2,970 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
0
votes
0
answers
98
views
How to write a dump analysis tool in Python without using PYKD.PYD? [closed]
I used to work with heap_stat.py, a Python script, to be run inside a Windbg session after opening a dump file.
As PYKD.PYD is outdated, I'm looking for another solution and I've been informed that ...
0
votes
1
answer
93
views
Dump Analysis in WinDbg - high memory consumption
In a dump file I see many System.Int64[] objects totalling ~4.5 GB. All are unrooted except one.
Visual Studio reports the rooted instance is referenced by the static variable NtProcessInfoHelper....
0
votes
1
answer
86
views
WinDbg cannot find libc.so and libcoreclr
I am trying to debug a .Net memory dump taken from an Ubuntu system in WinDbg. When I try to load the dump I get the following errors:
Module name Error
libc.so The system ...
Steve's user avatar
- 9,635
0
votes
1
answer
73
views
Unable to find required GLIBC private symbols
I am trying to analyze a memory dump obtained with dotnet-dump from a Ubuntu container in WinDbg to find an unmanaged memory leak.
I have been able to load the dump, but whenever I try to run !heap -s,...
0
votes
0
answers
309
views
In WinDBG, issuing .excr command shows "Unable to get exception context, HRESULT 0x8000FFFF" instead of the expected registers information
I am following a very basic tutorial on WinDBG (windbg tutorial ytb [not guaranteed broken link in the future]).
Is being quite a nightmare, at least from my knowledge base.
My context is Windows 11....
0
votes
0
answers
110
views
Getting a fatal error in Windbg on strat up of target virtual machine
I just setup this WinDbg debugging configuration yesterday and I'm getting a fatal error of memory corruption. The target machine is VMWare Workstation 17.5.x over a COM port named pipes. Secure boot ...
0
votes
1
answer
106
views
WinDbg Connects to Remote Debugger But Cannot Load Module
I am running WinDbg on my development Win10 machine and connecting via pipe to my Win10 VM. WinDbg is definitely talking to my VM and indicates as such with "Debuggee is running". If I break ...
0
votes
0
answers
34
views
Debug KMD on Windows 11 ARM64
I generated Default KMD for ARM64 In Visual Studio on my Windows 10 64. Just to get remote debugger working.
Built for test signing.
I Previsioned the Target Arm64 System.
I Can run Windbg in Kernal ...
0
votes
0
answers
39
views
I cannot execute extension plugin methods in WinDBG even after loading the correct versions of the SOS.dll and mscordacwks.dll
I am analyzing a .NET dump taken from a remote machine and analyzing it in a development machine. I have loaded the correct versions of the SOS.dll and mscordacwks.dll, the same as the clr.dll ...
-1
votes
1
answer
60
views
How to programmatically auto-detach WinDbg from a process after it exits (in headless VM environments)?
We have an internal test automation tool that runs tests on VMs. For each test:
-A new process is spawned.
-After execution, it ends with sys.exit(return_code) to trigger the next test.
Recently, I ...
1
vote
1
answer
151
views
Zero values for stack base and stack limit addresses in NT_TIB struct (Kernel Mode Windows)
When running the !pcr command in Windbg, the NT_TIB structure shows zeros for StackBase and StackLimit. I am debugging drivers on Windows 7 x32 Ultimate using Windbg via COM port. OS is running on ...
1
vote
1
answer
105
views
Unrecognized command 'xxx' because managed hosting failed or was disabled
I am trying to debug a .NET 8 application. I loaded the SOS extension
.load C:\Users\<username>\.dotnet\tools\.store\dotnet-sos9円.0.621003\dotnet-sos9円.0.621003\tools\net8.0\any\win-x64\sos.dll
...
0
votes
0
answers
64
views
How to disable test mode while enabling kernel debugging mode in Windows?
The following command disables test mode in Windows:
bcdedit /set testsigning off
The following command can enable kernel debugging mode in Windows:
bcdedit /debug on
Every time I enable kernel ...
0
votes
1
answer
71
views
Use WinDbg LINQ with C/C++ objects
I have an array of structs stores as pointer + length and would like to print a deep field of each.
I can do it using .for and temporary registers:
.for (r $t0 = 0; @$t0 < @@c++(length); r $t0 = @$...
-2
votes
1
answer
155
views
How to dump program execution / control-flow and local variables
Let's suppose I have program like this:
int test(int n) {
n++;
std::cout << n << std::endl
n += 15;
return n + 1;
}
int main(int argc, char** argv) {
auto result = ...