files) for debugging. So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb Yes. Symbols are one of Windbg'...
user avatar
  • 402
4 votes
Accepted

Windbg Scripting Issue

The first four bytes of the file (77 30 30 66) will be read into @$t5 in little-endian format. So .if(@$t5 == 0x77303066) should be .if(@$t5 == 0x66303077).
user avatar
4 votes
Accepted

WinDBG. How to catch first-chance exceptions?

In WinDbg: !gflag +soe You can see http://www.openrce.org/blog/view/1564/Kernel_debugger_vs_user_mode_exceptions for more details.
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible