windbg-info

The project intends to be a repository for links related to windbg that I found useful, interesting or have used and wish to keep in an easelly accessible list.

WinDbg Preview

I have not used the new version but it looks promessing.

• Windbg data model
• JavaScript Debugging Walkthrough
• WinDbg, Debugger Objects, and JavaScript! Oh, My!

WinDbg

General links

• http://www.windbg.org/

• A good collection of reverse engineering links, including several for windbg

• lowleveldesign - debugging-using-windbg

• Using .shell command

• Windbg versions comparison disctuion thread

• MEX is Your Friend: Analyzing 32-bit Processes in a 64-bit Kernel Dump

• Old but interesting - Sample Windbg extension to recurse, filter and pipe commands

Analyzing .net using windbg

• SOS Extension - Unraveling .NET with the Help of WinDBG
• old but interesting
  • ASP.NET Memory Leak Case Study: Sessions Sessions Sessions…

Analyzing JavaScript using windbg

• Windbg Tricks - JavaScript Windbg Instrumentation

• coreland helpful links

  • Exploit writing tutorial part 11 : Heap Spraying Demystified
  • DEPS – Precise Heap Spray on Firefox and IE10
• WinDBG and JavaScript Analysis

Cheat-sheets

• http://windbg.info/doc/1-common-cmds.html
• https://sites.google.com/site/jozsefbekes/Home/windows-programming/windbg

Scripting

• Windbg Python scripting wrapper - pykd

• Set of python scripts for WinDBG over pykd

• Windbglib, a wrapper around pykd.pyd (for Windbg)

• Anti-Antidebugging WinDbg Scripts

• modified file_activity script from “Practical Reverse Engineering”

Plugins, extensions and enhancements

lynnux/windbg_hilight github link - tuts4you link

• A windbg plugin to highlight text in Disassembly and Command windows. Support x86 and x64.
• I have used it. It slows the view down a bit when stepping through, but it’s worth the wait

bigLasagne

• Contains several UI enhancements and an extension

• Assembly syntax highlighting

• Command output window multi-color highlighting
• kdfiles extension

MEX Debugging Extension for WinDbg

Windbg grep extension

WinDBG Anti-RootKit Extension

Intel’s Debug Extensions for WinDbg

Application Verifier

• windbg application verifier extension

  • interesting related link - tracking-handle-misuse-using-application-verifier-and-windbg
  • possible prerequisite - enable-application-verifier

• Exploring Heap-Based Buffer Overflows with the Application Verifier