# windbg

Published articles for windbg.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Writing a Debugger From Scratch - DbgRs Part 7 - Disassembly

DevFeed: [Writing a Debugger From Scratch - DbgRs Part 7 - Disassembly](<https://devfeed.tech/articles/writing-a-debugger-from-scratch-dbgrs-part-7-disassembly-39739.md>)

Original publisher: [Read original article](<https://www.timdbg.com/posts/writing-a-debugger-from-scratch-part-7/>)

Author: Tim Misiak

Published: 2024-01-18T16:10:45Z

Content type: tutorial

Language: en

Sources: [TimDbg](<https://devfeed.tech/sources/timdbg.md>)

Topics: [debug](<https://devfeed.tech/topics/debug.md>), [Assembly](<https://devfeed.tech/topics/assembly.md>), [x86](<https://devfeed.tech/topics/x86.md>), [Rust](<https://devfeed.tech/topics/rust.md>), [Iced](<https://devfeed.tech/topics/iced.md>)

Tags: [assembly](<https://devfeed.tech/tags/assembly.md>), [code](<https://devfeed.tech/tags/code.md>), [debugger](<https://devfeed.tech/tags/debugger.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [encoding](<https://devfeed.tech/tags/encoding.md>), [memory](<https://devfeed.tech/tags/memory.md>), [rust](<https://devfeed.tech/tags/rust.md>), [windbg](<https://devfeed.tech/tags/windbg.md>), [x86](<https://devfeed.tech/tags/x86.md>)

### AI overview

This tutorial installment explains how the DbgRs low-level debugger adds disassembly for Windows x64 code. It introduces the challenges of decoding x86 instruction encodings and describes using a Rust disassembly crate with iced-x86 instead of implementing a complete disassembler from scratch.

### Source excerpt

(New to this series? Consider starting from part 1) At the end of the last post, DbgRs could display stacks, which is the single most powerful tool in the debugging arsenal. But once you have those frames to examine, you need to understand what that code was doing. Source code is one place to look at, but if you're using a low level debugger like WinDbg or KD there's a good chance you need to see the assembly code, which means we need a disassembler.

## Run My Code! (code injection on Windows)

DevFeed: [Run My Code! (code injection on Windows)](<https://devfeed.tech/articles/run-my-code-code-injection-on-windows-39725.md>)

Original publisher: [Read original article](<https://www.timdbg.com/posts/run-my-code/>)

Author: Tim Misiak

Published: 2023-08-27T22:13:28Z

Content type: tutorial

Language: en

Sources: [TimDbg](<https://devfeed.tech/sources/timdbg.md>)

Topics: [Code](<https://devfeed.tech/topics/code.md>), [Processes](<https://devfeed.tech/topics/processes.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Programming](<https://devfeed.tech/topics/programming.md>)

Tags: [binaries](<https://devfeed.tech/tags/binaries.md>), [buffer-overflow](<https://devfeed.tech/tags/buffer-overflow.md>), [code](<https://devfeed.tech/tags/code.md>), [processes](<https://devfeed.tech/tags/processes.md>), [programming](<https://devfeed.tech/tags/programming.md>), [windbg](<https://devfeed.tech/tags/windbg.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article explains code injection on Windows, focusing on ways to run code inside another process without relying on a security vulnerability. It introduces static injection through patching, DLL injection, and dynamic code injection, and discusses drawbacks of modifying binaries on disk, including effects on repeated runs and code signing.

### Source excerpt

The first time I realized it was possible to get a process to run some extra little code I had written, it felt like the ultimate cheat code. My first attempt was a little patch for Civilization 2 to fix some high CPU usage. Then I discovered that you could inject code at run-time. And when I discovered the ability to change how OS functions worked, it started to feel like I could do anything!

## WinDbg's Target Composition Model enables extensible debugging across platforms and target formats

DevFeed: [WinDbg's Target Composition Model enables extensible debugging across platforms and target formats](<https://devfeed.tech/articles/what-s-the-target-model-and-why-39731.md>)

Original publisher: [Read original article](<https://www.timdbg.com/posts/whats-the-target-model/>)

Author: Tim Misiak

Published: 2022-10-03T16:54:07Z

Content type: article

Language: en

Sources: [TimDbg](<https://devfeed.tech/sources/timdbg.md>)

Topics: [debugging](<https://devfeed.tech/topics/debugging.md>), [SDK](<https://devfeed.tech/topics/sdk.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [NuGet](<https://devfeed.tech/topics/nuget.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [macOS](<https://devfeed.tech/topics/macos.md>)

Tags: [debugger](<https://devfeed.tech/tags/debugger.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [linux](<https://devfeed.tech/tags/linux.md>), [macos](<https://devfeed.tech/tags/macos.md>), [nuget](<https://devfeed.tech/tags/nuget.md>), [sdk](<https://devfeed.tech/tags/sdk.md>), [windbg](<https://devfeed.tech/tags/windbg.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article explains why WinDbg's DbgEng was adapted beyond Windows and introduces the Target Composition Model. The model uses composable components to support different debugging targets, operating systems, hardware platforms, symbol formats, and crash dump formats, and can be extended through the Microsoft.Debugging.TargetModel.SDK NuGet package.

### Source excerpt

How do you teach an old dog new tricks? That's the topic of today's post. "WinDbg" is short for "Windows Debugger", but lately that name seems a bit odd since the WinDbg of today knows about a lot more than just Windows. WinDbg now supports Linux and MacOS crash dump targets, as well as few things that are a bit of a hybrid, like Open Enclave debugging. The core "debug engine" behind WinDbg is called "DbgEng", and it's been a Windows-centric debugging engine for decades.

## Symbol and Binary Indexing

DevFeed: [Symbol and Binary Indexing](<https://devfeed.tech/articles/symbol-and-binary-indexing-39727.md>)

Original publisher: [Read original article](<https://www.timdbg.com/posts/symbol-indexing/>)

Author: Tim Misiak

Published: 2022-08-10T15:30:09Z

Content type: tutorial

Language: en

Sources: [TimDbg](<https://devfeed.tech/sources/timdbg.md>)

Topics: [debugging](<https://devfeed.tech/topics/debugging.md>), [Windows](<https://devfeed.tech/topics/windows.md>), [Visual Studio](<https://devfeed.tech/topics/visual-studio.md>)

Tags: [binaries](<https://devfeed.tech/tags/binaries.md>), [debug](<https://devfeed.tech/tags/debug.md>), [debugger](<https://devfeed.tech/tags/debugger.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [files](<https://devfeed.tech/tags/files.md>), [symbols](<https://devfeed.tech/tags/symbols.md>), [windbg](<https://devfeed.tech/tags/windbg.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

This article explains why WinDbg debugging benefits from indexing both symbols and binaries. Symbols provide names, type definitions, and source files, while indexed binaries help debuggers reconstruct missing module data and perform reliable stack walking, especially when analyzing crash dumps from another machine.

### Source excerpt

Symbol indexing is one of those features of WinDbg that can make things "just work" in a way that seems like magic. But it can also be the most painful things when it goes wrong. Why should I index symbols and binaries? Most of us have tried to debug without symbols at one point, and it can quickly become an exercise in frustration. It's much more productive to debug an executable where you have symbols because it gives you function names, variable names, type definitions, and source files.

## Remote debugging

DevFeed: [Remote debugging](<https://devfeed.tech/articles/remote-debugging-39741.md>)

Original publisher: [Read original article](<https://www.timdbg.com/remote-debugging/>)

Author: Tim Misiak

Published: 2022-08-05T14:00:00Z

Content type: tutorial

Language: en

Sources: [TimDbg](<https://devfeed.tech/sources/timdbg.md>)

Topics: [debugging](<https://devfeed.tech/topics/debugging.md>), [Development](<https://devfeed.tech/topics/development.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [Server](<https://devfeed.tech/topics/server.md>), [Kernel](<https://devfeed.tech/topics/kernel.md>)

Tags: [binaries](<https://devfeed.tech/tags/binaries.md>), [debugger](<https://devfeed.tech/tags/debugger.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [development](<https://devfeed.tech/tags/development.md>), [exceptions](<https://devfeed.tech/tags/exceptions.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [kernel](<https://devfeed.tech/tags/kernel.md>), [os](<https://devfeed.tech/tags/os.md>), [remote](<https://devfeed.tech/tags/remote.md>), [server](<https://devfeed.tech/tags/server.md>), [symbols](<https://devfeed.tech/tags/symbols.md>), [windbg](<https://devfeed.tech/tags/windbg.md>)

### AI overview

This tutorial explains how to set up remote debugging with WinDbg and NTSD. It defines target and host terminology, compares NTSD/CDB with DbgSrv, and explains how debugger logic, binaries, symbols, memory, registers, and debugging events are distributed between machines.

### Source excerpt

A key feature of WinDbg and NTSD is the ability to debug a target "remotely" from a separate computer. For kernel debugging, this is often the only way to debug, since the entire OS is "frozen" when broken into a kernel debugger. Remote debugging is also available for usermode debugging, and is often just as useful. Sometimes it's useful because the target that you are testing on is different from the one you are using for development.

## Debugger data model, Javascript & x64 exception handling

DevFeed: [Debugger data model, Javascript & x64 exception handling](<https://devfeed.tech/articles/debugger-data-model-javascript-x64-exception-handling-39703.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2017/12/01/debugger-data-model/>)

Author: Axel "0vercl0k" Souchet

Published: 2017-12-01T14:59:00Z

Content type: tutorial

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [debugging](<https://devfeed.tech/topics/debugging.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>), [Exception handling](<https://devfeed.tech/topics/exception-handling.md>), [Microsoft](<https://devfeed.tech/topics/microsoft.md>), [Tooling](<https://devfeed.tech/topics/tooling.md>), [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>)

Tags: [debugging](<https://devfeed.tech/tags/debugging.md>), [debugging-tools](<https://devfeed.tech/tags/debugging-tools.md>), [exception](<https://devfeed.tech/tags/exception.md>), [exception-handling](<https://devfeed.tech/tags/exception-handling.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [seh](<https://devfeed.tech/tags/seh.md>), [time-travel-debugging](<https://devfeed.tech/tags/time-travel-debugging.md>), [ttd](<https://devfeed.tech/tags/ttd.md>), [windbg](<https://devfeed.tech/tags/windbg.md>)

### AI overview

This tutorial explores the WinDbg Preview debugger data model, JavaScript extensions, and Microsoft's time travel debugging tools. It explains how these features can be used to enumerate x64 try/except handlers in JavaScript.

### Source excerpt

Introduction The main goal of today's post is to show a bit more of what is now possible with the latest Windbg (currently branded "WinDbg Preview" in the Microsoft store) and the time travel debugging tools that Microsoft released a few months ago. When these finally got released, a bit ...

## Keygenning with KLEE

DevFeed: [Keygenning with KLEE](<https://devfeed.tech/articles/keygenning-with-klee-39699.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2015/08/18/keygenning-with-klee/>)

Author: Michele "brt\_device" Bertasi

Published: 2015-08-19T05:12:00Z

Content type: tutorial

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Software](<https://devfeed.tech/topics/software.md>), [Code](<https://devfeed.tech/topics/code.md>), [debug](<https://devfeed.tech/topics/debug.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [gcc](<https://devfeed.tech/topics/gcc.md>), [Scripting, bash](<https://devfeed.tech/topics/scripting-bash.md>), [WPF](<https://devfeed.tech/topics/wpf.md>)

Tags: [code](<https://devfeed.tech/tags/code.md>), [debugging](<https://devfeed.tech/tags/debugging.md>), [gcc](<https://devfeed.tech/tags/gcc.md>), [ida](<https://devfeed.tech/tags/ida.md>), [ida-pro](<https://devfeed.tech/tags/ida-pro.md>), [linux](<https://devfeed.tech/tags/linux.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [scripting](<https://devfeed.tech/tags/scripting.md>), [software](<https://devfeed.tech/tags/software.md>), [symbolic-execution](<https://devfeed.tech/tags/symbolic-execution.md>), [virtual-machine](<https://devfeed.tech/tags/virtual-machine.md>), [windbg](<https://devfeed.tech/tags/windbg.md>)

### AI overview

This article examines the reverse engineering of a software serial-number validation process and describes using the KLEE symbolic virtual machine to build a key generator. It also discusses tools and practices including IDA Pro, WinDbg, Linux, gcc, Bash scripting, and a WPF application.

### Source excerpt

Introduction In the past weeks I enjoyed working on reversing a piece of software (don't ask me the name), to study how serial numbers are validated. The story the user has to follow is pretty common: download the trial, pay, get the serial number, use it in the annoying nag ...