WinDbg is a powerful debug tool whichcan help programmer to locate the issues in a short time, especially incase there is no development environment. If the software product hasbeen deployed to the customers' workstation and an issue occurred, canyou ask your customer to install a visual studio for you to diagnosticit? Ofcourse not. Thus, WinDbg can help you in this situation. Thisarticle is to introduce how to start your trip on WinDbg. Hope it ishelpful for you, enjoy it!
1.Download andinstall Debugging Tools for Windows
http://www.microsoft.com/whdc/DevTools/Debugging/default.mspx
2.Setup environmentvariables to point to Microsoft Symbol server
_NT_SYMBOL_PATH = http://msdl.microsoft.com/download/symbols
OR
Specify it from[File]->[Symbol File Path...] in the menu of WinDbg UI
3.Start to debug theprogram you want to debug
a. start the programfrom windbg :[File]->[Open Executable...]
b. attach windbg toan existing process:[File]->[Attach to a process...]
c. automaticallyattach a debugger to an application when it starts to run:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Image File Execution Options
Create a newregistry key with the name of the process you want todebug, add an stringvalue "Debugger", set the data to the full path ofntsd.exe. It willuse ntsd.exe to debug the process you specified here.
4.Use command todebug the program
| Category | Command | Description | Example |
| RUN | F10/p | Step over |
|
|
| F11/t | Step into |
|
|
| Shift+F11/gu | Step out |
|
|
| F5/g | Go |
|
|
| F9 | Insert/Remove breakpoint |
|
| Display | dv | Display local variable |
|
|
| R | Display register | R ecx |
|
| U | Show usassemble | U WindbgEx1!Example2 |
|
| kb | Display stack trace |
|
|
| .lastevent | Last exception record |
|
|
| bl | List all of the breakpoints |
|
|
| lm | List all of the loaded modules |
|
|
| ~ | Display all threads |
|
|
| .hh | help | .hh dbgerr005 |
| QUIT | Q |
|
|
5.Example
First of all, startthe process you want to debug:[File]->[Open Executable...].
Click [Call stack]icon in UI or Alt+6 to sett the call stack, Alt+2 to show the Watch window...
Add breakpoint insource code, and F5 to run into the breakpoint, see the illustration below:
Now, it is the sameas the Visual Studio platform. F10 to step over, and F11 to step into.
Press F5 to run intothe breakpoint, the variable is displayed in Locals window.
Press F5 to continuethe process, an exception raised anddisplayed in Command window:
0:000> g
(1668.1920): Integerdivide-by-zero - code c0000094 (first chance)
First chance exceptions arereported before any exception handling.
This exception may be expectedand handled.
WindbgEx1!Example2+0x2d:
00000001`3f27117d f7f9 idiv eax,ecx
We can display theregister using the "r" command:
0:000> r ecx
ecx=0
0:000> r eax
eax=47
From the assemblyand register value, we can find the reason of the exception.
Note: First chanceexceptions are thrown from the application, whichgets a change to handle theexception, if the application does not handlethe exception, the debugger willcatch it and has another change, we canit second change exception, to handle it.
