Read Me

re: Scripting WINDBG

Mike Hoover — Mon, 19 Mar 2007 06:42:14 GMT

Really a quality work! This is awsome, I have heard about it but actually never read about it, this is the first blog I see related to the topic.

re: Read Me

Roberto Farah — Mon, 19 Mar 2007 22:57:39 GMT

Thanks Mike!

re: Read Me

nickx — Tue, 16 Oct 2007 17:31:46 GMT

your work is appreciated.

[Windbg Script] Retrieving information from ASP

Debugging Toolbox — Tue, 25 Dec 2007 03:41:53 GMT

Have you ever had this situation: You need to get ASP information from an IIS process? If yes, you can

[Windbg Script] Playing with Minesweeper

Debugging Toolbox — Tue, 25 Dec 2007 03:42:09 GMT

First, this script is not really about cheating. It does that with Minesweeper, but there are several

[Windbg Script] Playing with Notepad

Debugging Toolbox — Tue, 25 Dec 2007 03:44:06 GMT

This is one of my “just for fun” scripts. It’s very simple and has some limitations, but it’s fun! What

[Windbg Script] Tracing API calls

Debugging Toolbox — Tue, 25 Dec 2007 03:44:36 GMT

This is a very simple script, yet powerful script. You can use it to see the APIs an application is using

[Windbg Script] Extracting Performance Monitor counters from .NET application

Debugging Toolbox — Tue, 25 Dec 2007 03:44:55 GMT

Have you ever had a situation where you find yourself debugging a dump from ASP.NET when suddenly you

[Windbg Script] Tracing MessageBox calls

Debugging Toolbox — Tue, 25 Dec 2007 03:45:10 GMT

In the past I worked on a support case where I needed to find out if some MessageBox from a C++ application

[Windbg Script] Saving a Module - Extracting Base Address and Image Name from a method call

Debugging Toolbox — Tue, 25 Dec 2007 03:47:06 GMT

After creating this script, I have used it in almost every case that requires decompilation, and I guess

[Windbg Script] Disassembling Routines and Searching for Instructions

Debugging Toolbox — Tue, 25 Dec 2007 03:47:33 GMT

Sometimes you cannot avoid reading the disassembled code to look for a specific assembly instruction.

re: Read Me

sandeep — Fri, 06 Jun 2008 16:45:06 GMT

Thanks!! it is a great help.

re: Read Me

Toyota — Thu, 10 Jul 2008 04:49:07 GMT

Hi,

Thank you for the nice info!

By the way, you said;

"It will be fixed in the future, anyway,..."

Does this mean that the current script engine has some problems?

re: Read Me

Roberto Farah — Thu, 10 Jul 2008 05:27:34 GMT

Hi Toyota,

The scripts are ok, no problems found and when someone finds a bug I try to fix it as soon as possible, however, WinDbg had (and has) some issues when running scripts, for example, when you run a script that has alias and call it again you get an error. If you want to verify it by yourself, use, for example, dig_stack.txt, then call it again. Most of the problems I'm aware of were already fixed.

Lately I'm creating scripts using PowerShell that offer much more resources, stability and power. In a few weeks I'll post the newest PowerDbg library and a new script. Keep one eye in my blog. :)

Thanks

re: Read Me

Toyota — Thu, 10 Jul 2008 06:15:00 GMT

To Mr.Farah,

> Lately I'm creating scripts using PowerShell that

> offer much more resources, stability and power. In a

> few weeks I'll post the newest PowerDbg library and a

> new script. Keep one eye in my blog. :)

This is great!

I cannot wait any longer!!!

Thank you for your answer. I will try dig_stack.txt.

[Debugging Toolbox]Read Me

!analyze -v — Thu, 04 Sep 2008 07:55:27 GMT

http://blogs.msdn.com/debuggingtoolbox/archive/2007/03/18/read-me.aspx 글 : Roberto Alexis Farah 번역 :

[Windbg Script] Digging the Call Stack

Debugging Toolbox — Wed, 14 Jan 2009 23:31:54 GMT

Windbg has a lot of commands and command variations, so sometimes you may forget some of them, like when

[Windbg Script] Get Portable Executable Headers

Debugging Toolbox — Wed, 14 Jan 2009 23:34:02 GMT

There are several tools you can use to read the image headers, like Dumpbin.exe and Link.exe, for instance.

[Windbg Script] Retrieving queries/stored procedures from .NET application

Debugging Toolbox — Wed, 14 Jan 2009 23:40:36 GMT

Ok, you are debugging a .NET application. You need to find out the queries and stored procedures being