Crash Dump Analysis

Tracing Win32 API while debugging a process

Sponsored link: Memory Dump Analysis Services

Load an executable or attach WinDbg to an existing process and use logexts debugging extension (in output below all API parameters and return values are omitted for visual clarity):

0:001> !logexts.loge 0:001> !logc e * All categories enabled. 0:001> !logo e d Debugger Enabled Text file Disabled Verbose log Enabled 0:001> g Thrd 7c0 77555B59 BeginPaint( 0x001103AA) ... Thrd 7c0 77555B65 GetClientRect( 0x001103AA) ... Thrd 7c0 77555B96 DrawEdge( 0x01010072 ...) ... Thrd 7c0 77555C8A DrawFrameControl( 0x01010072 ...) ... Thrd 7c0 77555CE1 EndPaint( 0x001103AA ... ) ... Thrd 7c0 004165F2 TlsGetValue( 0x00000006) ... Thrd 7c0 4B8D54B5 CallNextHookEx( ... ) ... Thrd 7c0 0040D7CC GetMessageW( ... ) ...

You can break in and put a breakpoint at a return address:

0:001> bp 0040D7CC 0:001> g Thrd 7c0 0040D7CC GetMessageW( ... ) ... Breakpoint 0 hit ProcessHistory+0xd7cc: 0040d7cc 85c0 test eax,eax 0:000> u 0040D7C0 0040D7CC ProcessHistory+0xd7c0: 0040d7c0 50 push eax 0040d7c1 50 push eax 0040d7c2 8d7730 lea esi,[edi+30h] 0040d7c5 56 push esi 0040d7c6 ff15f8434300 call dword ptr [ProcessHistory+0x343f8 (004343f8)] 0:000> dd 004343f8 004343f8 3c001950 3c0018c4 3c00193c 3c0014dc 0:000> u 3c001950 3c001950 b889020000 mov eax,289h 3c001955 e98e410014 jmp logexts!LogHook (50005ae8) 3c00195a b88a020000 mov eax,28Ah 3c00195f e984410014 jmp logexts!LogHook (50005ae8) 3c001964 b88b020000 mov eax,28Bh 3c001969 e97a410014 jmp logexts!LogHook (50005ae8) 3c00196e b88c020000 mov eax,28Ch 3c001973 e970410014 jmp logexts!LogHook (50005ae8)

Here we can see that logexts patches import table.

And you can trace different API categories:

0:001> !logexts.logc Categories: 1 AdvApi32 Enabled 2 AtomFunctions Enabled 3 AVIFileExports Enabled 4 Clipboard Enabled 5 ComponentObjectModel Enabled 6 DebuggingAndErrorHandling Enabled 7 DeviceFunctions Enabled 8 Direct3D Enabled 9 DirectDraw Enabled 10 DirectPlay Enabled 11 DirectSound Enabled 12 GDI Enabled 13 HandleAndObjectFunctions Enabled 14 HookingFunctions Enabled 15 IOFunctions Enabled 16 MemoryManagementFunctions Enabled 17 Multimedia Enabled 18 Printing Enabled 19 ProcessesAndThreads Enabled 20 RegistryFunctions Enabled 21 Shell Enabled 22 StringManipulation Enabled 23 ThreadLocalStorage Enabled 24 User32 Enabled 25 User32StringExports Enabled 26 Version Enabled 27 WinSock2 Enabled

- Dmitry Vostokov -

Museum of Debugging and Memory Dumps

7/7/2010 - 8/8/2010 Annual Competition: Tell Your Windows Debugging Story

Crash and Hang Analysis Audit Service

CARE: Crash Analysis Report Environment

Crash Dump and Software Trace Analysis Training and Seminars

Access OpenTask Titles on Safari Books Online

DATA (Dump Analysis + Trace Analysis) Facebook group
Please join the community of memory (dump) and trace analysis engineers. This group promotes scientific methods and memory dump-based worldview.

Twitter @ DumpAnalysis
You can now follow portal and blog news at DumpAnalysis on Twitter

LinkedIn Group Dr. Watson Enthusiasts
All about Dr. Watson errors and more. Get news, excerpts and progress reports about the forthcoming book The Science of Dr. Watson: An Illustrated History of Debugging (ISBN 978-1906717070)

2010 (0x7DA) - The Year of Dump Analysis
2011 (0x7DB) - 2020 (0x7E4) The Debugging Decade

International Memory Analysts and Debuggers Day:
07.07 and/or 08.08 starting from The Year of Dump Analysis, 2010, 7DA

Announcements

Coming Soon:

Management Bits: An Anthology from Reductionist Manager

Crash Dump Analysis: Practical Foundations (Windows Edition, Systematic Software Fault Analysis Series)

Debugging Notebook: Essential Concepts, WinDbg Commands and Tools

Crash Dump Analysis for System Administrators and Support Engineers

New Magazines:

Debugged! MZ/PE: MagaZine for/from Practicing Engineers

New Books:

Memory Dump Analysis Anthology: Color Supplement for Volumes 1-3

Memory Dump Analysis Anthology, Volume 3

First Fault Software Problem Solving: A Guide for Engineers, Managers and Users

x64 Windows Debugging: Practical Foundations

Also available:

Windows Debugging: Practical Foundations

DLL List Landscape: The Art from Computer Memory Space

Dumps, Bugs and Debugging Forensics: The Adventures of Dr. Debugalov

WinDbg: A Reference Poster and Learning Cards

Memory Dump Analysis Anthology, Volume 2

Memory Dump Analysis Anthology, Volume 1

New Children's Book:

Baby Turing

Memory Dump It

This entry was posted on Wednesday, January 3rd, 2007 at 6:24 pm and is filed under Debugging. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

One Response to “Tracing Win32 API while debugging a process”

Software Generalist » Blog Archive » Reading Notebook: 09-Feb-09 Says:
February 9th, 2009 at 5:51 pm
[…] OS calls (pp. 104 - 106) - On Windows we can trace API while debugging using WinDbg extensions: http://www.dumpanalysis.org/blog/index.php/2007/01/03/tracing-win32-api-while-debugging-a-process/. Process Monitor can also be used to trace API subsets like File and Registry […]

Tracing Win32 API while debugging a process

One Response to “Tracing Win32 API while debugging a process”

Leave a Reply