The MASM Forum

Miscellaneous => The Orphanage => Topic started by: Magnum on January 16, 2013, 09:07:36 AM

Title: Ring 0 debugger
Post by: Magnum on January 16, 2013, 09:07:36 AM
I have been trying to learn how to use Windbg.

I have found it able to open more programs with fewer "imperial entanglements" than the Ring 3 ones like Ollydbg.

There aren't that many plugins for it.

I have been posted to some other groups, but have not found out how to get Windbg to use a local store of the symbol files.

It works fine using the online stores.



Title: Re: Ring 0 debugger
Post by: dedndave on January 16, 2013, 09:12:23 AM
it may only work with certain versions of LINK
some of the other guys can give you more details as to which versions
Title: Re: Ring 0 debugger
Post by: sinsi on January 16, 2013, 12:27:44 PM
Easiest way is to set an environment variable, this will store them locally (downloads it once).
For your program symbols, use the /debug switch with link to make the pdb.

_NT_SYMBOL_PATH=srv*c:\asm\symbols*http://msdl.microsoft.com/download/symbols
Title: Re: Ring 0 debugger
Post by: Magnum on January 16, 2013, 01:14:22 PM
Sinsi,

When "Reloading current modules" is showing, is there a way to see how it's doing ?


Andy

P.S. Anyone tried IceSword ?

Title: Re: Ring 0 debugger
Post by: sinsi on January 16, 2013, 01:37:34 PM
I think it's something to do with "noisy mode". Try entering these commands:
!sym noisy
.reload