WinDbg commands

[Nytro]

Am inceput sa folosesc mai des WinDbg (IDA sucks in unele privinte) si mi-am facut o lista cu comenzile utile.

?                           - Regular commands help
?? expr                     - Evaluate C++ expression
$$ comment                  - Add comment
~                           - All threads
~.                          - Current thread
~. k                        - Current thread stack
~* k                        - All threads stack             

.cls                        - Clear screen
.help                       - Display . commands
.hh text                    - Open Help and search text
.lastevent                  - Last exception/event
.time                       - Kernel and user time
.tthread                    - Thread time
.attach                     - Attach to process with PID
.detach                     - Detach from process
.restart                    - Restart application
.symfix                     - Set default symbol path
.reload                     - Reload all symbols
.tlist                      - List all processes

!Ext.help                   - General extensions
!Exts.help                  - Other extensions
!Uext.help                  - User-mode extensions 
!Wdfkd.help                 - Kernel-mode extensions   

!analyze -v                 - Information about current exception
!threads                    - Detalied threads info
!address -summary           - Memory addresses
!heap -s                    - Heap info
!runaway                    - Time of all threads
!teb                        - Thread Environment Block
!peb                        - Process Environment Block
!dlls                       - Loaded modules (+options)
!lmi chrome.dll             - Module information
!dh kernel32.dll            - Display PE headers and sections
!tls                        - Thread Local Storage
!gle                        - Dump last errors (by threads)
!error ERR                  - Display error text info
!uniqstack                  - Stack for all threads
!address Addr               - Display info about address
!mapped_file Addr           - File containing that address

g                           - Go
gu                          - Go up (until function complete)
q                           - End debug session
p                           - Single step
pt                          - Step to next return
pc                          - Step to next call
pa Addr                     - Step until addr
lm / lmf                    - Loaded modules
lm vm chrome                - Module information
ld * / module               - Load symbols
n 10 / 16                   - Change number base
x kernel32!Load*            - Examine symbols
ln addr                     - List nearest symbols
k                           - Stack
kd                          - Raw stack
kb                          - Stack with firts 3 params
r                           - Show registers
r eax,ebx                   - Show some registers
r ecx=0                     - Set register value
dt ntdll!_PEB               - Display type
dv                          - Display local variables
da, du                      - Display ASCII/Unicode memory
db, dw, dd, dq, df          - Display byte/word/dword/qword/float memory
db*, dd*                    - Display dereferenced memory
eb, ew, ed, eq, ef          - Edit byte/word/dword/qword/float memory
c, m, f                     - Compare, move, fill memory
s Addr Size Data            - Search data

bl                          - List breakpoints
bc *                        - Clear all breakpoints
be / bd                     - Enable/disable breakpoints
bp Addr                     - Add breakpoint
bm Sym                      - Add breakpoint on symbol
ba [rwx] Addr               - Break on access
bp mod!addr /1              - Only once
bp mod!addr k               - Only triggered after k-1 passes

Poate i se mai pare cuiva utila.

Mai multe comenzi: http://windbg.info/doc/1-common-cmds.html

Un mic cheatsheet: https://labs.snort.org/awbo/windbg.txt

[Ganav]

@Nytro Vreau sa te intreb, tu ce setup folosesti cand faci kernel debugging? Modul ideal ar presupune doua statii conectate fie prin USB sau RS232 insa in cazul meu acest lucru nu este posibil. Se pot folosi si masini virtuale insa in acest caz imaginea memoriei(date+instructiuni) nu este actualizata in mod real(are delay-uri considerabile).

[Nytro]

Nu am facut kernel debugging, dar http://alexandreborgesbrazil.files.wordpress.com/2014/03/intro_win_debugging.pdf .