https://github.com/f1zm0/windbg-cheatsheet
WinDBG notes and commands cheatsheet
https://github.com/f1zm0/windbg-cheatsheet
debugging windbg windows windows-internals
Last synced: 16 days ago
JSON representation
WinDBG notes and commands cheatsheet
- Host: GitHub
- URL: https://github.com/f1zm0/windbg-cheatsheet
- Owner: f1zm0
- Created: 2021-03-14T20:40:59.000Z (over 5 years ago)
- Default Branch: main
- Last Pushed: 2022-04-17T17:09:25.000Z (about 4 years ago)
- Last Synced: 2025-02-25T21:47:01.408Z (over 1 year ago)
- Topics: debugging, windbg, windows, windows-internals
- Homepage:
- Size: 23.4 KB
- Stars: 5
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# WinDBG Cheatsheet
* [Setup](#setup)
* [Symbols](#symbols)
* [Command Reference](#command-reference)
* [Registers](#registers)
* [Memory](#memory)
* [Strings](#strings)
* [Breakpoints](#breakpoints)
* [Tracing](#tracing)
* [Disassembly](#disassembly)
* [Modules](#modules)
* [NTAPI Structures](#ntapi-structures)
## Setup
### Symbols
Download symbols locally
```
.symfix+ c:\symbols
.reload
```
## Command Reference
### Registers
| Function | Command | Examples |
| --------------------- | ----------------- | ----------- |
| show all registers | `r` | - |
| show registry content | `r ,[]` | `r rax,rsp` |
| set registry value | `r @=` | `r @rax=0` |
### Memory
| Function | Command | Type / Size | Examples |
| ------------------------------------------- | -------------------- | --------------------- | -------------- |
| display memory at address | `d* [format]` | bytes: `db`
words:`dw`
dwords: `dd`
qwords: `dq`
pointer: `dp` | `db @rax L4` |
| edit memory at address | `e* [ ...]` | bytes: `eb`
word: `ew`
dword: `ed`
qword: `eq`
pointer `ep` | `eb @ip a3 b6 c9` |
| show protection attributes | `!vprot ` | memory page | |
| dereference memory at address | `d* poi()` | | `dq poi(@rax)` |
### Strings
| Function | Command | Type / Size | Examples |
| ------------------------------------------- | -------------------- | --------------------- | -------- |
| display string at address | `d* ` | ascii: `da`
unicode:`du` | `da 7ffe040d0110` |
| edit string at address | `e* [ ...]` | ascii: `ea`
unicode:`eu` | `ea 7ffe040d0110 "AAAA"` |
### Breakpoints
| Function | Command | Examples |
| ------------------------------------------------------------------ | ------- | -------------------------- |
| set a breakpoint | `bp` | `bp kernel32!VirtualAlloc` |
| set unresolved breakpoint (becomes `bp` when the module is loaded) | `bu` | `bu test!TestFunc` |
| set breakpoint on module function[s] using pattern | `bm` | `bm wow64!*` |
| clear all breakpoints | `bc` | `bc *` |
### Tracing
| Function | Command |
| ------------------------------------------- | ---------- |
| go (or resume execution) | `g` (F5) |
| single step | `p` (F10) |
| step to address | `p ` |
| toggle display of registers after each step | `pr` |
### Disassembly
| Function | Command | Examples |
| -------------------------------- | -------------- | ------------------------------ |
| unassemble | `u ` | `u kernel32!VirtualAlloc+0x4f` |
| unassemble from address at pointer | `u poi()` | `u poi(777a9228)` |
| unassemble function with offsets | `uf /o [addr]` | `uf /o amsi!AmsiOpenSession` |
### Modules
| Function | Command | Examples |
| --------------------------------- | ----------------- | ------------- |
| list loaded (or deferred) modules | `lm` | - |
| check if a module is loaded | `lm m ` | `lm m amsi` |
| break when a module is loaded | `sxe ld ` | `sxe ld amsi` |
| show functions exported by the module (reads EAT) | `x !` | `x ntdll!*Allocate*` |
## NTAPI Structures
| Command | Function | Examples |
| ----------------- | --------------------------------- | ------------- |
| `r $teb` | display TEB base address | - |
| `r $peb` | display PEB base address | - |
| `dt ntdll!_PEB @$peb` | display type `ntdll!_PEB` starting from address stored in `$peb` | - |
| `dt ntdll!_PEB @$peb ->->...` | display sub structures starting from PEB | `dt ntdll!_PEB @$peb Ldr->InMemoryOrderModuleList` |
| `!list -x "dt " ` | use link extension to traverse linked list starting at base address | `!list -x "dt _LDR_DATA_TABLE_ENTRY BaseDllName" 0x0001ed...` |