windbg - Dave's Blog


Data breakpoints in JavaScript

2016 Jun 17, 5:44

The other day I had to debug a JavaScript UWA that was failing when trying to use an undefined property. In a previous OS build this code would run and the property was defined. I wanted something similar to windbg/cdb's ba command that lets me set a breakpoint on read or writes to a memory location so I could see what was creating the object in the previous OS build and what that code was doing now in the current OS build. I couldn't find such a breakpoint mechanism in Visual Studio or F12 so I wrote a little script to approximate JavaScript data breakpoints.

The script creates a stub object with a getter and setter. It actually performs the get or set but also calls debugger; to break in the debugger. In order to handle my case of needing to break when window.object1.object2 was created or accessed, I further had it recursively set up such stub objects for the matching property names.

Its not perfect because it is an enumerable property and shows up in hasOwnProperty and likely other places. But for your average code that checks for the existence of a property via if ( it works well.

PermalinkCommentsdebug debugging javascript

Cdb/Windbg Commands for Runtime Patching

2016 Feb 8, 1:47

You can use conditional breakpoints and debugging commands in windbg and cdb that together can amount to effectively patching a binary at runtime. This can be useful if you have symbols but you can't easily rebuild the binary. Or if the patch is small and the binary requires a great deal of time to rebuild.

Skipping code

If you want to skip a chunk of code you can set a breakpoint at the start address of the code to skip and set the breakpoint's command to change the instruction pointer register to point to the address at the end of the code to skip and go. Voila you're skipping over that code now. For example:

bp 0x6dd6879b "r @eip=0x6dd687c3 ; g"

Changing parameters

You may want to modify parameters or variables and this is simple of course. In the following example a conditional breakpoint ANDs out a bit from dwFlags. Now when we run its as if no one is passing in that flag.

bp wiwi!RelativeCrack "?? dwFlags &= 0xFDFFFFFF;g"

Slightly more difficult is to modify string values. If the new string length is the same size or smaller than the previous, you may be able to modify the string value in place. But if the string is longer or the string memory isn't writable, you'll need a new chunk of memory into which to write your new string. You can use .dvalloc to allocate some memory and ezu to write a string into the newly allocated memory. In the following example I then overwrite the register containing the parameter I want to modify:

.dvalloc 100
ezu 000002a9`d4eb0000 "mfcore.dll"
r rcx = 000002a9`d4eb0000

Calling functions

You can also use .call to actually make new calls to methods or functions. Read more about that on the Old New Thing: Stupid debugger tricks: Calling functions and methods. Again, all of this can be used in a breakpoint command to effectively patch a binary.

PermalinkCommentscdb debug technical windbg

Tweet from David_Risney

2015 Apr 9, 4:34
Scripting in cdb/kd is not pleasant. Using PowerShell to script cdb/kd instead: … . Any other better ways?

WinDbg .cmdtree file format reverse engineered | Debugging

2013 May 22, 3:34

Wrote some scripts that produce .cmdtree files. Nice to find this format definition.

PermalinkCommentsdebug windows windbg technical cmdtree

Debugging Toolbox

2008 Sep 30, 11:14Tools and hints for debugging esp. WinDbg. Some interesting things in here. "...When I'm not debugging applications with Windbg, I'm working on tools (utility software) like those presented in this blog. My tools should help you during your debugging or troubleshooting session. "PermalinkCommentsblog windows debug windbg powershell tool programming

Install Debugging Tools for Windows 32-bit Version

2007 May 20, 5:14Debugging tools for Windows executables.PermalinkCommentsmsdn microsoft c++ c debug debugger development download free programming software tool tools windbg windows cdb

Frequently Used Debugger Commands

2006 Apr 21, 4:52Quick list of Debugging Commands for the Microsoft debuggers windbg and cdbPermalinkCommentstony-schriner debug debugger windows microsoft windbg tools tool
Older Entries Creative Commons License Some rights reserved.