WinDbg Patching Arguments at Runtime
# WinDbg Patching Arguments at Runtime When a function is about to receive a bad argument (e.g. `NULL` filename passed to `__loaddll`), you can fix the pointer value on [[Stack F…
#debugging
6 published notes
Debugger Suspend Does Not Kill the Process
In a [[Debugger attach and ASLR rebasing pitfalls|debugger]], **suspend** means pausing the target process, not killing it. The OS scheduler simply stops giving the process CPU ti…
WinDbg Stack Inspection Commands
# WinDbg Stack Inspection Commands Use these commands to inspect values that have been pushed onto the stack, especially right before a function call. ## Core command ```windbg…
WinDbg Hardware Breakpoints (ba)
# WinDbg Hardware Breakpoints (`ba`) `ba` sets a **hardware breakpoint** that triggers on **memory access** rather than execution. ## `ba` vs `bp` | Command | Type | Fires when…
WinDbg Commands for Live Binary Analysis
# WinDbg Commands for Live Binary Analysis Essential commands used to inspect buffers, catch encryption, and trace function behavior in WinDbg during disassembly/reverse engineer…
Debugger attach and ASLR rebasing pitfalls
# Debugger attach and ASLR rebasing pitfalls When attaching a debugger to a live Windows process, the static disassembly addresses shown in tools like [[Binary Ninja]] are usuall…