introduction
play

Introduction to Debugging with Windbg Module Overview - PowerPoint PPT Presentation

Sep 03, 2023 •588 likes •1.05k views

Introduction to Debugging with Windbg Module Overview Introduction to Debugging Callstacks and Symbols Windbg for .NET Debugging Son of Strike (SOS) Review 2 Callstacks and Symbols Anatomy Of A Call Stack (unmanaged) Module &

  1. Introduction to Debugging with Windbg

  2. Module Overview Introduction to Debugging Callstacks and Symbols Windbg for .NET Debugging Son of Strike (SOS) Review 2

  3. Callstacks and Symbols

  4. Anatomy Of A Call Stack (unmanaged) Module & Return address Function arguments Function name poi(EBP+4) poi(EBP+8),poi(EBP+c),poi(ESP+10)

  5. Calling Convention (32Bit unmanaged) The function’s return address is at EBP+4 mostly StdCall: function arguments start at (Child) EBP+8, EBP+0c etc. • When EBP is not present function arguments start at ESP+4, then increment by 4H (ESP+8, ESP+C, ESP+10 etc.) Local variables are negative offsets of EBP (EBP-4, EBP-8, etc.) Most functions will store their return value in EAX ->pseudo register: @$retreg

  6. Calling Convention (X64 unmanaged) FASTCALL Only Return value gets stored within rax First four integer arguments go into registers Integer: rcx,rdx,r8,r9 Floating point: XMM0 – XMM3 Parameters smaller than 64 are not zero extended -the upper bits are garbage Stack Pointer is rsp The Stack is growing downwards (like x86)

  7. Calling Convention (X64) int _tmain(int argc, _TCHAR* argv[]) { ... SomeFunction(1,2,3,4,5); 00000001400010A6 mov dword ptr [rsp+20h],5 00000001400010AE mov r9d,4 00000001400010B4 mov r8d,3 00000001400010BA mov edx,2 00000001400010BF mov ecx,1 00000001400010C4 call SomeFunction (14000100Ah) return 0; ...

  8. C++ fastcall - X64 //Debug Version for better callstacks: int _stdcall SomeFunction (int a, int b, int c, int d, int e) { 00007FF7B95832B0 mov dword ptr [f],r9d //Data is realigned on the stack 00007FF7B95832B5 mov dword ptr [rsp+18h],r8d 00007FF7B95832BA mov dword ptr [rsp+10h],edx 00007FF7B95832BE mov dword ptr [rsp+8],ecx 00007FF7B95832C2 push rdi 00007FF7B95832C3 sub rsp,30h 00007FF7B95832C7 mov rdi,rsp 00007FF7B95832CA mov ecx,0Ch Reference: The history of calling conventions, part 5: amd64 And for Debugging: Challenges of Debugging Optimized x64 Code

  9. C++ fastcall - X64 #pragma optimize("g",off) //for better callstacks! int _stdcall SomeFunction (int a, int b, int c, int d, int e) { 00007FF7B95832B0 mov dword ptr [f],r9d //Data is realigned on the stack 00007FF7B95832B5 mov dword ptr [rsp+18h],r8d 00007FF7B95832BA mov dword ptr [rsp+10h],edx 00007FF7B95832BE mov dword ptr [rsp+8],ecx 00007FF7B95832C2 push rdi 00007FF7B95832C3 sub rsp,30h 00007FF7B95832C7 mov rdi,rsp 00007FF7B95832CA mov ecx,0Ch

  10. Symbols (unmanaged) You need good symbols Always ensure that the version of source you are using matches the module image • Is the call stack consistent with the source? • Are blank lines being executed? • Optimisations may invalidate source • Use Microsoft public symbol server: set _NT_SYMBOL_PATH=srv* DownstreamStore *http://msdl.microsoft.co m/download/symbols Source Level Debugging Only works if you have “Private” symbols • Private symbols do not guarantee source level debugging – It may lack line number information – Make sure Debug / Source Mode is checked

  11. Understanding Mismatched Symbols Mismatched symbols occur when you use symbols for a binary that were not built at the same time as that binary ERROR: Symbol file could not be found. Defaulted to export symbols for ntdll.dll The debugger will normally fail to load mismatched symbols or will warn you that they are wrong: Use !sym noisy to understand why your symbols are not loading 01bffd70 77f7f49f SharedUserData!SystemCallStub+0x4 WARNING: Stack unwind information not available. Following frames may be wrong. 01bffe10 77d46db9 ntdll!ZwWaitForMultipleObjects+0xc 01bffe6c 77d46e5b USER32!UserLpkPSMTextOut+0x15c 01bffe88 75f8a5f3 USER32!MsgWaitForMultipleObjects+0x1d

  12. Managed Symbols? Managed .NET Debugging: possible without Better with :-) • Complete callstack • More infos Instruct CLR not to optimize the code (during jit) without recompiling the dll: Use an ini file (and symbols) • MyDll.ini: [.NET Framework Debugging Control] AllowOptimize=0 Instruct CLR to ignore (optimized) Ngen Image Use Environment variable: set COMPLUS_ZapDisable=1

  13. Where to store my symbols? Companies are storing their symbols in symbol servers Maintain all versions which you might need to troubleshoot at some point Microsoft public symbol server: http://msdl.microsoft.com/download/symbols http://symweb Microsoft private symbols server: Customers should set up and maintain their own store for this

  14. Symbol Server Structure

  15. How to set up a symbol server Set up a file share Give access to the user account doing build operation Use Symstore.exe to store symbols on the share To store public symbols use the Binplace.exe which generates stripped symbols from the private ones

  16. Windbg Debugging 16

  17. WinDBG outlook Output Window View Window Shortcuts Tracing Shortcuts Command Line Current Thread # 17

  18. Execution Control Break - Ctrl+Break, or Menu: Debug -> Break Go - g or F5 : continue execution - gn : go not handled - gh : go handled Step - p or F10 : Step Over - t or F11 : Step Into Detach q : Quit the debug session – it will terminate your application - qd : Quit the debug session with detach – the process won’t - terminate 18

  19. Thread Symbols and Commands ~. : Current Thread ~# : Display thread caused exception ~5 : Display Thread 5 can be 0...Thread Count-1 ~5s : Set Thread 5 to be the current one ~*: All Threads Example: Display the call stack for all threads ~*kb 19

  20. Navigating on a Thread Change frames .frame <frame number> View Local Variables 0:000> dv d : display names of locals hInstance = 01000000 dv – v : display used registers hPrevInstance = 00000000 lpAnsiCmdLine = 00091eeb "" dt : displays information about cmdShow = 0xa variables msg = tagMSG lpfnRegisterPenApp = 00000000 20

  21. Call Stacks CDB/Windbg k command with several options Display of calls and arguments kb : include first three parameters kn : include frame numbers kv : include frame type info, including FPO info kd : display raw stack data kf : display the distance between frames kp : gives detailed symbol information about parameters kL : display without source lines

  22. Call Stacks – examples K Command Return address poi(ESP) OutputListBox has a variable number of arguments: (..)

  23. Call Stacks – examples what are the arguments? KB Command – displays the first 3 Arguments ->DWORDs on the stack

  24. Call Stacks – examples KN adds the frame number to the display options can be chained together to get the desired results.

  25. View Registers and Assembly View Registers R command – CDB/Windbg Disassembly U <address> Uf <function>

  26. Examine/Modify Memory d commands – display address or address range dp : display pointer (64Bit on 64Bit target) dd : display double words (DWORDS) dc : display double words and ASCII values da : display ASCII value du : display Unicode value ed : edit memory (ex. ed 0x23478924 10) ? : expression evaluator 0:000> ?10 Evaluated expression: 16 = 00000010 26

  27. View Modules and Symbols CDB and Windbg X command, used to examine modules, types,… X *! : list all the modules X Kernel32!Op* : list all symbols starting with “Op” in Kernel32.dll 0:001> x kernel32!Op* 76d60964 kernel32!OpenProfileUserMapping 76cd1225 kernel32!OpenThread .. LM : List loaded modules with source path LN <address> : find closest symbol to the given address LMVM <module name> : List verbose module information

  28. Breakpoints Static (Fixed) Breakpoints bp : set breakpoint ba : break on access Conditional Breakpoints Break at location if condition is true bp MyFunction+0xb “j (poi( MyVar ) > 0x20)” Break if location changes value ba w &MyVar - breaks on a write to the address of MyVar Break at location if location == value bp MyMod!myFunction “j MyMod!g_myGlobal == 1” Break at location after count is reached bp MyFunction+0xb 7

  29. Breakpoints (continued) Execute debug statements when breakpoint is reached bp MyFunction+0xb “ kb;.frame 2;dv;g” Others bu : Breakpoint unresolved can be set on modules which are not loaded right now gets resolved when module loads stores Breakpoint in the Workspace bl : list breakpoints bd : disable breakpoint be : enable breakpoint bc : clear breakpoint bd * : disables all breakpoints bd 3 : disables Breakpoint 3

  30. Set Exceptions Controls debugger actions when an exception occurs sxe : enable sxd : disable sxi : ignore sxn : notify Types of events to handle sxe ld : break when a module loads sxn av : notify (don’t break) on Access Violations

  31. Debugger Log File Commands CDB/Windbg Logfile Open/Close/Append .logopen [filename] //open a new log file .logappend [filename] //appends to an existing log file .logclose //close current log file Add comments * [comment] // Used to add a comment .echo [comment] // Will echo back what you type Screen .cls : Clears the screen

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend

INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION

INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION

TRAINING COURSE ON SOCIAL PROTECTION &amp; FORMALIZATION TRINIDAD AND TOBAGO MARCH 15, 2017 INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION INTRODUCTION Design of the NIS Assistance from the

547 views • 23 slides
INTRODUCTION Introduction 2/42 INTRODUCTION Alternations I am giving bread to the

INTRODUCTION Introduction 2/42 INTRODUCTION Alternations I am giving bread to the

Patterns of variation in the expression of case and agreement Andrs Brny Leiden University Centre for Linguistics 9 November 2019, BaSIS Workshop a.barany@hum.leidenuniv.nl INTRODUCTION Introduction 2/42 INTRODUCTION

1.37k views • 42 slides
Introduction Introduction Introduction Introduction Outline Motivation Failures

Introduction Introduction Introduction Introduction Outline Motivation Failures

Introduction Introduction Introduction Introduction Outline Motivation Failures Definition and concepts Process and product properties Principles SE Approaches Motivation Software and the economy The economies of

1.03k views • 49 slides
Introduction Introduction Introduction Nationwide Cause for Concern 1

Introduction Introduction Introduction Nationwide Cause for Concern 1

Introduction Introduction Introduction Nationwide Cause for Concern 1 https://www.cdc.gov/std/stats17/infographic.htm Introduction Epidemiology in Western Colorado CPHE Surveillance Data Report, May 2018 Chlamydia Epidemiology in Western

977 views • 39 slides
DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every

DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every

DAQ introduction Purpose of this talk : (1) Introduction for those who have not been in every meeting (2) Some ideas of diagrams for section 7.1 (Introduction) of TP. Giles Barr 25 Jan 2018, Pembroke College On DUNE, the reality is there is a

474 views • 10 slides
INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT

ADVANCED COMPUTER SECURITY INTRODUCTION cf. Schneider, Chapter 1 INTRODUCTION THEY ARE OUT TO GET YOU INTRODUCTION WHAT IS SECURITY? A systems security policies describe What the system is supposed to do Store and provide access

479 views • 16 slides
Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL

Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL

Overview Introduction to SMIL Introduction to W3C and XML Introduction to SMIL Writing a SMIL file Adding Media Objects Martin Halvey Clipping media files January 2008 Timing and Synchronising Layout World Wide

387 views • 14 slides
14 Introduction Introduction Bad guys can put malware into Example: hosts

14 Introduction Introduction Bad guys can put malware into Example: hosts

Introduction Introduction source Encapsulation ISO/OSI reference model message M application segment H t H t M transport network datagram H n H n H t M presentation: allow applications to frame link H l H n H t M interpret

583 views • 4 slides
Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL

Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL

Previous Lecture Introduction to SMIL 2 Introduction to W3C and XML Introduction to SMIL Writing a SMIL file Adding Media Objects Martin Halvey Clipping media files January 2008 Timing and Synchronising Layout

322 views • 8 slides
Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL

Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL

Introduction Zynq Lecture 1 Andreas Habegger Introduction Zynq Introduction Zynq Introduction Zynq PS vs. PL Processing System Processor Peripherals Data Buses AXI Bus Conclusion BTE5380 - Embedded Systems Octobre 2014 Andreas Habegger

1.81k views • 30 slides
2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04

2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04

2018.06 01 SMILE5 Introduction S E 5 02 Alpha Cloud M I L 03 Company Introduction 04 Project References S E 5 PART.1 SMILE5 Introduction M I L Introduction STORION-SMILE5 Residential Energy Storage System Inverter 5kW Output Input

1.06k views • 25 slides
Introduction to CICS Course introduction Course introduction What is CICS? What is an

Introduction to CICS Course introduction Course introduction What is CICS? What is an

Introduction to CICS Course introduction Course introduction What is CICS? What is an application server? Why use an application server? Course introduction Services provided by CICS How CICS applications are defined Scaling CICS to meet

1.84k views • 146 slides
Network Visualization Introduction Presented by Shahed Introduction Introduction Basic

Network Visualization Introduction Presented by Shahed Introduction Introduction Basic

Network Visualization Introduction Presented by Shahed Introduction Introduction Basic building blocks Node Links (relationship between nodes) Spatial information Network data

584 views • 9 slides
Introduction Introduction (1) Main argument of the paper: universities are not only

Introduction Introduction (1) Main argument of the paper: universities are not only

Le jugement des pairs comme outil de management des universits Peer-review as a management tool Christine Musselin (CSO, Sciences Po et CNRS) Avril 2013, Lirrsistible ascension du capitalisme acadmique Introduction Introduction (1)

590 views • 28 slides
Introduction Introduction to storage and to storage and filesystems filesystems Introduction

Introduction Introduction to storage and to storage and filesystems filesystems Introduction

Moreno Baricevic Gilberto Daz Axel Kohlmeyer Stefano Cozzini ULA ICTP CNR-IOM DEMOCRITOS Merida, VENEZUELA Trieste, ITALY Trieste, ITALY Introduction Introduction to storage and to storage and filesystems filesystems Introduction

1.19k views • 51 slides
JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of

JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of

JABLOTRON JA-100 introduction November 2011 Introduction Todays goals First introduction of the brand new JA-100 alarm system Visions Basic architecture System components Setting Help us with final validations You are the FIRST ones

1.69k views • 111 slides
Topic: Data for Better MQLs (&amp; Summit Highlights) WELCOME MARKETO USER GROUP LEADERS: Karen

Topic: Data for Better MQLs (&amp; Summit Highlights) WELCOME MARKETO USER GROUP LEADERS: Karen

Topic: Data for Better MQLs (&amp; Summit Highlights) WELCOME MARKETO USER GROUP LEADERS: Karen W. Sesona Manager, Marketing Ops/Campaign Management Tyler Technologies, Inc. karen.sesona@tylertech.com Pamela Brungardt Marketing Systems and

1.71k views • 18 slides
Network-level Polymorphic Shellcode Detection using Emulation Michalis Polychronakis, Kostas

Network-level Polymorphic Shellcode Detection using Emulation Michalis Polychronakis, Kostas

Network-level Polymorphic Shellcode Detection using Emulation Michalis Polychronakis, Kostas Anagnostakis, and Evangelos Markatos Institute of Computer Science Foundation for Research and Technology Hellas Crete, Greece DIMVA06 - 13

771 views • 54 slides
2 An overall view (of little detail) Source program Scan Parse Front High IR (lexical)

2 An overall view (of little detail) Source program Scan Parse Front High IR (lexical)

1 TDT4205 Grand Summary, pt. 1 2 An overall view (of little detail) Source program Scan Parse Front High IR (lexical) (syntactic) Back Assemble Generate Low IR Binary executable 3 Lexical analysis Lexical analysis covers

343 views • 31 slides
Language Models Dan Klein, John DeNero UC Berkeley Language Models Language Models Acoustic

Language Models Dan Klein, John DeNero UC Berkeley Language Models Language Models Acoustic

Language Models Dan Klein, John DeNero UC Berkeley Language Models Language Models Acoustic Confusions the station signs are in deep in english -14732 the stations signs are in deep in english -14735 the station signs are in deep into

1.44k views • 86 slides
1 Three Dimensional Aggregation (con.t) Three Dimensional Aggregation (con.t) If we need to

1 Three Dimensional Aggregation (con.t) Three Dimensional Aggregation (con.t) If we need to

Data Cube: A Relational Aggregation Operator Topic Outline Generalizing Group-By, Cross-Tab, and Sub-Totals J. Gray, al, Microsoft Research F. Pellow, al, IBM Research Visualization and dimension reduction The relational representation of

367 views • 4 slides
Understanding the Link Between Micro and Macro Consump8on Data ( a project for 2017-18 ) Thomas

Understanding the Link Between Micro and Macro Consump8on Data ( a project for 2017-18 ) Thomas

Understanding the Link Between Micro and Macro Consump8on Data ( a project for 2017-18 ) Thomas Crossley, Essex Sofiya Stoyanova , ONS Richard Tonkin, ONS ESCoE Workshop, October 2 nd 2017 Mo8va8on(s) At least three: Understanding the

203 views • 19 slides
Spintronics -- materials aspect Spintronics -- materials aspect Why to do not combine

Spintronics -- materials aspect Spintronics -- materials aspect Why to do not combine

Spintronics -- materials aspect Spintronics -- materials aspect Why to do not combine complementary resources of ferromagnets and semiconductors? TopGaN hybrid ferromagnetic-metal/semiconductor structures cf. B. Dieny Hybrid structures

778 views • 65 slides
WIN MORE WORK WIN MORE WORK without being a sleaze without being a sleaze CINDY TONKIN VALUE

WIN MORE WORK WIN MORE WORK without being a sleaze without being a sleaze CINDY TONKIN VALUE

10/15/2015 Download the workbook here: tinyurl.com/wmw20151015 WIN MORE WORK WIN MORE WORK without being a sleaze without being a sleaze CINDY TONKIN VALUE consultantsconsultant.com.au ARE YOU READY? MOVING FAST 1 10/15/2015 LIFETIME

197 views • 19 slides

More recommend