windbg

name	windbg
description	Auth/lab ref: Microsoft's debugger for user-mode and kernel-mode Windows debugging, crash dump analysis, driver reversing, and rootkit analysis.
license	MIT
compatibility	Windows; Microsoft Store (WinDbg Preview) or Windows SDK; supports x86/x64/ARM64.
metadata	{"author":"AeonDave","version":"1.1"}

WinDbg

Microsoft's debugger — kernel-mode debugging, crash dump analysis, driver reversing, and advanced user-mode debugging.

Installation

# WinDbg Preview (recommended — modern UI, TTD support)
winget install --id Microsoft.WinDbg --accept-source-agreements

# Classic WinDbg (part of Windows SDK)
# Download from https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/

# Symbol server setup (critical for useful debugging)
# In WinDbg:
.sympath srv*C:\Symbols*https://msdl.microsoft.com/download/symbols
.reload

Quick Start — User Mode

# Open executable
File -> Open Executable -> select target.exe

# Or attach to running process
File -> Attach to a Process -> select PID

# Set breakpoint and run
bp kernel32!CreateFileW
g                           # Go (run)

Quick Start — Kernel Mode

# Enable kernel debugging on target
bcdedit /debug on
bcdedit /dbgsettings net hostip:192.168.1.100 port:50000

# In WinDbg: File -> Kernel Debug -> Net -> enter key from target
# Or: File -> Open Crash Dump -> load .dmp file

Essential Commands

Execution Control

Command	Purpose
g	Go (continue)
p	Step over
t	Step into (trace)
pt	Step to next return
pc	Step to next call
gu	Step out (go up)
bp ADDR	Set breakpoint
bp MODULE!FUNC	Breakpoint on function
bu MODULE!FUNC	Deferred breakpoint (module not yet loaded)
ba r4 ADDR	Hardware breakpoint (read 4 bytes at ADDR)
ba w4 ADDR	Hardware breakpoint (write 4 bytes)
bl	List breakpoints
bc *	Clear all breakpoints
.restart	Restart debugging session

Inspection

Command	Purpose
r	Show registers
r rax=0	Set register value
db ADDR	Display bytes
dd ADDR	Display DWORDs
dq ADDR	Display QWORDs
da ADDR	Display ASCII string
du ADDR	Display Unicode string
dps ADDR	Pointer-sized values with symbols
u ADDR	Unassemble (disassemble)
uf FUNC	Unassemble function
k	Stack trace
kP	Stack trace with parameters
~	List threads
~Ns	Switch to thread N
.frame N	Switch to stack frame N

Memory Search

Command	Purpose
s -a RANGE "string"	Search ASCII string
s -u RANGE L1000 "string"	Search Unicode string
s -b RANGE 4D 5A	Search byte pattern (MZ header)
.writemem FILE ADDR L SIZE	Dump memory to file

Module and Symbol

Command	Purpose
lm	List loaded modules
lm m ntdll	Module info for ntdll
x ntdll!Nt*	List symbols matching pattern
ln ADDR	Nearest symbol to address
.reload /f	Force reload symbols

Process and Thread

Command	Purpose
!process 0 0	List all processes (kernel)
!process ADDR 7	Full process info
.process /i ADDR	Switch context to process (kernel)
!peb	Process Environment Block
!teb	Thread Environment Block
!handle	List handles
!dlls	Loaded DLL list with details

Crash Dump Analysis

# Open dump file
File -> Open Crash Dump -> select .dmp

# First commands after loading a dump:
!analyze -v              # Automated crash analysis (start here)
.ecxr                    # Switch to exception context record
k                        # Stack trace at crash
lm                       # Loaded modules
!process 0 0             # Process list

BSOD Analysis

# After !analyze -v:
.bugcheck                # Bug check code and params
!pool ADDR               # Pool analysis for pool corruption
!verifier                # Driver verifier info
!irp ADDR                # IRP analysis
dt nt!_DRIVER_OBJECT ADDR  # Inspect driver object

Kernel Mode Malware Analysis

Driver/rootkit analysis

# List all drivers
lm t n                   # List all modules by type

# Find suspicious drivers
!object \Driver          # List driver objects
!drvobj \Driver\suspect 7  # Full driver object listing

# Inspect driver dispatch routines
dt nt!_DRIVER_OBJECT ADDR
dps ADDR+0x70 L1C        # MajorFunction table (IRP handlers)

# SSDT hook detection
dps nt!KiServiceTable L100
# Compare each entry — hooks point outside ntoskrnl range

# IDT analysis
!idt                     # Interrupt Descriptor Table

Process hiding detection

# Cross-reference process lists
!process 0 0             # Active process list (via PsActiveProcessList)
!for_each_process "r $t0 = @$proc; .printf \"%p %s\\n\", @$t0, @@c++(@$t0->ImageFileName)"
# Compare with direct EPROCESS walk for hidden processes

User Mode Malware Analysis

Injection detection

bp kernel32!VirtualAllocEx
bp kernel32!WriteProcessMemory
bp kernel32!CreateRemoteThread
bp ntdll!NtMapViewOfSection
g
# On hit: inspect target process handle and injected data
dd @rcx                  # Buffer being written

API monitoring with breakpoint commands

# Log all CreateFile calls without stopping
bp kernel32!CreateFileW ".printf \"CreateFile: %mu\\n\", @rcx; gc"

# Log registry operations
bp advapi32!RegOpenKeyExW ".printf \"RegOpen: %mu\\n\", poi(@rsp+8); gc"

# Log network connections
bp ws2_32!connect "dd @rdx L4; gc"

Time Travel Debugging (TTD)

# Record execution (WinDbg Preview)
File -> Launch Executable (Advanced) -> check "Record with Time Travel Debugging"

# After recording — navigate backwards:
g-                      # Reverse continue
p-                      # Reverse step over
t-                      # Reverse step into

# Find when memory was written:
ba w4 ADDR             # Set write watchpoint
g-                      # Go backwards until write

# TTD queries (LINQ-style):
dx @$cursession.TTD.Calls("kernel32!CreateFileW")
dx @$cursession.TTD.Calls("ntdll!NtCreateThreadEx").Count()

WinDbg Scripting

# Conditional breakpoint with logging
bp kernel32!VirtualAlloc "j (@r8==0x40) '.printf \"RWX alloc: size=%x\\n\",@rdx; gc' ; 'gc'"

# Walk a linked list
!list -t nt!_LIST_ENTRY.Flink -x "dt nt!_EPROCESS @$extret" ADDR

# Extension commands
.load C:\path\to\extension.dll
!mex.help                # MEX extension commands

Resources

File	When to load
references/kernel-debugging.md	Kernel driver analysis and rootkit detection workflows
references/crash-dump-analysis.md	BSOD and crash dump triage methodology