WinDGB.pdf

(227 KB) Pobierz
Debugging Windows Applications with IDA WinDbg Plugin
Copyright 2011 Hex-Rays SA
Quick overview:
The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine
(dbgeng) that is used by Windbg, Cdb or Kd.
To get started, you need to install the latest Debugging Tools from Microsoft website:
https://msdn.microsoft.com/en-us/windows/hardware/hh852365
or from the Windows SDK / DDK package.
Please make sure you should install the
x86
version of the debugging tools which is used by both IDA
Pro and IDA Pro 64. The x64 version will NOT work.
After installing the debugging tools, make sure you select « Debugger / Switch Debugger » and select
the WinDbg debugger.
Also make sure you specify the correct settings in the “Debugger specific options” dialog:
•
•
•
•
•
User mode:
Select this mode for user mode application debugging (default mode)
Kernel mode:
Select this mode to attach to a live kernel.
Non Invasive debugging:
Select this mode to attach to a process
non-invasively
Output flags:
These flags tell the debugging engine which kind of output messages to display
and which to omit
Kernel mode debugging with reconnect and initial break:
Select this option when
debugging a kernel and when the connection string contains 'reconnect'. This option will assure
that the debugger breaks as soon as possible after a reconnect.
To make these settings permanent, please edit the IDA\cfg\dbg_windbg.cfg file.
To specify the debugging tools folder
you may add to the PATH environment variable the location of
Windbg.exe or edit %IDA%\cfg\ida.cfg and change the value of the DBGTOOLS key.
After the debugger is properly configured, edit the process options and leave the connection string
value empty because we intend to debug a local user-mode application.
Now hit F9 to start debugging:
The Windbg plugin is very similar to IDA Pro's Win32 debugger plugin, nonetheless by using the
former, one can benefit from the command line facilities and the extensions that ship with the
debugging tools.
For example, one can type “!chain” to see the registered Windbg extensions:
“!gle” is another command to get the last error value of a given Win32 API call.
Another benefit of using the Windbg debugger plugin is the use of symbolic information.
Normally, if the debugging symbols path is not set, then the module window will only show the
exported names. For example kernel32.dll displays 1359 names:
Let us configure a symbol source by adding this environment variable before running IDA:
set _NT_SYMBOL_PATH=srv*C:\Temp\pdb*http://msdl.microsoft.com/download/symbols
It is also possible to set the symbol path directly while debugging:
and then typing “.reload /f” to reload the symbols.
Now we try again and notice that more symbol names are retrieved from kernel32.dll:
Now we have 5818 symbols instead!

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin