].Io.Handles
// Display all available information.
dx -g @$processHandles
// Displays selected information.
dx -g @$processHandles->Select(o => new { Handle = o->Handle, Type = o->Type, ObjectName = o->ObjectName})
// Filters handles of type "Directory" and displays selected information.
dx -g @$processHandles->Where(o => (o.Type == "Directory"))->Select(o => new { Handle = o->Handle, Type = o->Type, ObjectName = o->ObjectName})
// Get process Ldr first entry (in memory order).
dx -r1 @$process.Environment.EnvironmentBlock.Ldr->InMemoryOrderModuleList.Flink
```
**Execution control flow**
| Command | Usage | Examples | Description |
| ----------------------------------------------------------------------------------------------------------------------------- | ----- | -------- | ----------- |
| [bp, bu, bm (Set Breakpoint)](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bp--bu--bm--set-breakpoint-) | | | |
| [bl (Breakpoint List)](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/bl--breakpoint-list-) | | | |
| [g (Go)](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/g--go-) | | | |
### Userland process crashdump / dump analysis
| Command | Description |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `!analyze -v` | Provides an overview of the dump: process name, error code, stack trace, etc.
More useful for crashdump, limited use for voluntarily taken process dump.
|
| `!peb` | Parses the `Process Environment Block (PEB)` of the process, notably retrieving: the process image file and command line, current directory, loaded `DLLs`, windows title, environment variables. |
| `lm f` | Lists the loaded `DLLs`, with the possibility to click on any `DLL` to retrieve more information on a specific `DLL`: size, file / product version, metadata, etc. |
| `lmDv` | Prints verbose information (as mentioned on `lm f`) for all loaded `DLLs`. |
| `!address` | Lists the address pages and associated information:
- Page type (MEM\_IMAGE, MEM\_MAPPED, MEM\_PRIVATE)
- Page state (MEM\_COMMIT, MEM\_RESERVE, MEM\_FREE)
- Page protection (PAGE\_READWRITE, PAGE\_EXECUTE\_READ, PAGE\_EXECUTE\_READWRITE, etc.)
- Eventual associated file on disk
Can be useful to detect a number of suspicious indicators / anomalies:
- In memory PE (MZ header) not backed by an on-disk file.
- Suspicious PAGE\_EXECUTE\_READWRITE protection.
- Modification of modules usually patched to bypass security mechanism (such as the patching of the amsi.dll to bypass AMSI). Indeed a modification of a module memory will result in the page to change from MEM\_IMAGE to MEM\_PRIVATE.
|
| !address -f:\
Examples:
!address -f:PAGE\_EXECUTE\_READWRITE
!address -f:MEM\_PRIVATE,MEM\_COMMIT
| Filters memory pages based on the specified filter.
All filters in the list are AND-combined.
|
***
### References
* Microsoft Windows Debugging Tools official documentation
* "Modern Debugging with WinDbg Preview" DEFCON 27 workshop by hugsy and 0vercl0k"
* "WinDbg — the Fun Way: Part 1 / 2" by Yarden Shafir