About
Articles
Book Store
Distributed RCE
Downloads
Event Calendar
Forums
Live Discussion
Reference Library
RSS Feeds
Search
Users
What's New
Customize Theme
bluegrey
blackgreen
metal
simple
Flag:
Tornado!
Hurricane!
Login:
Password:
Remember Me
Register
Forums
>>
Debuggers
>> Plugins for Windbg
Topic created on:
January 14, 2013 21:02 CST by
drew77
.
I am fairly new to using Windbg and am looking for plugins to make it easier to use.
I have not been able to get it to work with symbols stored on my hard drive.
Thanks.
codeinject
January 15, 2013 02:10.59 CST
Check http://tuts4you.com/download.php
anonymouse
January 16, 2013 03:19.20 CST
windbg doesnt have plugins it has a few public extensions
one of the more well known extension is by SkyWing Aka Ken Johnson is sdbgext
the next is a grep extension by the name of domdbg
code machine has an extensions that expands the pte pfn and virtual address space explanations a bit more
microsoft securtity research has published an extension for
!is_it_exploitable or some thing to that name (codeplex i think)
anonymouse
January 16, 2013 03:29.59 CST
I have not been able to get it to work with symbols stored on my hard drive.
assuming you have stored the symbols on say d:\symbols folder
the directory would / should look like this
D:\SYMBOLS\ntdll.pdb\1751003260CA42598C0FB326585000ED2\ntdll.pdb
now open mycomputers->properties -> advanced -> environment variables->system variables->new
and add an entry for _NT_SYMBOL_PATH
it should look like this
SRV*D:\symbols*http://msdl.microsoft.com/download/symbols
C:\>reg query "hklm\system\controlset001\control\Session Manager\Environment" /v
"_NT_SYMBOL_PATH"
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\system\controlset001\control\Session Manager\Environment
_NT_SYMBOL_PATH REG_SZ SRV*D:\symbols*http://msdl.microsoft.com/downloa
d/symbols
C:\>
open windbg and it should be able to find the symbols
if you have some more problems
you can issue !sym noisy
inside windbg and it will print diagnostics about what and where and how it is searching for symbols and why it thinks it cant find your symbols
drew77
January 16, 2013 15:16.15 CST
Thanks for your help.
Note:
Registration
is required to post to the forums.
There are
31,322
total registered users.
Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n
Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM
oleavr
Oct/24
Anatomy of a code tracer
hasherezade
Sep/24
IAT Patcher - new tool for ...
oleavr
Aug/27
CryptoShark: code tracer ba...
oleavr
Jun/25
Build a debugger in 5 minutes
More ...
Recent Blog Comments
nieo
on:
Mar/22
IAT Patcher - new tool for ...
djnemo
on:
Nov/17
Kernel debugger vs user mod...
acel
on:
Nov/14
Kernel debugger vs user mod...
pedram
on:
Dec/21
frida.github.io: scriptable...
capadleman
on:
Jun/19
Using NtCreateThreadEx for ...
More ...
Imagery
SoySauce Blueprint
Jun 6, 2008
[+] expand
View Gallery
(11) /
Submit