README.md
July 22, 2019 · View on GitHub
If you're more familiar with Linux and GDB than with Windows, but find yourself needing/wanting to learn Windows debugging, this is the cheat sheet for you.
Breakpoints
| GDB Command | WinDBG Command | Description | Usage/Examples |
|---|---|---|---|
b/break | bp | Set breakpoint | |
disable | bd # | Disable breakpoint | |
enable | be # | Enable breakpoint | |
info breakpoints/ib | bl | List breakpoints | |
watch | ba | Break on access(read/write) | ba [r|w|e] [Size] Addr |
Running/Stepping
| GDB Command | WinDBG Command | Description |
|---|---|---|
r/run | g .restart | Run program |
s/si | p | Step over |
n/ni | t | Step into |
finish | pt | Step to next return |
| None | pc | Step to next call |
u | pa | Step to address |
Variables, Symbols, and Memory
| GDB Command | WinDBG Command | Description | Usage/Example |
|---|---|---|---|
x* | d* | Dump memory at address | a = ascii chars u = Unicode chars b = byte + ascii w = word (2b) W = word (2b) + ascii d = dword (4b) c = dword (4b) + ascii q = qword (8b) dd 0x1000000 |
set {int}addr = | e* | Edit memory | ed 0x1000000 deadbeef a = ascii string za = ascii string (NULL-terminated) u = Unicode string zu = Unicode string (NULL-terminated) e[a|u|za|zu] addr "String" |
print/p | dt/dv | Print variable | dt ntdll!_PEB dt ntdll!_PEB @$peb |
disasm | u | Disassemble at address/symbol | u kernel32!CreateProcessAStub |
* (deref) | poi | Dereference pointer | u poi(ebp+4) |
| None | x | Examine symbols | x *! x /t /v MyDll!* list symbols in MyDll with data type, symbol type, and size |
C++ Expression Syntax
| GDB Command | WinDBG Command | Description | Usage/Example |
|---|---|---|---|
p (Datatype *) &variable | dx (Datatype *) &variable | displays a C++ expression | dx (nt!_EPROCESS *) &nt!PsIdleProcess |
p [expression] | ?? | Evaluate C++ expressions. Used with the C++ expression parser - @@c++(), that supports operators, registers, macros. etc. See docs for a full list | ?? @@c++(1+2) |
Registers
Access registers with @, like @eip.
| GDB Command | WinDBG Command | Description | Usage/Example |
|---|---|---|---|
info registers | r | Show registers | r Reg1 Reg2 r Reg:Type Type = data format in which to display the register (i.e.: r eax:uw) ib = Signed byte ub = Unsigned byte iw = Signed word (2b) uw = Unsigned word (2b) id = Signed dword (4b) ud = Unsigned dword (4b) iq = Signed qword (8b) uq = Unsigned qword (8b) f = 32-bit floating-point d = 64-bit floating-point |
set reg = | r Reg=Value | Set register |
Getting information
| GDB Command | WinDBG Command | Description | Usage/Example |
|---|---|---|---|
info proc mappings | !address | Show virtual memory map and permissions | !address addr |
print/p | x | Examine symbols | x kernel32!*CreateProcess* |
| None | ln | List nearest symbol to address | |
backtrace/bt | k | Stack backtrace | |
| None | !exchain | View SEH Chain | |
Other useful commands
!peb – dumps Process Environment Block
dt ntdll!_PEB @$peb — dumps more PEB info of our process
Tips
The WinDBG executable is installed in C:\Program Files (x86)\Windows Kits\10\Debuggers\x86[64]/. If it's not in your path, add it by going to the Edit system environment variables menu, and append to the Path variable.
$peb is a "pseudo-register", and there are others that hold useful values. Some are $teb, $csp, $curprocess.