swug july 2010 - windows debugging by sainath
DESCRIPTION
Sainath shares about the tools he uses when he debugs problems in Windows.TRANSCRIPT
Sainath Sainath BT Frontline BT Frontline [email protected]@live.in
MVP – Active DirectoryMVP – Active DirectoryMicrosoft Technet Moderator – Win2k8 , Microsoft Technet Moderator – Win2k8 ,
NetworkingNetworkingMicrosoft Technet Magazine – AuthorMicrosoft Technet Magazine – AuthorMicrosoft Speaker – SWUGMicrosoft Speaker – SWUG
Windows Windows Debugging Debugging
Basic TermsBasic Terms
Process Process Thread Thread User mode User mode Kernel mode Kernel mode Call stack Call stack Register Register ExceptionException
Basic TermsBasic Terms
IRQL IRQL Interrupt Interrupt Free BuildFree Build Check BuildCheck Build PagingPaging Non paged poolNon paged pool Paged poolPaged pool
Basic TermsBasic Terms
Complete Memory Dump Complete Memory Dump
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControlHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\CrashControl
CrashDumpEnabled REG_DWORD 0x0 = NoneCrashDumpEnabled REG_DWORD 0x0 = NoneCrashDumpEnabled REG_DWORD 0x1 = Complete memory dumpCrashDumpEnabled REG_DWORD 0x1 = Complete memory dumpCrashDumpEnabled REG_DWORD 0x2 = Kernel memory dumpCrashDumpEnabled REG_DWORD 0x2 = Kernel memory dumpCrashDumpEnabled REG_DWORD 0x3 = Small memory dump (64KB) CrashDumpEnabled REG_DWORD 0x3 = Small memory dump (64KB)
ASK A QUESTION TO PROCEED ASK A QUESTION TO PROCEED
Debugger Installation Debugger Installation SetupSetup
Http://www.microsoft.com/ddk/debuHttp://www.microsoft.com/ddk/debugginggging
Symbol file Symbol file
public symbols – global public symbols – global variables, FPOvariables, FPO
private symbols – local symbol, private symbols – local symbol, global varglobal var
Debugger Setup Debugger Setup
Problem with Symbol File Problem with Symbol File ERROR: Symbol file could not be found. Defaulted to export ERROR: Symbol file could not be found. Defaulted to export
symbols for <xxx.exe>symbols for <xxx.exe>
Solution Solution Check for the symbol file path Check for the symbol file path Use .reload command Use .reload command
AdPlus ToolAdPlus Tool User mode debugging tool User mode debugging tool Produces memory dumps of an Produces memory dumps of an
application and processesapplication and processes -notify switch notifies user using live -notify switch notifies user using live
messengermessenger
You Cannot You Cannot Debug startup applications Debug startup applications Programs generating lot of debug Programs generating lot of debug
informationinformation
AdPlus ToolAdPlus Tool
Adplus Modes Adplus Modes
Hang ModeHang Mode Crash Mode Crash Mode
First chance exception First chance exception
second chance exception second chance exception
AdPlus ToolAdPlus Tool
Command Line Switches Command Line Switches
Adplus –helpAdplus –help Adplus –hangAdplus –hang Adplus –crashAdplus –crash Adplus –pnAdplus –pn Adplus –iisAdplus –iis
AdPlus ToolAdPlus Tool
Demo 1 Demo 1
Adplus hang dump Adplus hang dump Adplus crah dump Adplus crah dump Configuring symbols Configuring symbols Dumping processDumping process Analyzing dumpAnalyzing dump
Understanding AssemblyUnderstanding Assemblyc pgmc pgm
void main()void main(){{int x =10;int x =10;int y = 20;int y = 20;
x= 30; x= 30; y = 40 ; y = 40 ;
Printf("value of x is %d \n", x); Printf("value of x is %d \n", x); }}
Understanding AssemblyUnderstanding Assembly
Important Note : Important Note : CPU registers and Variables are different in assembly but CPU registers and Variables are different in assembly but
serve similar purposeserve similar purpose
12 Major CPU registers 12 Major CPU registers
AX, BX, CX, DX, SI, DI, CS , IP etc..AX, BX, CX, DX, SI, DI, CS , IP etc..
Declaring variablesDeclaring variables : :
X dw 10;X dw 10;
Y dw 20 ; Y dw 20 ;
Understanding AssemblyUnderstanding Assembly
Assembly Assembly
Mov [x], 10 Mov [x], 10
Mov [y], 20Mov [y], 20
Windbg Windbg
Mov dword ptr [ saiprj!x (0a003456) ], Mov dword ptr [ saiprj!x (0a003456) ], 1010
Assembly ContinuedAssembly Continued
Writing data to registers Writing data to registers
Mov eax, 15 Mov eax, 15
Mov eax, [x]Mov eax, [x]
Windbg Windbg
mov eax, [saipgm!x (a0302934)]mov eax, [saipgm!x (a0302934)]
Assembly ContinuedAssembly Continued
C programC programInt b = 10;Int b = 10;Int a = 20 ; Int a = 20 ; B = b+a ; B = b+a ;
Assembly Assembly mov eax , bmov eax , bAdd [a], eaxAdd [a], eax
Windbg Windbg Mov eax, [saipgm!b ( a0308923)]Mov eax, [saipgm!b ( a0308923)]Add [saipgm!a (02342343)], eaxAdd [saipgm!a (02342343)], eax
Assembly ContinuedAssembly Continued
Mov [x], 1Mov [x], 1
Mov [y], 1 Mov [y], 1
Mov eax, [x]Mov eax, [x]
Add [b], eax Add [b], eax
Inc eax Inc eax
What is the output ???What is the output ???
Registers Registers
Registers are small storage units Registers are small storage units generally 32 or 64bit widegenerally 32 or 64bit wide
Registers are always accessed using Registers are always accessed using names names
Wrong data in the registers are source Wrong data in the registers are source of bug of bug
R command to display registersR command to display registers
Registers Deep DiveRegisters Deep Dive
EAX = contains return values EAX = contains return values
EBX EBX
ECX = contains loop counter infoECX = contains loop counter info
EDX EDX
EIP = points to next instruction to be EIP = points to next instruction to be executedexecuted
ESP = Stack pointer , points to top of ESP = Stack pointer , points to top of stack.stack.
Registers Deep Dive Registers Deep Dive
EBP = Base pointer / Stack Frame EBP = Base pointer / Stack Frame PointerPointer
EBP will be set before function is EBP will be set before function is calledcalled
Reading MemoryReading Memory
Variable Types Variable Types Local variablesLocal variables Global variablesGlobal variables StringsStrings Unicode Unicode Arrays Arrays constants.constants.
Reading MemoryReading Memory
DD DD – display memory 32 bitsDD – display memory 32 bits Dw – display as words ( 16 bits ) Dw – display as words ( 16 bits ) DT – display type DT – display type
Example:Example:Eg: dt nt!<function name>Eg: dt nt!<function name>
dt yourexe!<function name>dt yourexe!<function name>
StacksStacks
Program 1 Program 1 function 1 function 1 function 2 function 2 program 2 program 2 calling function 1 calling function 1 (assigns (assigns
stack ) stack ) return return ( clears stack ) ( clears stack ) calling function 2 calling function 2
Stacks ContinuedStacks Continued
Every thread has 2 stacks Every thread has 2 stacks • User Mode 1 MBUser Mode 1 MB• Kernel Mode 12 KB Kernel Mode 12 KB
When ever a function is called you see When ever a function is called you see a return instruction.a return instruction.
Deep Dive Stacks.Deep Dive Stacks.
Dd esp Dd esp 0012fe6c 004113e0 00000005 0000000a 0127f5580012fe6c 004113e0 00000005 0000000a 0127f558
0012fe7c 007dca76 7ffd8000 cccccccc cccccccc0012fe7c 007dca76 7ffd8000 cccccccc cccccccc
004113e0 = return address 004113e0 = return address
00000005 = argument 1 00000005 = argument 1
0000000a = argument 2 0000000a = argument 2
Questions Please Questions Please