| name | windbg |
| description | Auth/lab ref: Microsoft's debugger for user-mode and kernel-mode Windows debugging, crash dump analysis, driver reversing, and rootkit analysis. |
| license | MIT |
| compatibility | Windows; Microsoft Store (WinDbg Preview) or Windows SDK; supports x86/x64/ARM64. |
| metadata | {"author":"AeonDave","version":"1.1"} |
WinDbg
Microsoft's debugger — kernel-mode debugging, crash dump analysis, driver reversing, and advanced user-mode debugging.
Installation
# WinDbg Preview (recommended — modern UI, TTD support)
winget install --id Microsoft.WinDbg --accept-source-agreements
# Classic WinDbg (part of Windows SDK)
# Download from https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
# Symbol server setup (critical for useful debugging)
# In WinDbg:
.sympath srv*C:\Symbols*https://msdl.microsoft.com/download/symbols
.reload
Quick Start — User Mode
# Open executable
File -> Open Executable -> select target.exe
# Or attach to running process
File -> Attach to a Process -> select PID
# Set breakpoint and run
bp kernel32!CreateFileW
g # Go (run)
Quick Start — Kernel Mode
# Enable kernel debugging on target
bcdedit /debug on
bcdedit /dbgsettings net hostip:192.168.1.100 port:50000
# In WinDbg: File -> Kernel Debug -> Net -> enter key from target
# Or: File -> Open Crash Dump -> load .dmp file
Essential Commands
Execution Control
| Command | Purpose |
|---|
g | Go (continue) |
p | Step over |
t | Step into (trace) |
pt | Step to next return |
pc | Step to next call |
gu | Step out (go up) |
bp ADDR | Set breakpoint |
bp MODULE!FUNC | Breakpoint on function |
bu MODULE!FUNC | Deferred breakpoint (module not yet loaded) |
ba r4 ADDR | Hardware breakpoint (read 4 bytes at ADDR) |
ba w4 ADDR | Hardware breakpoint (write 4 bytes) |
bl | List breakpoints |
bc * | Clear all breakpoints |
.restart | Restart debugging session |
Inspection
| Command | Purpose |
|---|
r | Show registers |
r rax=0 | Set register value |
db ADDR | Display bytes |
dd ADDR | Display DWORDs |
dq ADDR | Display QWORDs |
da ADDR | Display ASCII string |
du ADDR | Display Unicode string |
dps ADDR | Pointer-sized values with symbols |
u ADDR | Unassemble (disassemble) |
uf FUNC | Unassemble function |
k | Stack trace |
kP | Stack trace with parameters |
~ | List threads |
~Ns | Switch to thread N |
.frame N | Switch to stack frame N |
Memory Search
| Command | Purpose |
|---|
s -a RANGE "string" | Search ASCII string |
s -u RANGE L1000 "string" | Search Unicode string |
s -b RANGE 4D 5A | Search byte pattern (MZ header) |
.writemem FILE ADDR L SIZE | Dump memory to file |
Module and Symbol
| Command | Purpose |
|---|
lm | List loaded modules |
lm m ntdll | Module info for ntdll |
x ntdll!Nt* | List symbols matching pattern |
ln ADDR | Nearest symbol to address |
.reload /f | Force reload symbols |
Process and Thread
| Command | Purpose |
|---|
!process 0 0 | List all processes (kernel) |
!process ADDR 7 | Full process info |
.process /i ADDR | Switch context to process (kernel) |
!peb | Process Environment Block |
!teb | Thread Environment Block |
!handle | List handles |
!dlls | Loaded DLL list with details |
Crash Dump Analysis
# Open dump file
File -> Open Crash Dump -> select .dmp
# First commands after loading a dump:
!analyze -v # Automated crash analysis (start here)
.ecxr # Switch to exception context record
k # Stack trace at crash
lm # Loaded modules
!process 0 0 # Process list
BSOD Analysis
# After !analyze -v:
.bugcheck # Bug check code and params
!pool ADDR # Pool analysis for pool corruption
!verifier # Driver verifier info
!irp ADDR # IRP analysis
dt nt!_DRIVER_OBJECT ADDR # Inspect driver object
Kernel Mode Malware Analysis
Driver/rootkit analysis
# List all drivers
lm t n # List all modules by type
# Find suspicious drivers
!object \Driver # List driver objects
!drvobj \Driver\suspect 7 # Full driver object listing
# Inspect driver dispatch routines
dt nt!_DRIVER_OBJECT ADDR
dps ADDR+0x70 L1C # MajorFunction table (IRP handlers)
# SSDT hook detection
dps nt!KiServiceTable L100
# Compare each entry — hooks point outside ntoskrnl range
# IDT analysis
!idt # Interrupt Descriptor Table
Process hiding detection
# Cross-reference process lists
!process 0 0 # Active process list (via PsActiveProcessList)
!for_each_process "r $t0 = @$proc; .printf \"%p %s\\n\", @$t0, @@c++(@$t0->ImageFileName)"
# Compare with direct EPROCESS walk for hidden processes
User Mode Malware Analysis
Injection detection
bp kernel32!VirtualAllocEx
bp kernel32!WriteProcessMemory
bp kernel32!CreateRemoteThread
bp ntdll!NtMapViewOfSection
g
# On hit: inspect target process handle and injected data
dd @rcx # Buffer being written
API monitoring with breakpoint commands
# Log all CreateFile calls without stopping
bp kernel32!CreateFileW ".printf \"CreateFile: %mu\\n\", @rcx; gc"
# Log registry operations
bp advapi32!RegOpenKeyExW ".printf \"RegOpen: %mu\\n\", poi(@rsp+8); gc"
# Log network connections
bp ws2_32!connect "dd @rdx L4; gc"
Time Travel Debugging (TTD)
# Record execution (WinDbg Preview)
File -> Launch Executable (Advanced) -> check "Record with Time Travel Debugging"
# After recording — navigate backwards:
g- # Reverse continue
p- # Reverse step over
t- # Reverse step into
# Find when memory was written:
ba w4 ADDR # Set write watchpoint
g- # Go backwards until write
# TTD queries (LINQ-style):
dx @$cursession.TTD.Calls("kernel32!CreateFileW")
dx @$cursession.TTD.Calls("ntdll!NtCreateThreadEx").Count()
WinDbg Scripting
# Conditional breakpoint with logging
bp kernel32!VirtualAlloc "j (@r8==0x40) '.printf \"RWX alloc: size=%x\\n\",@rdx; gc' ; 'gc'"
# Walk a linked list
!list -t nt!_LIST_ENTRY.Flink -x "dt nt!_EPROCESS @$extret" ADDR
# Extension commands
.load C:\path\to\extension.dll
!mex.help # MEX extension commands
Resources
