Archive for the ‘Fun with WinDbg’ Category

The Power of Simplicity

Thursday, February 7th, 2013

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Posted in Art, Computicart (Computical Art), Fun with Crash Dumps, Fun with Debugging, Fun with Software Diagnostics, Fun with Software Traces, Fun with WinDbg, Windows 8, x64 Windows | No Comments »

WinDbg as UNICODE to ASCII Converter

Wednesday, February 6th, 2013

Steps:

1. Open a crash dump or attach WinDbg to a process you can sacrifice.

2. Enter this command: eb rsp <UNICODE string> [00 00]

0: kd> eb rsp 42 00 65 00 65 00 74 00 68 00 6F 00 76 00 65 00 6E 00 3A 00 20 00 53 00 79 00 6D 00 70 00 68 00 6F 00 6E 00 69 00 65 00 73 00 20 00 31 00 20 00 61 00 6E 00 64 00 20 00 33 00 00 00

Note: use esp for a 32-bit dump. Last NULL terminators 00 00 are not necessary if the string already has them.

3. Enter this command: du rsp

0: kd> du rsp
fffff880`15925ae8  "Beethoven: Symphonies 1 and 3"

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Posted in Fun with WinDbg, WinDbg Tips and Tricks | No Comments »

DD That (Debugging Slang, Part 37)

Tuesday, January 22nd, 2013

I don’t know how I missed it. It was the first real life slang I heard almost 10 years ago during hot political and critical crash dump analysis session.

DD That - Analyze that simply.

Although more correctly would be to say DP That at that time when I heard it 64-bit computing wasn’t a mainstream yet. Based on dd WinDbg command to dump raw binary data starting from a given 32-bit memory address.

Examples: I dd-ed that and found an ASCII.

- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -

Posted in Debugging Slang, Fun with Crash Dumps, Fun with Debugging, Fun with WinDbg | No Comments »