Why should i use/learn windbg ???
- You don't have to pay for WindDbg like Visual Studio
- You can extend Windbg
- Do Post-Mortem analsysis
- Capable of both user-mode and kernel-mode debugging
- Full source-level debugging for the Windows kernel, kernel-mode drivers, and system services, as well as user-mode applications and drivers.
- WinDbg also supports various remote debugging options for both user-mode and kernel-mode targets
You installed debugger ?
cool , You are genius.Lets do some configuration .You have internet connection ? Yes ..Then set sybmol server for windows
_NT_SYMBOL_PATH = symsrv*symsrv.dll*f:\localsymbols*http://msdl.microsoft.com/download/symbol
.
Starting Debugger cool , Still reading , Lets start put hand on debugger:
You can do a lot :
- Start new process (Open Executable )
- Attach to a running process (Attach to a process)
- Do postmortem Analysis (Open Crash Dump)
- and many more
- .
- .