New answers tagged windbg
0
votes
how to access the initialized data in windbg through offset from IDA
I just followed the guide from blabb. In my IDA, it's Edit->Segments->Rebase program. The image base is 0x1C0000000 instead of 1C0001000. The PE has some other headers before the section headers(...
- 301
1
vote
Accepted
unable to figure out how a windbg extension work
The buffer is printed from CurrentMdl->MappedSystemVa+CurrentMdlOffset upto Size-CurrentOffset
When there is an MDLChain the data is printed for all Next->MappedSystemVa
And when posting output ...
- 16.1k
1
vote
how to stop windbg when register value changes
well if you really need to trace each execution just looking for a value in some register and willing to spend the time you can run a script recursively on each instruction
it is very time consuming ...
- 16.1k
1
vote
Accepted
how to stop windbg when register value changes
or if you know the address and need to stop only when some artifact is equal to your target value you can use conditional breakpoints
assuming you have the following code and want to break only when ...
- 16.1k
1
vote
how to stop windbg when register value changes
disassembly at an arbitrary location
0:000> u .
ntdll!RtlpFlsAlloc+0x45:
trace from here
00007ffe`988a4909 e8e2000000 call ntdll!RTL_BINARY_ARRAY<RTLP_FLS_CALLBACK_ENTRY,8,4>::...
- 16.1k
Top 50 recent answers are included