{"id":70,"date":"2006-10-29T07:00:53","date_gmt":"2006-10-29T12:00:53","guid":{"rendered":"http:\/\/www.nynaeve.net\/?p=70"},"modified":"2019-12-13T17:41:45","modified_gmt":"2019-12-13T22:41:45","slug":"debugger-commands-review","status":"publish","type":"post","link":"http:\/\/www.nynaeve.net\/?p=70","title":{"rendered":"Debugger commands review"},"content":{"rendered":"

This posting is a master list of all the other posts and post series that cover different WinDbg commands, whether they be built-in commands, extension commands, or even third-party extension commands.<\/p>\n

    \n
  1. Using SDbgExt to aid your debugging and reverse engineering efforts (part 1)<\/a>. SDbgExt is the debugger extension that I maintain and make publicly available. This series provides a high-level overview of the different commands that it offers.<\/li>\n
  2. SDbgExt extensions, part 2<\/a><\/li>\n
  3. Useful WinDbg commands: .formats<\/a><\/li>\n
  4. Using knf<\/em> to track down excessive stack usage<\/a>. This trick is discussed in a section of the “Beware of stack usage with the new network stack in Windows Vista<\/a>” post.<\/li>\n
  5. Removing kernel patching on the fly with the kernel debugger<\/a>. This article discusses how you can use the !chkimg<\/em> command to remove patches and hooks on loaded module code at runtime. (This particular command is also available and applicable to the user mode debuggers, and not just the kernel debugger.)<\/li>\n
  6. Debugger flow control: More on breakpoints (part 2)<\/a>. This article explores some of the inner workings of the various breakpoints supported by WinDbg. In addition, it describes the .apply_dbp<\/em> command that can be used to apply a set of hardware breakpoints to the current register context, or a saved register context image in-memory.<\/li>\n
  7. SDbgExt 1.09 released (support for displaying x64 EH data)<\/a>. This article describes the !fnseh<\/em> command in SDbgExt that can be used to view exception handlers and unwind handlers for x64 targets from the debugger.<\/li>\n
  8. Useful debugger commands: .writemem and .readmem<\/a>. This article covers the .writemem<\/em> and .readmem<\/em> commands that can be used to move large sections of raw data into or out of the debugger.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    This posting is a master list of all the other posts and post series that cover different WinDbg commands, whether they be built-in commands, extension commands, or even third-party extension commands. Using SDbgExt to aid your debugging and reverse engineering efforts (part 1). SDbgExt is the debugger extension that I maintain and make publicly available. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[2],"tags":[],"_links":{"self":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/70"}],"collection":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=70"}],"version-history":[{"count":1,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/70\/revisions"}],"predecessor-version":[{"id":671,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=\/wp\/v2\/posts\/70\/revisions\/671"}],"wp:attachment":[{"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=70"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=70"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.nynaeve.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=70"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}