Having Fun with WinDBG

I’ve been spending lots of quality time with WinDBG and the rest of the Windows Debugging Tools, and ran into something I thought was fun to do.

For the sake of keeping it simple, let’s say I have a sample console application that looks like this:

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using System.Runtime.CompilerServices;

class Program {

  static void Main(string[] args) {

    Program p = new Program();

    for ( int i = 0; i < 10; i++ ) {

      p.RunTest("Test Run No. " + i, i);

    }

  }

  [MethodImpl(MethodImplOptions.NoInlining)]

  public void RunTest(String msg, int executionNumber) {

    Console.WriteLine("Executing test");

  }

}

Now, imagine I’m debugging such an application and I’d like to figure out what is passed as parameters to the RunTest() method, seeing as how the application doesn’t actually print those values directly. This seems contrived, but a classic case just like this one is a method that throws an ArgumentException because of a bad parameter input but the exception message doesn’t specify what the parameter value itself was.

For the purposes of this post, I’ll be compiling using release x86 as the target and running on 32-bit Windows. Now, let’s start a debug session on this sample application. Right after running it in the debugger, it will break right at the unmanaged entry point:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86

Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: .\DbgTest.exe

Symbol search path is: *** Invalid ***

****************************************************************************

* Symbol loading may be unreliable without a symbol search path.           *

* Use .symfix to have the debugger choose a symbol path.                   *

* After setting your symbol path, use .reload to refresh symbol locations. *

****************************************************************************

Executable search path is:

ModLoad: 012f0000 012f8000   DbgTest.exe

ModLoad: 777f0000 77917000   ntdll.dll

ModLoad: 73cf0000 73d3a000   C:\Windows\system32\mscoree.dll

ModLoad: 77970000 77a4c000   C:\Windows\system32\KERNEL32.dll

(f9c.d94): Break instruction exception - code 80000003 (first chance)

eax=00000000 ebx=00000000 ecx=001cf478 edx=77855e74 esi=fffffffe edi=7783c19e

eip=77838b2e esp=001cf490 ebp=001cf4c0 iopl=0         nv up ei pl zr na pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll -

ntdll!DbgBreakPoint:

77838b2e cc              int     3

Read more: Winterdom

Posted via email from Jasper-net