Questions tagged [windbg]
WinDbg is a user and kernel mode debugger for Windows. It can be used to debug both native and managed code.
2,848
questions
0
votes
1
answer
32
views
Windbg shows info dialog that it cannot open MFC source file from devdiv.visualstudio.com
Windbg 10.0.20348.1 shows this info dialog with below message when single stepping through MFC code:
The file 'https://devdiv.visualstudio.com/DevDiv/_apis/git/repositories/msvc/items?path=src/vctools/...
0
votes
0
answers
24
views
How to analyse unmanged memory of DotNet Process from Dump
I've a problem at a customer that our netcore applications grows in memory size to over 11GB. (it will grow larger and crash with out of memory exception)
We now created a procdump before we restarted ...
0
votes
0
answers
54
views
Driver causing a system crash every time unloaded
The driver I wrote is taken from the Windows Kernel Programming book but for some reason it just doesn't work.
Here is my driver entry:
extern "C" NTSTATUS DriverEntry(PDRIVER_OBJECT ...
0
votes
0
answers
13
views
du <address> shows empty for dotnet string content in WinDbg? [duplicate]
I am analyzing a memory dump file from a dotnet core process.
0:000> !DumpObj /d 000002037237a720
Name: System.String
MethodTable: 00007ffee91dd698
EEClass: 00007ffee91b9d60
Tracked Type:...
0
votes
0
answers
115
views
How to intercept the database file used by a Delphi application?
I have entered data into a Delphi application for analysis, but the application exports the data into a messed up comma separated file (CSV). It does not export a database file.
I looked at the ...
1
vote
0
answers
24
views
Windbg Preview won't break into target computer
I have setup a hyper v virtual machine and configured it as a target machine,
I followed this guide:
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/attaching-to-a-virtual-machine--...
0
votes
1
answer
18
views
WinDBG: Execute du Command on first arg of top stack automatically
I have a breakpoint on some source code set up.
Each time the break point is triggered I execute two commands:
0:000> kb 1
# RetAddr : Args to Child ...
0
votes
0
answers
42
views
How to view a device driver stack?
There is a picture on the Microsoft site which represent a USB device driver stack (in other word, the list of all drivers which applys for the device work).
What software shall I use to get this ...
0
votes
1
answer
37
views
Why WinDbg does not reconnect after target computer reboot?
I was Setting Up KDNET Network Kernel Debugging Automatically to provision a computer for driver deployment and testing in order to Write a Hello World Windows Driver (KMDF) and after rebooting my ...
-1
votes
0
answers
74
views
When analysing a crash dump, how to get the crashing process command line or pid?
Since I updated all drivers, 1 of them is causing bosd on my machine after boot in non safe mode. I know this through the !analyse -v which leads to this in all dumps :
Microsoft (R) Windows Debugger ...
0
votes
1
answer
48
views
Where to find pdb/symbol files for older operating systems (like Windows 2000)
IT WAS NOT POSSIBLE TO OBTAIN THE SYMBOLS THROUGH THE MICROSOFT SYMBOLS SERVER as it is not possible to obtain them on the symbols server..
log windbg :
Waiting to reconnect...
Connected to Windows ...
1
vote
0
answers
58
views
.NET Interop Memory Leak, strong handle cannot be dumped
I try to figure out an Memory Leak in my mixed VC++/C# application. Interop is done by com. I figured out the garbage collector does not clean up the managed Object LcUI.Portal.PortalMainForm. It is ...
0
votes
1
answer
50
views
Calling KeGetCurrentThread() in DriverEntry() and inputing _KTHREAD Address in WinDbg gives (null) value for WaitPrcb member variable
OK so I have a kernel mode WDF device driver and in DriverEntry I've got two lines of code (see at the bottom). I then take the address displayed in DebugView by the DbgPrintEx statement then enter ...
0
votes
1
answer
37
views
How to display current value of a specific variable which is located in particular _KTHREAD object?
OK so the following command (see below) displays all variable names and their type information of the structure _KTHREAD in Windbg. But if I have the address of a specific _KTHREAD object how can I ...
-1
votes
1
answer
69
views
Troubleshooting Windows Event Viewer USB error 0x26 status 0xc000038e
I need some guidance in how to troubleshoot a low level issue I am facing with some USB devices.
Background: I have a .NET Windows Service that, scans connected USB devices via WMI queries + reads low ...
0
votes
1
answer
29
views
WinDbg How to find HeapAlloc or HeapAllocStub?
I'm trying to find the address of the API HeapAlloc in Windbg using the following syntax u Kernel32!HeapAllocStub but windbg cannot resolve that. I have reloded the symbols and the error persist, for ...
1
vote
0
answers
36
views
Service Fabric Stateful Service Replica memory spiked without any activity
One of the replicas of the below-mentioned node started taking 82 MB and spiked up to 172 MB suddenly without any activity on the service. The dump says there are objects due to service fabric.
We are ...
1
vote
0
answers
32
views
Is it possible to use SOS with a .NET7 AOT application?
When building a .NET Core AOT application the necessary CLR functionality is, if I understand it correctly, statically linked into the executable. That means that at run time, coreclr.dll is not ...
1
vote
1
answer
131
views
OutputDebugString with both WinDbg and DbgView
With DebugView is simple: I clear its output window with "DBGVIEWCLEAR" (in OutputDebugString, ODS), and then I show some 10 lines of info. I do this with a timer, 10 times per second.
But, ...
0
votes
1
answer
52
views
WinDbg: Unable to verify checksum for EXE file
I realize a question with the exact title has already been answered, but the steps there requires running the compiler and linker manually, whereas I want to use cmake.
I am trying to debug a C ...
0
votes
1
answer
40
views
pykd can not start thread use threading in python script
when I use threading.Thread to create new thread.it can not start. The code like this
import threading
import time
import sys
def worker():
count = 1
while True:
if count >= 6:
...
0
votes
1
answer
38
views
IDA - execute commands in WinDbg console from python script
I have a python script to run in IDA that generates commands for WinDbg. I also open the memory dump (via the windmp64.dll loader), where the WinDbg console is already available:
I want to execute ...
0
votes
0
answers
71
views
hooking a function using a debugger
I currently got into reverse engineering and now I am trying to solve different CrackMes. At the moment I hook functions with Frida and it's JavaScript API. I understand the theory behind hooking a ...
-2
votes
3
answers
85
views
See what caused a fatal exception (Post-Mortem) C++ app with WinDbg
Situation:
C++ app developed with Visual Studio 2022 dies in Release mode only when debugger is detached. Now, while I may know the typical scenarios where this might be happening the code base is too ...
0
votes
1
answer
85
views
How to pinpoint where in the program a crash happened using .dmp and WinDbg?
I have a huge application (made in PowerBuilder) that crashes every once in a while so it is hard to reproduce this error. We have it set up so that when a crash like this occurs, we recieve a .dmp ...
0
votes
1
answer
58
views
Windows store legacy app (metro) experiencing random file access errors on Windows 10
I have an old metro app which needs to run on Windows 10. It performs file operations on Documents Library for interop with other processes running on the same machine.
Line causing the issue:
...
0
votes
0
answers
43
views
Debugging an access violation exception in a Java app
I have the Britannica Ultimate Reference Suite 2015 installed on a 64 bit Windows 10 Enterprise machine. It used to work fine, but when I last tried to launch it, nothing happened. The Disk indicator ...
0
votes
1
answer
29
views
How can i set global breakpoint using windbg
Can i set global breakpoint, using windbg, like softice (for example: bpx MessageBoxA) so it will break on all user mode running apps?
0
votes
1
answer
48
views
How to examine the structures in Windbg?
I'm trying to use dt command to see the values of the structure fields. But it doesn't work for some reason:
dt ntkrnlmp!_SECURITY_SUBJECT_CONTEXT rdx
Cannot find specified field members.
...
0
votes
0
answers
99
views
The access violation of the .NET program crashes, why are all "????"
My program crashed, and I used !analyze -v to observe the crash information as follows:
0:044> !analyze -v
CONTEXT: (.ecxr)
rax=0000000000000000 rbx=000001659f8a6d88 rcx=0000000000000000
rdx=...
1
vote
0
answers
73
views
Is there a way to close a .py file directly after running the script instead of after detaching when using pykd in windbg?
Sorry for all the questions but I think I have narrowed down my issue. In the below code, I call the following script via pykd in windbg. For the most part, it behaves as intended. However, after I ...
0
votes
1
answer
122
views
In Windbg what command will display all function names or addresses that call a specific function?
I need to obtain the addresses (absolute) of all functions that call the below function. Can this be done in Windbg ?
The function that I would like to find all callers of is KeBugCheckEx
lkd> uf ...
0
votes
1
answer
53
views
How to set an exception using masm64?
How can i access the exception chain (SEH) using masm64?
Using masm32, I get the first exception looking into fs:[0]
But when I checked in Windbg if fs:[0] still pointed at the first exception in x64, ...
5
votes
1
answer
241
views
Windbg breakpoint on a register value
I want to put a breakpoint on a certain register that will fire whenever the register holds the value specified.
In the following example:
mov eax,10
mov ebx,12
inc eax
dec eax
Pseudocode:
bp @eax=...
0
votes
0
answers
129
views
windbg "Unable to read memory at ~~" error
When analyze minidump file on windbg, I want to extract file for memory arange.
So I try
.writemem C:\f.dll 76dd0000 76ec0000
( 76dd0000 ~ 76ec0000 is kernel32.dll's start address and end address )
...
1
vote
1
answer
140
views
Who access a certain memory in windbg
How can I check on WinDbg which part of the code in an executable (disassembled) access a certain memory address?
For instance, (pseudo) "get_addresses_use 140000" -> 14853, 12435 (...
0
votes
0
answers
66
views
How to query profiler instrumented IL code address using Windbg and SOS extension?
I have been debugging a .Net framework (4.8) CLR profiler codebase using Windbg and extension SOS.
I am starting the target application debug binary through windbg and after the instrumentation has ...
1
vote
1
answer
51
views
How to set a data breakpoint on a variable address in CDB (WinDbg)
class Test
{
public:
Test()
{
std::cout << "ctor" << std::endl;
ptr = new int(5);
*(ptr + 1) = 42;
};
~Test() { std::cout << &...
0
votes
1
answer
161
views
How to set WinDbg cache* local symbol path
This is my WinDbg target launch link.
From
"E:\software\Windows Kits\10\Debuggers\x86\windbg.exe" -y SRV*
E:\symbol*http://msdl.microsoft.com/download/symbols -b -k com:port=//./pipe/com_1,...
1
vote
1
answer
47
views
Modifying Registers in Windbg extension
Does anyone know if it is possible to either call a Windbg script from an extension or modify registers and execute APIs in the debugged process's context?
By Windbg script I mean .wds files and ...
1
vote
1
answer
67
views
WinDbg evaluate ebp+12
I try to understand things about stackpointer, basepointer .. how does it work .. and because most of the teaching material are not combined with a practical examples, I try to reproduce that: https://...
0
votes
2
answers
129
views
How to load an external file in a WinDbg session
I'm trying to load pykd.pyd in order to be able to use Python during Windbg crash dump analysis. This does not work, as you can see here:
0:006> .load C:\Python27\Lib\site-packages\pykd.pyd
The ...
0
votes
1
answer
107
views
WinDbg remote kernel debugging - detach from debuggee without terminating WinDbg process
When using remote kernel debugging (over network) via WinDbg, executing .detach also terminates the debugger itself. To be exact: once I execute .detach cmd - the debugger gets detached from the ...
2
votes
1
answer
157
views
WinDbg - execute script on startup
I'd like to execute .logopen /u /t /d each time I launch WinDbg - so that a logfile will be created automatically, right from the beginning of each session, without me having to specify it explicitly.
...
0
votes
0
answers
215
views
Retrieve all functions that called by a user mode process in kernel mode debug including kernels functions
I am trying to find all the functions including both user mode functions and kernel mode functions that wmic.exe calls to execute the diskdrive command. In order to do this I opened wmic.exe in my ...
0
votes
1
answer
86
views
How do I compare the checksum of a memdump to the source file
While debugging a memory dump Windbg apparently reads somewhere the checksum, because it complains if you there is no provided (not linked with the /RELEASE flag). BUT it doesnt seem to actually ...
0
votes
1
answer
105
views
Windbg load symbol at address which is a reload module, symbol name can not be displayed
I've wrote some pieces of code which is used to reload a PE module into arbitrary address, and below is the memory that the code reload ntoskrnl.exe of windows kernel:
kd> lm
start end ...
0
votes
0
answers
50
views
WinDbg Time Travel Debugging not finding correct symbols for .NET app
I'm trying to record a .NET 6 application with WinDbg TTD. I record the .exe file, not the .dll.
When recording, the program image is listed as .exe but is linked to apphost.pdb, with WinDbg showing ...
0
votes
1
answer
163
views
Problem with !vtop in windbg for converting a virtual address to a physical one, using the page table address from CR3
I study the Windows kernel and windbg ( along the way). And I found the !vtop command on msdn - which translates the virtual address of the current context into a physical one. I wanted to enjoy the ...