# TimDbg Recent content on TimDbg This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Writing a Debugger From Scratch - DbgRs Part 8 - Source and Symbols DevFeed: [Writing a Debugger From Scratch - DbgRs Part 8 - Source and Symbols]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2024-05-29T15:50:13Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debug](), [Windows](), [Streams](), [Parsing](), [LLVM](), [Open Source]() Tags: [debugger](), [debugging](), [llvm](), [open-source](), [parsing](), [streams](), [symbols](), [windows]() ### AI overview This installment of the DbgRs debugger series introduces source-level debugging through symbols, focusing on Windows PDB files. It explains how PDBs connect compiled code with source code and can contain function signatures, type definitions, local variables, and stream-based file data. ### Source excerpt (New to this series? Consider starting from part 1) At the end of the last post, DbgRs gained the ability to disassemble the code that it was debugging. While disassembly is critical for many debugging tasks, using source code to step through the code line by line is usually more convenient when it's available. In this post we'll start looking at how to use symbols (PDB files on Windows) so that we can display the source for the code that's being debugged. ## Snippy: An Open-Source GPT-4 Screen-Sharing Assistant Built with Tauri and Rust DevFeed: [Snippy: An Open-Source GPT-4 Screen-Sharing Assistant Built with Tauri and Rust]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2024-04-21T17:47:33Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [Artificial Intelligence](), [Large Language Model](), [multimodal](), [screen](), [Tauri](), [Rust](), [screenshot](), [cross-platform](), [Open Source](), [OpenAI](), [API keys](), [debugging]() Tags: [ai](), [ai-assistant](), [api](), [debugger](), [llms](), [macos](), [multimodal](), [open-source](), [rust]() ### AI overview This article presents Snippy, an open-source screen-sharing GPT assistant that sends application screenshots with chat messages. It explains how GPT-4 with vision uses screen context to answer questions and describes the use of Tauri and Rust in the application. ### Source excerpt While I no longer work on WinDbg, I still spend a lot of time thinking about how to make tools so people can build things faster. With WinDbg, I tried to do that by putting more debugging power at people's fingertips in a way that was easier to use. Recently, everyone is looking for ways to use LLMs to build things faster. But for most people using something like ChatGPT means pasting text back and forth between your different tools. ## Writing a Debugger From Scratch - DbgRs Part 7 - Disassembly DevFeed: [Writing a Debugger From Scratch - DbgRs Part 7 - Disassembly]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2024-01-18T16:10:45Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debug](), [Assembly](), [x86](), [Rust](), [Iced]() Tags: [assembly](), [code](), [debugger](), [debugging](), [encoding](), [memory](), [rust](), [windbg](), [x86]() ### AI overview This tutorial installment explains how the DbgRs low-level debugger adds disassembly for Windows x64 code. It introduces the challenges of decoding x86 instruction encodings and describes using a Rust disassembly crate with iced-x86 instead of implementing a complete disassembler from scratch. ### Source excerpt (New to this series? Consider starting from part 1) At the end of the last post, DbgRs could display stacks, which is the single most powerful tool in the debugging arsenal. But once you have those frames to examine, you need to understand what that code was doing. Source code is one place to look at, but if you're using a low level debugger like WinDbg or KD there's a good chance you need to see the assembly code, which means we need a disassembler. ## Writing a Debugger From Scratch - DbgRs Part 6 - Stacks DevFeed: [Writing a Debugger From Scratch - DbgRs Part 6 - Stacks]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-11-22T17:40:45Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [Code](), [debugging](), [Windows]() Tags: [code](), [debugger](), [execution](), [function](), [local-variables](), [windows]() ### AI overview This tutorial explains how DbgRs, an x64 Windows debugger, walks call stacks by unwinding register contexts to inspect stack frames, return addresses, and local variables. ### Source excerpt (New to this series? Consider starting from part 1) At the end of the last post, DbgRs could finally set breakpoints. That was the last really critical feature needed for controlling execution of a program. Now that it can stop on an arbitrary function or code location, the next step is to find more information about the state of the program. In my opinion, the single most useful piece of information is the call stack, so that's what this post will be about. ## Writing a Debugger From Scratch - DbgRs Part 5 - Breakpoints DevFeed: [Writing a Debugger From Scratch - DbgRs Part 5 - Breakpoints]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-09-27T05:28:40Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debugging](), [debug](), [Code](), [Windows]() Tags: [breakpoint](), [code](), [debug](), [debugger](), [github]() ### AI overview This tutorial continues the DbgRs debugger series by adding hardware breakpoint support. It also describes cleanup of the Windows debug-event handling, symbol name evaluation, and breakpoint state management. ### Source excerpt (New to this series? Consider starting from part 1) At the end of the last post, we started to get some interesting functionality with the ability to resolve addresses to names in a module. This was the last functionality missing before we could implement breakpoints! This part adds the ability for DbgRs to set hardware breakpoints. The code for this post is in the part5 branch on github. You can also view the changes from part4. ## Run My Code! (code injection on Windows) DevFeed: [Run My Code! (code injection on Windows)]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-08-27T22:13:28Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [Code](), [Processes](), [Windows](), [Programming]() Tags: [binaries](), [buffer-overflow](), [code](), [processes](), [programming](), [windbg](), [windows]() ### AI overview This article explains code injection on Windows, focusing on ways to run code inside another process without relying on a security vulnerability. It introduces static injection through patching, DLL injection, and dynamic code injection, and discusses drawbacks of modifying binaries on disk, including effects on repeated runs and code signing. ### Source excerpt The first time I realized it was possible to get a process to run some extra little code I had written, it felt like the ultimate cheat code. My first attempt was a little patch for Civilization 2 to fix some high CPU usage. Then I discovered that you could inject code at run-time. And when I discovered the ability to change how OS functions worked, it started to feel like I could do anything! ## Writing a Debugger From Scratch - DbgRs Part 4 - Exports and Private Symbols DevFeed: [Writing a Debugger From Scratch - DbgRs Part 4 - Exports and Private Symbols]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-05-29T22:28:40Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [Code](), [debug](), [Processes](), [modules](), [Parsing](), [Windows](), [GitHub]() Tags: [code](), [debugger](), [modules](), [parsing](), [portable-executable](), [process](), [windows]() ### AI overview Part 4 of a series on writing a debugger from scratch explains how to inspect a target process for loaded modules, exports, and private symbols. It covers tracking modules, mapping addresses to names, and beginning to parse Windows Portable Executable files. ### Source excerpt (New to this series? Consider starting from part 1) At the end of the last post, we had the ability to read memory out of the target process, but we still had very little in the way of interpreting the data in that process. That changes in this post, where we will start grabbing useful information out of the target, including modules, exports, and even private symbols. The code for this post is in the part4 branch on github. ## Writing a Debugger From Scratch - DbgRs Part 3 - Reading Memory DevFeed: [Writing a Debugger From Scratch - DbgRs Part 3 - Reading Memory]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-03-28T17:14:19Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [Rust](), [debug](), [Parsing](), [Processes](), [GitHub]() Tags: [code](), [debugger](), [github](), [memory](), [parsing](), [rust]() ### AI overview Part 3 of a series implements memory inspection for a debugger written in Rust. It extends the command parser to handle numeric expressions and adds commands to evaluate expressions and display a hexadecimal memory dump at an evaluated address. ### Source excerpt (New to this series? Consider starting from part 1) At the end of the last post, we had the ability to launch a program, step through instructions, and examine registers. We're still not quite at the point that we can call this a "debugger" but we're getting pretty close. In this part, we're going to start implementing functionality to examine the memory of the target process. You can see the full code for this post in the part3 branch on github. ## Writing a Debugger From Scratch - DbgRs Part 2 - Register State and Stepping DevFeed: [Writing a Debugger From Scratch - DbgRs Part 2 - Register State and Stepping]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-03-06T16:44:39Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debug](), [Processes](), [Windows](), [Code](), [Parsing](), [Rust](), [GitHub]() Tags: [code](), [commands](), [console](), [context](), [debugger](), [error-handling](), [execution](), [github](), [input](), [parsing](), [state](), [windows]() ### AI overview Part 2 of a tutorial on building a debugger from scratch in Rust for Windows. It adds a console command interface, input parsing, register-state reading through GetThreadContext, and basic execution control such as stepping and continuing. ### Source excerpt When we left off last time, we had a basic "debugger" that could launch a Windows process and monitor events that occur in that process, but it's not yet something that you would really call a debugger. Two things that are missing are the ability to examine the state of the process and to control its execution. So that's what we're going to build next. The code for this part is on GitHub as the part2 branch. ## Writing a Debugger From Scratch - DbgRs Part 1 - Attaching to a Process DevFeed: [Writing a Debugger From Scratch - DbgRs Part 1 - Attaching to a Process]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-02-13T16:20:24Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debugging](), [Rust](), [Processes](), [Windows](), [GitHub](), [Visual Studio Code]() Tags: [code](), [debugger](), [debugging](), [github](), [ide](), [os](), [rust]() ### AI overview This tutorial begins a series on writing a debugger from scratch in Rust. It introduces debugger concepts and describes the goal of implementing live user-mode debugging on Windows, while focusing on concepts and APIs that apply across programming languages and operating systems. ### Source excerpt I've left the Microsoft Debugger Platform team twice, and each time I've started writing my own debugger. I must really like debuggers or something. This time, I have two reasons for writing a new debugger. The first is because I want to learn Rust better, and writing something I already understand pretty well seems like a good way to learn. The second reason is to make it easier for people to learn how a debugger works. ## Weird things I learned while writing an x86 emulator DevFeed: [Weird things I learned while writing an x86 emulator]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-02-02T07:54:20Z Content type: article Language: en Sources: [TimDbg]() Topics: [Emulator](), [x86](), [Assembly](), [cpu](), [Encoding](), [debugging](), [C++](), [execution]() Tags: [assembly](), [breakpoint](), [c-plus-plus](), [code](), [compilers](), [cpu](), [debugging](), [emulator](), [encoding](), [execution](), [software](), [time-travel-debugging](), [x86]() ### AI overview The author shares x86 and amd64 encoding trivia learned while writing a CPU emulator for Time Travel Debugging. The article explains why alternate instruction encodings matter for software breakpoints, code size, compiler behavior, and CPU understanding. ### Source excerpt If you've read my first post about assembly language, you might expect that this is another post on how to understand assembly language. I will write more about that at some point, but this post is not that. Instead, this post is going to talk about some of the weird things and random trivia I learned while writing an x86 and amd64 emulator. The emulator I wrote was for Time Travel Debugging. ## The faker's guide to reading (x86) assembly language DevFeed: [The faker's guide to reading (x86) assembly language]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2023-01-03T16:20:24Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [Assembly](), [x86](), [Programming](), [Reverse Engineering](), [systems](), [Ghidra]() Tags: [assembly](), [c](), [c-plus-plus](), [ghidra](), [guide](), [ida](), [language](), [reading](), [reverse-engineering](), [rust](), [tools](), [x86]() ### AI overview This tutorial explains why reading x86 assembly is generally easier than writing it and why it helps developers understand native-code programs. It presents assembly reading as useful for troubleshooting, understanding compiled behavior, and reverse engineering code when source is unavailable, while noting that it complements tools such as Ghidra and IDA. ### Source excerpt Assembly code scares people. There's a good reason for that. For many people, writing code in assembly language seems equivalent to writing code in ancient dwarven runes, or calculating pi in roman numerals. The fact that RollerCoaster Tycoon was almost completely written in assembly language sounds almost too amazing to be true. Many programmers view assembly language as some combination of ancient, arcane, inscrutable, useless, and complex. Despite all that, I have a secret to share with you. ## What's a vtable? What's an IUnknown? DevFeed: [What's a vtable? What's an IUnknown?]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2022-12-18T15:30:09Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [C++](), [Windows](), [debug](), [MSVC](), [Polymorphism]() Tags: [c-plus-plus](), [class](), [compiler](), [debugger](), [function](), [msvc](), [virtual](), [windows]() ### AI overview This tutorial explains how C++ virtual function tables, or vtables, support dynamic dispatch and how they relate to COM objects on Windows. It also introduces debugger-based techniques for examining vtables and discusses errors that can be difficult to diagnose. ### Source excerpt Understanding vtables (also called VMT/Virtual Method Tables or VFT/Virtual Function Tables) is important for understanding how many C++ features work on any OS. They are even more important to understand on Windows, where vtables are used for communication between modules using COM. There are a few types of errors that can happen when things go wrong with them, and some of these will be extremely difficult to diagnose unless you understand how vtables actually work. ## Recognizing patterns in memory DevFeed: [Recognizing patterns in memory]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2022-11-24T15:30:09Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debugging](), [data](), [Processes]() Tags: [data](), [debugging](), [memory](), [patterns]() ### AI overview This tutorial explains how recognizing patterns in memory can help debug memory corruption. It covers aligned 32-bit and 64-bit values and pointers, including how repeated byte patterns and zero high bits can indicate the data type or pointer range involved. ### Source excerpt Something I find frustrating is how hard it is to teach debugging skills. I think the biggest reason is because there are many things that can only be learned through experience. This is true for anything that requires pattern recognition. Our brains are great at recognizing patterns, but it often takes a large amount of practice to be able to identify useful patterns in data. I can't instantly give you pattern recognition skills with a short blog post, but I can tell you about some of the patterns that I look for so you can start to train your brain to see these as well. ## WinDbg's Target Composition Model enables extensible debugging across platforms and target formats DevFeed: [WinDbg's Target Composition Model enables extensible debugging across platforms and target formats]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2022-10-03T16:54:07Z Content type: article Language: en Sources: [TimDbg]() Topics: [debugging](), [SDK](), [Windows](), [NuGet](), [Linux](), [macOS]() Tags: [debugger](), [debugging](), [linux](), [macos](), [nuget](), [sdk](), [windbg](), [windows]() ### AI overview This article explains why WinDbg's DbgEng was adapted beyond Windows and introduces the Target Composition Model. The model uses composable components to support different debugging targets, operating systems, hardware platforms, symbol formats, and crash dump formats, and can be extended through the Microsoft.Debugging.TargetModel.SDK NuGet package. ### Source excerpt How do you teach an old dog new tricks? That's the topic of today's post. "WinDbg" is short for "Windows Debugger", but lately that name seems a bit odd since the WinDbg of today knows about a lot more than just Windows. WinDbg now supports Linux and MacOS crash dump targets, as well as few things that are a bit of a hybrid, like Open Enclave debugging. The core "debug engine" behind WinDbg is called "DbgEng", and it's been a Windows-centric debugging engine for decades. ## Why you should do printf debugging DevFeed: [Why you should do printf debugging]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2022-09-24T19:20:24Z Content type: opinion Language: en Sources: [TimDbg]() Topics: [debugging](), [Tool](), [Programming]() Tags: [debug](), [debugging](), [techniques](), [tools](), [troubleshooting]() ### AI overview The article argues that printf debugging remains useful in some situations, even though debuggers are often easier for investigating code. It explains that choosing a diagnostic technique involves tradeoffs such as lightweight versus heavyweight methods, time versus space, and predefined versus ad hoc data collection. ### Source excerpt If you know who I am, you might think that this post title is clickbait. Maybe it is, a little. But the truth is, you should do printf debugging! Sometimes. Often not. But sometimes, you should! Let me explain. When most of us first started programming, we had one tool at our disposal. It was "printf debugging". Sometimes just littering the code with printf("here"), printf("here2"), and my favorite, printf("why won't this code work? ## What's the Debugger Data Model? (And Why?) DevFeed: [What's the Debugger Data Model? (And Why?)]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2022-08-31T06:26:09Z Content type: article Language: en Sources: [TimDbg]() Topics: [debug](), [Extension](), [data]() Tags: [debugger](), [extension](), [model]() ### AI overview The article introduces WinDbg's Debugger Data Model and explains why it was created. It describes traditional debugger extensions as difficult to discover, difficult to compose because their output is unstructured, and difficult to write. ### Source excerpt If you follow me on Twitter, you have probably heard me talk about the "Debugger Data Model". But unless you've spent a bunch of time reading our documentation or you've read articles such as this one by Yarden Shafir about the Data Model, you might have no idea what I'm talking about. Many of the ways that WinDbg is evolving to be more powerful are through the Debugger Data Model, and understanding it will help you use WinDbg more effectively. ## Debugger Lies: Stack Corruption DevFeed: [Debugger Lies: Stack Corruption]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2022-08-21T16:57:31Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debug](), [debugging](), [MSVC](), [Security](), [Variable]() Tags: [bug](), [crash](), [debug](), [debugger](), [debugging](), [local-variables](), [memory](), [msvc](), [security](), [stack]() ### AI overview This article explains why debuggers can produce misleading stack walks, focusing on stack corruption caused by buffer overflows that overwrite return addresses. It discusses how MSVC's /GS security checks affect crash stacks and recommends enabling /GS, along with using memory access breakpoints to investigate corruption. ### Source excerpt There are lots of reasons your debugger might be lying to you. Sometimes it's because information is lost when compiling due to optimizations. Sometimes the symbolic debug information isn't expressive enough. Other times it can be due to a bug in the debugger (although I hope that reason is rare). One frustrating case where the debugger sometimes "lies" to you is the stack walk. It's the single most important piece of information to come out of a crash, so when the stack walk is wrong, it's probably going to make analysis difficult. ## Symbol and Binary Indexing DevFeed: [Symbol and Binary Indexing]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2022-08-10T15:30:09Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debugging](), [Windows](), [Visual Studio]() Tags: [binaries](), [debug](), [debugger](), [debugging](), [files](), [symbols](), [windbg](), [windows]() ### AI overview This article explains why WinDbg debugging benefits from indexing both symbols and binaries. Symbols provide names, type definitions, and source files, while indexed binaries help debuggers reconstruct missing module data and perform reliable stack walking, especially when analyzing crash dumps from another machine. ### Source excerpt Symbol indexing is one of those features of WinDbg that can make things "just work" in a way that seems like magic. But it can also be the most painful things when it goes wrong. Why should I index symbols and binaries? Most of us have tried to debug without symbols at one point, and it can quickly become an exercise in frustration. It's much more productive to debug an executable where you have symbols because it gives you function names, variable names, type definitions, and source files. ## Remote debugging DevFeed: [Remote debugging]() Original publisher: [Read original article]() Author: Tim Misiak Published: 2022-08-05T14:00:00Z Content type: tutorial Language: en Sources: [TimDbg]() Topics: [debugging](), [Development](), [Tooling](), [Server](), [Kernel]() Tags: [binaries](), [debugger](), [debugging](), [development](), [exceptions](), [how-to](), [kernel](), [os](), [remote](), [server](), [symbols](), [windbg]() ### AI overview This tutorial explains how to set up remote debugging with WinDbg and NTSD. It defines target and host terminology, compares NTSD/CDB with DbgSrv, and explains how debugger logic, binaries, symbols, memory, registers, and debugging events are distributed between machines. ### Source excerpt A key feature of WinDbg and NTSD is the ability to debug a target "remotely" from a separate computer. For kernel debugging, this is often the only way to debug, since the entire OS is "frozen" when broken into a kernel debugger. Remote debugging is also available for usermode debugging, and is often just as useful. Sometimes it's useful because the target that you are testing on is different from the one you are using for development.