WinDbg Kernel

Kernel exploration

CheatSheet

Symbols and types

Memory exploration

Display Debugger Object Model Expression (dx)

dx <CPP_EXPRESSION>

// Displays information about the specified variable (using the variable address directly or the variable eventual symbol).
dx (<TYPE> *) <ADDRESS>
dx (<TYPE> *) &<VARIABLE>
// If the variable is a pointer to an object.
dx (<TYPE> **) &<VARIABLE>

// Examples:
dx -r1 (ntkrnlmp!_EPROCESS *) 0xffffa10d10c37080
dx (nt!_EPROCESS *) &nt!PsIdleProcess
dx *(nt!_OBJECT_TYPE **) &nt!AlpcPortObjectType

// Displays the first debugging session processes as a grid view.
dx -g Debugger.Sessions.First().Processes

// Displays the first debugging session processes as a grid view.
dx -g Debugger.Sessions.First().Processes

// Displays information about the process PID in the first debugging session.
dx Debugger.Sessions.First().Processes[<DECIMAL_PID>]

// Displays the threads of the first or specified process in the first debugging session processes as a grid view.
dx -g Debugger.Sessions.First().Processes.First().Threads
dx -g Debugger.Sessions.First().Processes[<DECIMAL_PID>].Threads

// Displays the loaded module of the first or specified process in the first debugging session processes as a grid view.
dx -g Debugger.Sessions.First().Processes.First().Modules
dx -g Debugger.Sessions.First().Processes[<DECIMAL_PID>].Modules

// Retrieve the first or specified thread of the specified process in the first debugging session.
dx -r1 Debugger.Sessions.First().Processes[<DECIMAL_PID>].Threads.First()
dx -r1 Debugger.Sessions.First().Processes[<DECIMAL_PID>].Threads[<DECIMAL_THREAD_ID>]

// Stores the specified process as a variable, allowing later reference to the process properties.
dx @$process = Debugger.Sessions.First().Processes[<DECIMAL_PID>]
dx @$process->Name
dx @$process->Threads
// Get process Ldr.
dx -r2 (_PEB_LDR_DATA *) @$process.Environment.EnvironmentBlock.Ldr

// Stores the specified process handles in a variable and display all or selected information about each handle.
dx @$processHandles = Debugger.Sessions.First().Processes[<DECIMAL_PID>].Io.Handles
// Display all available information.
dx -g @$processHandles
// Displays selected information.
dx -g @$processHandles->Select(o => new { Handle = o->Handle, Type = o->Type, ObjectName = o->ObjectName})
// Filters handles of type "Directory" and displays selected information.
dx -g @$processHandles->Where(o => (o.Type == "Directory"))->Select(o => new { Handle = o->Handle, Type = o->Type, ObjectName = o->ObjectName})

// Get process Ldr first entry (in memory order).
dx -r1 @$process.Environment.EnvironmentBlock.Ldr->InMemoryOrderModuleList.Flink

Execution control flow

Userland process crashdump / dump analysis


References

  • Microsoft Windows Debugging Tools official documentation

    https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/

  • "Modern Debugging with WinDbg Preview" DEFCON 27 workshop by hugsy and 0vercl0k"

    https://github.com/hugsy/defcon_27_windbg_workshop

  • "WinDbg — the Fun Way: Part 1 / 2" by Yarden Shafir

    https://medium.com/@yardenshafir2/windbg-the-fun-way-part-1-2e4978791f9b

    https://medium.com/@yardenshafir2/windbg-the-fun-way-part-2-7a904cba5435

Last updated