Scribd
Upload
821 views3 pages

Windbg Cheat Sheet

Windbg can be set as the default post-mortem debugger by running windbg.exe -I from the command line. The document then provides information on various Windbg commands to control program flow, set breakpoints, dump memory, edit memory, search memory, set up symbol paths, and dump structures. It recommends setting up Windbg with disassembly, registers, command, and memory windows configured in a specific layout.

Uploaded by

Francell Flood
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as RTF, PDF, TXT or read online on Scribd
821 views3 pages

Windbg Cheat Sheet

Windbg can be set as the default post-mortem debugger by running windbg.exe -I from the command line. The document then provides information on various Windbg commands to control program flow, set breakpoints, dump memory, edit memory, search memory, set up symbol paths, and dump structures. It recommends setting up Windbg with disassembly, registers, command, and memory windows configured in a specific layout.

Uploaded by

Francell Flood
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as RTF, PDF, TXT or read online on Scribd
You are on page 1/ 3

SETUP

------------------------------------------------------
To set windbg as your default post-mortem debugger (run on crash
of programs),
simply run windbg from the command line with the -I option:

C:\wherever\windbg.exe -I

------------------------------------------------------
CONTROL FLOW
g - go / continue / run
p - step over
t - step into

(All further commands also work as ta, tc, tt, tct, th -


stepping in insted of over)

pa 0xaddress - step to address


pc - step to next call
pt - step to next return
pct - step to next call or return
ph - step to next branching instruction

------------------------------------------------------
BREAKPOINTS

bp 0xaddress - Set breakpoint


bl - List breakpoints
bd num - disable breakpoint num
bc num - clear breakpoitn num
ba [e|r|w] 1 0xaddress - break on access [execution|read|write]
size address

sxe ld:dllname - Break on load of module dllname

------------------------------------------------------
DUMP MEMORY

d[d|w|b|a] 0xaddress - dump [dword|word|byte|ascii] at address


d[d|w|b|a] 0xaddress L5 - option L argument defines how many of
them to dump
dd register - dump contents of a register
ddp 0xaddress - dump contents of address, and whatever
it points to
dda 0xaddress - dump contents of address, and print
the string if it exists
u 0xaddress L5 - disassemble at 0xaddress, L
instructions
------------------------------------------------------
EDIT MEMORY

e[d|w|b] 0xaddress newbytes - edit memory

------------------------------------------------------
SEARCH MEMORY

s -[d|w|b|a] 0x00000000 L?0xffffffff searchval


- first option is size (dword, word, byte,
ascii string)
- second option is start address
- third option is end address
- last option is the value to search for
- ex dword: 0x41414141
- ex word 0x4241
- ex byte ff e3 (can be as many as you
like!)
- ex ascii: avacado!

------------------------------------------------------
SYMBOL SETUP - to dump symbols in C:\sym

.sympath .SRV*C:\sym*http://msdl.microsoft.com/download/symbols/
.reload /f

------------------------------------------------------
DUMP STRUCTURES

!teb - dump thread environment block


!peb - dump process environment block
!vadump - dump list of memory pages and info
!lmi modulename - dump the info for module modulename
lm - show loaded modules
k - show call stack
r - show registers
dt structName 0xaddress - display a structure in proper format
if you have symbols

------------------------------------------------------
SUGGESTED SETUP

----------------------------------------------
| | |
| | |
| | |
| | |
| DISASSEMBLY | REGISTERS |
| | |
| |----------------------|
| | |
| | |
| | |
|-----------------------| COMMAND |
| | |
| | |
| | |
| MEMORY | |
| | |
| |- - - - - - - - - - - |
| | |
| | MEMORY / STACK |
| | |
-----------------------------------------------

MEMORY - Virtual: set to esp to show the stack


If you want a generic memdump AND a constant stack, put another
memory window under
command - yes, you can have as many as you like

REGISTERS - I usually check both boxes in the configuration -


changes show up on top and
in red

You might also like