Good tutorial for WinDbg?

windbg
q0987 picture q0987 · Feb 9, 2011 · Viewed 59.2k times · Source

Are there good tutorials for showing how to use WinDbg?

Answer

Colin Smith picture Colin Smith · Jul 29, 2012

Basic Tutorials & Usage Demos

Different Ways to "Start"/Attach WinDbg

Workspaces (Understanding how they work)

Cmdtree

Allows you to define a "menu" of debugger commands for easy access to frequently used commands without having to remember the terse command names. Don't have to put all the command definitions into the same cmdtree text file....you can keep them separate and load multiple ones (they then get their own window).

Startup Script

You can use the -c option on the command line to automatically run a WinDbg script when you start WinDbg.

Gives opportunity to turn on DML (Debugger Markup Language) mode, load particular extensions, set .NET exception breakpoints, set kernel flags (e.g. when kernel debugging you might need to change the DbgPrint mask so you see tracing information....ed nt!Kd_DEFAULT_Mask 0xFFFFFFFF), load cmdtrees, etc.

An example script:

$$ Include a directory to search for extensions
$$ (point to a source controlled or UNC common directory so that all developers get access)
.extpath+"c:\svn\DevTools\WinDBG\Extensions"
$$ When debugging a driver written with the Windows Driver Framework/KMDF
$$ load this extension that comes from the WinDDK.
!load C:\WinDDK\7600.16385.1\bin\x86\wdfkd.dll
!wdftmffile C:\WinDDK\7600.16385.1\tools\tracing\i386\wdf01009.tmf
$$ load some extensions
.load msec.dll
.load byakugan.dll
.load odbgext.dll
.load sosex
.load psscor4
$$ Make commands that support DML (Debugger Markup Language) use it
.prefer_dml 1
.dml_start
$$ Show NTSTATUS codes in hex by default
.enable_long_status 1
$$ Set default extension
.setdll psscor4
$$ Show all loaded extensions
.chain /D
$$ Load some command trees
.cmdtree c:\svn\DevTools\WinDBG\cmdtree\cmdtree1.txt
.cmdtree c:\svn\DevTools\WinDBG\cmdtree\cmdtree2.txt
$$ Show some help for the extensions
!wdfkd.help
!psscor4.help
.help /D

Command Cheat Sheets

Extensions (extend the range of commands/features supported)

  • AddSym
    - allows transfer of symbol names between IDA and WinDbg
  • bigLasagne (bldbgexts & blwdbgue)
    - assembly syntax highlighting and a driver mapping tool)
  • BigLib Number Reader
  • Byakugan
    - detect antidebugging methods, vista heap visualization/emulation, track buffers in memory
  • CmdHist
    - records every command you executed in your debug session so you can re-execute easily
  • Core Analyzer
    - check heap structures for corruption, detect objects shared by threads, etc.
  • dom WinDbg Extension
    - (!stlpvector, !idt, !unhex, !grep, etc.)
  • dumppe
    - dumps PE file from memory
  • Image Viewer Extension (Vladimir Vukicevic)
  • Intel UEFI Development Kit Debugger Tool
    - debug UEFI firmware
  • leaktrap
    - GDI/USER handle tracker to aid in leak detection
  • Mona (requires PyKD)
    - set of commands to aid in advanced analysis/find exploits
  • MSEC
    - provides automated crash analysis and security risk assessment
  • narly
    - lists info about loaded modules such as if using SafeSEH, ASLR, DEP, /GS (Buffer Security Checks)
  • netext (Rodney Viana)
    - (!wservice - list WCF service objects, !wconfig - show .config lines, !whttp - list HttpContexts, !wselect/!wfrom - support SQL like queries on arrays)
  • ODbgExt
    - open debugger extensions
  • OllyMigrate
    - pass debuggee to another debugger without restarting
  • Psscor2
    - a superset of SOS for assisting in debugging .NET 2.0 managed code
  • Psscor4
    - a superset of SOS for assisting in debugging .NET 4 managed code
  • PyDBGExt
    - allows Python scripting to be used
  • PyKD
    - allows Python to be used to script WinDbg
  • sdbgext (Nynaeve)
    -(!valloc, !vallocrwx, !heapalloc, !heapfree, !remotecall, !remotecall64, !loaddll, !unloaddll, !close, !killthread, !adjpriv, !ret)
  • SieExtPub
    -legacy extension...now built into WinDbg in ext.dll
  • SOSEX
    - more commands for helping to debug managed NET 2.0 or 4.0 code
  • SPT/SDBGExt2 (Steve Niemitz)
    - (!DumpHttpContext, !DumpASPNetRequests, !DumpSqlConnectionPools, !DumpThreadPool, etc.)
  • Uniqstack
    - source to a debugger extension (need an OSR Online account to access it)
  • viscope
    - code coverage graph
  • Wait Chain Traversal/wct.dll (CodePlex Debugging Extensions
    - display wait chains of application threads (helps find deadlocks)
  • windbgshark
    - integrates the Wireshark protocol analyser to enable VM traffic manipulation and analysis
  • WinDbg Extensions (Sasha Goldstein)
    - Tracer, WCT, heap_stat, bkb, traverse_map, traverse_vector)
  • WinDbg Highlight (ColorWindbg.dll) (Use Google Translate to translate link)
    - assembly language syntax highlighting

Write your own extension

Debugging Managed Code

Scripting (C#, PS, Python, and WinDbg)

Debuggers/Tools that use the dbgeng.dll API/WinDbg Tools

Different Ways to Generate Crash Dump Files for Post-Mortem Analysis

Dump Analysis Tools

Dump related Tools

  • Citrix dumpcheck - checks consistency of dump file (looks like it's been abandoned link + link)
  • dumpchk (part of Debugging Tools) - checks consistency of a Dump file
  • MoonSols Windows Memory Toolkit (formerly windd) - converts various raw memory dump files into WinDbg compatible dmp files
  • vm2dmp - Microsoft Hyper-V VM State to Memory Dump Converter
  • vmss2core - converts VMware snapshot file into a core dump file (download), (instructions)

Kernel Debugging Virtual Machines

  • VMKD - Virtual Machine KD Extensions
  • VirtualKD - (kernel debugger support for OS's hosted in VMware/VirtualBox)

Videos

Blogs

Advanced Articles & Tutorial Resources

Alternative Debuggers

Other Links

Related questions

Getting windbg without the whole WDK?

Does anyone know how to get ahold of windbg without having to download the entire 620MB WDK ISO? All I can find on the net to download the debugger is this link, which says you have to get the whole …

Read More
How to set up symbols in WinDbg?

I am using Debugging Tools for Windows and I get the following error message when starting WinDbg / cdb or ntsd: Symbol search path is: *** Invalid *** **************************************************************************** * Symbol loading may be unreliable without a symbol search path. * * Use .symfix to have the …

Read More
ERROR: Symbol file could not be found. windbg.exe

I downloaded the symbols from http://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx the package (Windows 7 RTM x86 retail symbols, all languages) but it still gives me the same error! Done .sympath but still not working .sympath C:\inetpub\…

Read More