Skip to content

alex-ilgayev/windbg-kernel-debug-cheat-sheet

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

2 Commits
 
 

Repository files navigation

WinDBG Kernel Debug Cheat-Sheet

I won't cover the basic commands (lm/dt and more), but try to focus other unique but useful WinDBG utilities.

General Useful Commands

kd> ln fffff8014b60e180 - Shows the symbol for given address
kd> .writemem <dump_path> 0x80f5e000 L 0xA000 - Dumps a PE file to disk
kd> uf /c 0x833cfb43 - Unassemble Function - show only function calls.
kd> !dh 0x80f5e000 - Tries to parse a PE image header
kd> !dh -e ndis - List export functions for loaded module
kd> lm m ndis - Show specific module

Processes

kd> !process 0 0 - List all processes
kd> !process 0 0 cmd.exe - Find process
kd> !process -1 0 - Current process context
kd> .process /i ffffd302f03020c0 - Switch to usermode process VAS
kd> .reload -user - Reload user-mode symbols
kd> bp /p ffffd302f03020c0 ntdll!NtCreateFile - Breakpoint in context of usermode process
kd> !token 0xffffaa08ba807635 - Info about a process token
kd> !pte fffff8016037a9f8 - Convert VA to PA

Drivers Specific

kd> !drvobj \Driver\kbdclass 2 - Extensive info about driver object
kd> !devobj 0x83272ca0 - Device object info
kd> !devstack 0x83272ca0 - Device stack for a device object
kd> !vpb 0x8325c298 - Volume Parameter Block: map between dev objects and physical devices
kd> !object \Device\Ide\IdeDeviceP0T0L0-0 - Query driver object
kd> !object \global??\c: - Query symbolic link object
kd> .trap ffffa482a55cd990 - Set to trap frame context (to observe kernel registers). trap frame could be observed using kv command

Memory

kd> !pool 0x833cfb43 - Info about pool page region
kd> !poolfind Driv - Scans pools for specific tag
kd> !address 0x833cfb43 - Info about address region
kd> s-b 833cb000 833cb000+0x57000 4d 5a 90 00 - Searching for MZ in a region

Extensions

kd> !fltkd.help - Various commands for dealing with filter drivers
kd> !fltkd.filters - Show filter list
kd> !ndiskd.help - Various commands for dealing with NDIS drivers
kd> !ndiskd.miniports - List of miniport NDIS drivers
kd> !ndiskd.minidriver ffffd7050de514f0 -handler - Lists all handlers for specific driver
kd> !ndiskd.filters - Query NDIS filters for each adapter
kd> !wdfkd.help - Various commands for dealing with WDF drivers

Useful Exported NTOSKRNL Symbols

kd> dp nt!PsInitialSystemProcess L1 - SYSTEM EPROCESS pointer
kd> dp nt!MmPteBase L1 - Page table base address. The value is being randomized in boot process
kd> dp nt!MmHighestUserAddress L1 - Highest address for userspace VA
kd> dp nt!MmSystemRangeStart L1 - Lowest address for kernel VA
kd> x nt!PsLoadedModuleList - Loaded modules in kernel (_LIST_ENTRY)
kd> dt <list_base> nt!_KLDR_DATA_TABLE_ENTRY -l InLoadOrderLinks.Flink FullDllName - Traversing loaded modules in kernel
kd> dq nt!SeLoadDriverPrivilege L1 - Privilege for loading a driver
kd> dps nt!HalDispatchTable - HAL dispatch table
kd> dp nt!PsJobType L1 - Job creation configuration (_OBJECT_TYPE)
kd> dp nt!PsProcessType L1 - Process creation configuration (_OBJECT_TYPE)
kd> dp nt!PsThreadType L1 - Thread creation configuration (_OBJECT_TYPE)
kd> db nt!PspNotifyEnableMask L1 - Flag which can disable kernel notify routines
kd> rdmsr 0xc0000082 - System call handler (KiSystemCall64Shadow)

About

Helpful WinDBG command for kernel debugging

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published