ContextQMD
Back to Developer Roadmap

WinDbg

src/data/roadmaps/cpp/content/[email protected]

4.02.5 KB
Original Source

WinDbg

WinDbg is a powerful debugger for Windows applications, which is included in the Microsoft Windows SDK. It provides an extensive set of features to help you analyze and debug complex programs, kernel mode, and user-mode code. With a user-friendly graphical interface, WinDbg can help in analyzing crash dumps, setting breakpoints, and stepping through code execution.

Getting Started

To begin using WinDbg, you first need to install it. You can download the Windows SDK and install it to get the WinDbg.

Loading Symbols

WinDbg relies on symbol files (*.pdb) to provide more useful information about a program's internal structures, functions, and variables. To load symbols properly, you may need to configure the symbol path:

!sym noisy
.sympath SRV*C:\symbols*http://msdl.microsoft.com/download/symbols
.reload /f

Opening Executables and Crash Dumps

To debug an executable using WinDbg, go to File > Open Executable..., then locate and open the target program. To analyze a crash dump, use File > Open Crash Dump... instead.

Basic Commands

Some common commands you might use in WinDbg:

  • g: Execute the program until the next breakpoint or exception
  • bp <address>: Set a breakpoint at a given address
  • bl: List all breakpoints
  • bd <breakpoint_id>: Disable a breakpoint
  • be <breakpoint_id>: Enable a breakpoint
  • bc <breakpoint_id>: Clear a breakpoint
  • t: Single-step through instructions (trace)
  • p: Step over instructions (proceed)
  • k: Display call stack
  • dd: Display memory contents in 4-byte units (double words)
  • da: Display memory contents as ASCII strings
  • !analyze -v: Analyze the program state and provide detailed information

Example Usage

Debugging a simple program:

  • Open the executable in WinDbg
  • Set a breakpoint using bp <address>
  • Run the program using g
  • Once the breakpoint is hit, use t or p to step through the code
  • Try k to view the call stack, or dd, da to inspect memory
  • Remove the breakpoint and continue debugging with other commands as needed

Remember that WinDbg has a wealth of commands and functionality, so it's essential to get comfortable with the documentation and explore the wealth of available resources specific to your debugging tasks.