https://github.com/bluecmd/windbg-call
Helper allowing calls into WinDbg from inside the target being debugged
https://github.com/bluecmd/windbg-call
Last synced: about 1 year ago
JSON representation
Helper allowing calls into WinDbg from inside the target being debugged
- Host: GitHub
- URL: https://github.com/bluecmd/windbg-call
- Owner: bluecmd
- Created: 2024-04-19T15:00:49.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2024-04-19T15:17:41.000Z (about 2 years ago)
- Last Synced: 2025-03-05T23:46:33.623Z (about 1 year ago)
- Language: JavaScript
- Size: 4.88 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
## Background
This is a library implementing primitives to call into, and return values from, a WinDbg instance while being debugged.
## Why?
This is useful for example when debugging a kernel issue triggered from user-mode, allowing for things like setting breakpoints based on local addresses, logging outside of the context of the target, and building macros.
## Examples
Set a breakpoint when a buffer is read:
```cpp
callDebugger("ba r8 0x%p", &InputBuffer);
```
Alternatively, you can request data that the kernel has access to:
```cpp
void* eprocAddr = *(void**)callDebugger("$retInt64(State.PseudoRegisters.General.proc.address)");
printf("EPROCESS @ 0x%p\n", eprocAddr);
```
You can also log messages to the WinDbg session. This is especially useful if you are relying on console output from inside VMs and/or using snapshots which would otherwise cause you to lose log output.
```cpp
logDebugger("Input buffer @ 0x % 016llx", &InputBuffer);
```
## Usage
Load it inside your WinDbg session like this:
```
.scriptload C:\Shared\callhlp.js
```
Alternatively, if you want to reload the script, do it like this:
```
.scriptunload C:\Shared\callhlp.js; .scriptload C:\Shared\callhlp.js
```
Then instead of doing `g` or pressing "Go", run `dx Debugger.State.Scripts.callhlp.Contents.run()` which will resume the execution until a breakpoint is hit while also catering to any calls into the debugger.