Setting breakpoint on entry point with Windbg

You might wonder how to breakpoint on entry point in windbg. I didn’t know neither because I never tried it. I usually do kernel mode debugging so I didn’t need to bp on entry point. Here’s a little bit complicated method. But if you find any simpler way, just let me know.

First, start the application from windbg using File -> Open Executable(or ^E).
On the first breakpoint, execute the following commands.

0:000> !peb

PEB at 7ffd8000

InheritedAddressSpace: No

ReadImageFileExecOptions: No

BeingDebugged: Yes

ImageBaseAddress: 01000000

Ldr 001a1ea0

Ldr.Initialized: Yes

Ldr.InInitializationOrderModuleList: 001a1f58 . 001a2920

Ldr.InLoadOrderModuleList: 001a1ee0 . 001a2910

Ldr.InMemoryOrderModuleList: 001a1ee8 . 001a2918

Base TimeStamp Module

1000000 48025287 Apr 13 11:35:51 2008 c:\windows\notepad.exe

7c900000 4802a12c Apr 13 17:11:24 2008 C:\WINDOWS\system32\ntdll.dll

7c800000 4802a12c Apr 13 17:11:24 2008 C:\WINDOWS\system32\kernel32.dll

763b0000 4802a0c9 Apr 13 17:09:45 2008 C:\WINDOWS\system32\comdlg32.dll

77dd0000 4802a0b2 Apr 13 17:09:22 2008 C:\WINDOWS\system32\ADVAPI32.dll

77e70000 4802a106 Apr 13 17:10:46 2008 C:\WINDOWS\system32\RPCRT4.dll

77fe0000 4802a11b Apr 13 17:11:07 2008 C:\WINDOWS\system32\Secur32.dll

773d0000 4802a094 Apr 13 17:08:52 2008 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\COMCTL32.dll

77c10000 4802a188 Apr 13 17:12:56 2008 C:\WINDOWS\system32\msvcrt.dll

77f10000 49006fbe Oct 23 05:36:14 2008 C:\WINDOWS\system32\GDI32.dll

7e410000 4802a11b Apr 13 17:11:07 2008 C:\WINDOWS\system32\USER32.dll

77f60000 45091361 Sep 14 01:31:29 2006 C:\WINDOWS\system32\SHLWAPI.dll

7c9c0000 48580a39 Jun 17 12:02:17 2008 C:\WINDOWS\system32\SHELL32.dll

73000000 4802a127 Apr 13 17:11:19 2008 C:\WINDOWS\system32\WINSPOOL.DRV

SubSystemData: 00000000

ProcessHeap: 000a0000

ProcessParameters: 00020000

WindowTitle: 'c:\windows\notepad.exe'

ImageFile: 'c:\windows\notepad.exe'

CommandLine: 'c:\windows\notepad.exe'

...

WINDBG_DIR=C:\Program Files\Debugging Tools for Windows (x86)

windir=C:\WINDOWS

_NT_SYMBOL_PATH=srv*c:\Symbols*http://msdl.microsoft.com/download/symbols

0:000> !dh 01000000

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES

14C machine (i386)

3 number of sections

48025287 time date stamp Sun Apr 13 11:35:51 2008

0 file pointer to symbol table

0 number of symbols

E0 size of optional header

10F characteristics

Relocations stripped

Executable

Line numbers stripped

Symbols stripped

32 bit word machine

OPTIONAL HEADER VALUES

10B magic #

7.10 linker version

7800 size of code

A600 size of initialized data

0 size of uninitialized data

739D address of entry point

1000 base of code

----- new -----

01000000 image base

1000 section alignment

200 file alignment

2 subsystem (Windows GUI)

5.01 operating system version

5.01 image version

4.00 subsystem version

14000 size of image

400 size of headers

18700 checksum

00040000 size of stack reserve

00011000 size of stack commit

00100000 size of heap reserve

00001000 size of heap commit

0 [ 0] address [size] of Export Directory

7604 [ C8] address [size] of Import Directory

B000 [ 8948] address [size] of Resource Directory

0 [ 0] address [size] of Exception Directory

0 [ 0] address [size] of Security Directory

0 [ 0] address [size] of Base Relocation Directory

1350 [ 1C] address [size] of Debug Directory

0 [ 0] address [size] of Description Directory

0 [ 0] address [size] of Special Directory

0 [ 0] address [size] of Thread Storage Directory

18A8 [ 40] address [size] of Load Configuration Directory

250 [ D0] address [size] of Bound Import Directory

1000 [ 348] address [size] of Import Address Table Directory

0 [ 0] address [size] of Delay Import Directory

0 [ 0] address [size] of COR20 Header Directory

0 [ 0] address [size] of Reserved Directory

SECTION HEADER #1

.text name

7748 virtual size

1000 virtual address

7800 size of raw data

400 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

60000020 flags

Code

(no align specified)

Execute Read

Debug Directories(1)

Type Size Address Pointer

cv 24 18f0 cf0 Format: RSDS, guid, 1, notepad.pdb

SECTION HEADER #2

.data name

1BA8 virtual size

9000 virtual address

800 size of raw data

7C00 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

C0000040 flags

Initialized Data

(no align specified)

Read Write

SECTION HEADER #3

.rsrc name

8948 virtual size

B000 virtual address

8A00 size of raw data

8400 file pointer to raw data

0 file pointer to relocation table

0 file pointer to line numbers

0 number of relocations

0 number of line numbers

40000040 flags

Initialized Data

(no align specified)

Read Only

0:000> u 01000000+739D

notepad!WinMainCRTStartup:

0100739d 6a70 push 70h

0100739f 6898180001 push offset notepad!`string'+0x8 (01001898)

010073a4 e8bf010000 call notepad!_SEH_prolog (01007568)

010073a9 33db xor ebx,ebx

010073ab 53 push ebx

010073ac 8b3dcc100001 mov edi,dword ptr [notepad!_imp__GetModuleHandleA (010010cc)]

010073b2 ffd7 call edi

010073b4 6681384d5a cmp word ptr [eax],5A4Dh

0:000> bp 01000000+739D

0:000> g

ModLoad: 5cb70000 5cb96000 C:\WINDOWS\system32\ShimEng.dll

ModLoad: 6f880000 6fa4a000 C:\WINDOWS\AppPatch\AcGenral.DLL

ModLoad: 76b40000 76b6d000 C:\WINDOWS\system32\WINMM.dll

ModLoad: 774e0000 7761d000 C:\WINDOWS\system32\ole32.dll

ModLoad: 77120000 771ab000 C:\WINDOWS\system32\OLEAUT32.dll

ModLoad: 77be0000 77bf5000 C:\WINDOWS\system32\MSACM32.dll

ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.dll

ModLoad: 769c0000 76a74000 C:\WINDOWS\system32\USERENV.dll

ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\UxTheme.dll

ModLoad: 76390000 763ad000 C:\WINDOWS\system32\IMM32.DLL

ModLoad: 629c0000 629c9000 C:\WINDOWS\system32\LPK.DLL

ModLoad: 74d90000 74dfb000 C:\WINDOWS\system32\USP10.dll

ModLoad: 48000000 48022000 C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

ModLoad: 71ab0000 71ac7000 C:\WINDOWS\system32\WS2_32.dll

ModLoad: 71aa0000 71aa8000 C:\WINDOWS\system32\WS2HELP.dll

Breakpoint 0 hit

eax=00000000 ebx=7ffd8000 ecx=0007ffb0 edx=7c90e4f4 esi=08f2f55c edi=7c911440

eip=0100739d esp=0007ffc4 ebp=0007fff0 iopl=0 nv up ei pl zr na pe nc

cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246

notepad!WinMainCRTStartup:

0100739d 6a70 push 70h

About these ads

10 Responses to Setting breakpoint on entry point with Windbg

  1. Jordan says:

    Also, for the lazy:

    bp $exentry
    g
    ;-)

    That said, I like to use a similar version of what you have above except as a one-liner with poi() to de-reference the pointers because it works even in the crappy busted version of ntsd that XP shipped with.

    Like

  2. mattoh says:

    thanks for the tip ;)

    Like

  3. zimnipan says:

    Why so sophisticated? Just use:

    bu @$exentry
    g

    Like

  4. Pingback: Handmade Jewelry

  5. Pingback: Ladies Bracelets

  6. zhaozhaozhao says:

    Thanks a lot!! I searched this info for a long time.

    Like

  7. Henry says:

    I’m extremely pleased to discover this website. I wanted to thank you for ones time due to this wonderful read!! I definitely enjoyed every bit of it and I have you saved to fav to see new things in your web site.

    Like

  8. Hello there, You have done an excellent job. I’ll definitely digg it and personally recommend to my friends.

    I am sure they will be benefited from this web site.

    Like

  9. I have been browsing online more than 3 hours today, yet I never found any interesting article
    like yours. It’s pretty worth enough for me.
    Personally, if all web owners and bloggers made
    good content as you did, the web will be a lot more useful than ever before.|
    I could not refrain from commenting. Exceptionally well
    written!|
    I’ll right away grab your rss feed as I can not to find your email subscription link or e-newsletter
    service. Do you have any? Please let me recognize so that I
    may subscribe. Thanks.|
    It’s appropriate time to make some plans for the future
    and it’s time to be happy. I’ve read this post and if I could I want to suggest you
    few interesting things or advice. Perhaps you can write next articles referring to this article.
    I desire to read more things about it!|
    It’s the best time to make some plans for the long run and it is
    time to be happy. I have read this post and if I may just I want to
    counsel you few fascinating issues or tips. Perhaps you can write next articles referring to this article.
    I want to learn more issues approximately it!|
    I’ve been surfing on-line more than three hours nowadays, but I by no means discovered any attention-grabbing
    article like yours. It is pretty value enough for me.
    In my view, if all webmasters and bloggers made just right content as
    you did, the web will be much more useful than ever before.|
    Ahaa, its good conversation regarding this paragraph here at this weblog,
    I have read all that, so now me also commenting here.|
    I am sure this article has touched all the internet viewers, its really really
    nice piece of writing on building up new web site.|
    Wow, this article is good, my younger sister is analyzing such things,
    so I am going to convey her.|
    Saved as a favorite, I love your web site!|
    Way cool! Some extremely valid points! I appreciate you writing this post and also the rest of the site is also really good.|
    Hi, I do believe this is an excellent blog. I stumbledupon
    it ;) I’m going to return yet again since i have book-marked it.
    Money and freedom is the best way to change, may you be rich and continue to
    guide others.|
    Woah! I’m really enjoying the template/theme of this website.
    It’s simple, yet effective. A lot of times it’s tough to
    get that “perfect balance” between superb usability
    and visual appearance. I must say that you’ve done a great job with this.

    Also, the blog loads extremely fast for me on Firefox.
    Outstanding Blog!|
    These are genuinely wonderful ideas in concerning blogging.
    You have touched some pleasant factors here.
    Any way keep up wrinting.|
    I love what you guys are up too. Such clever work and reporting!

    Keep up the wonderful works guys I’ve included you guys to my blogroll.|
    Hi there! Someone in my Myspace group shared this site with
    us so I came to give it a look. I’m definitely loving
    the information. I’m bookmarking and will be tweeting this to my
    followers! Exceptional blog and great style and design.|
    I enjoy what you guys are usually up too. This kind of clever work and coverage!
    Keep up the amazing works guys I’ve added you
    guys to our blogroll.|
    Hi would you mind stating which blog platform you’re working with?
    I’m planning to start my own blog soon but I’m having a tough time
    making a decision between BlogEngine/Wordpress/B2evolution and
    Drupal. The reason I ask is because your design
    seems different then most blogs and I’m looking for something unique.

    P.S My apologies for getting off-topic but I had to ask!|
    Hey there would you mind letting me know which web host you’re using?
    I’ve loaded your blog in 3 completely different web browsers and I must say
    this blog loads a lot faster then most. Can you recommend a good
    hosting provider at a honest price? Thanks a lot, I appreciate it!|
    I love it whenever people get together and share thoughts.
    Great blog, keep it up!|
    Thank you for the auspicious writeup. It in fact was a amusement account it.
    Look advanced to far added agreeable from you! However, how can
    we communicate?|
    Hey there just wanted to give you a quick heads up.
    The text in your article seem to be running off the screen in Ie.
    I’m not sure if this is a format issue or something to do with browser compatibility but
    I thought I’d post to let you know. The design and style look great though!
    Hope you get the problem fixed soon. Kudos|
    This is a topic that’s close to my heart… Many thanks!
    Exactly where are your contact details though?|
    It’s very straightforward to find out any matter on web as compared to books,
    as I found this paragraph at this website.|
    Does your blog have a contact page? I’m having problems locating it
    but, I’d like to send you an e-mail. I’ve got some suggestions for your blog you might be interested in hearing.
    Either way, great blog and I look forward to seeing
    it develop over time.|
    Greetings! I’ve been reading your weblog for
    some time now and finally got the courage to go ahead and give you a
    shout out from Porter Tx! Just wanted to mention
    keep up the good work!|
    Greetings from Florida! I’m bored at work so I decided
    to check out your website on my iphone during lunch break.
    I enjoy the info you present here and can’t wait to take a look
    when I get home. I’m shocked at how fast your blog loaded
    on my mobile .. I’m not even using WIFI, just 3G .. Anyways, fantastic
    site!|
    Its like you read my mind! You seem to understand a lot about this, such as
    you wrote the e-book in it or something. I think that you just can do with
    a few percent to power the message house a little bit, but
    other than that, that is magnificent blog. A great read.
    I’ll definitely be back.|
    I visited multiple sites however the audio quality for audio songs existing
    at this web page is really fabulous.|
    Hello, i read your blog occasionally and i own a similar one and i was just curious if you get
    a lot of spam comments? If so how do you protect against it, any plugin or anything you can advise?
    I get so much lately it’s driving me mad so any help is very much appreciated.|
    Greetings! Very helpful advice within this article!

    It is the little changes that make the largest changes.
    Thanks a lot for sharing!|
    I truly love your website.. Pleasant colors & theme. Did you make this amazing site yourself?

    Please reply back as I’m planning to create my own personal blog and would love to learn where you
    got this from or what the theme is called.
    Kudos!|
    Hello there! This post couldn’t be written any better! Going through this
    article reminds me of my previous roommate! He continually kept talking about this.
    I’ll forward this article to him. Pretty sure he will have a great read.

    Thanks for sharing!|
    Incredible! This blog looks just like my old one! It’s on a completely different
    subject but it has pretty much the same page layout and design.
    Great choice of colors!|
    There’s certainly a great deal to know about this subject.
    I love all the points you’ve made.|
    You have made some decent points there. I checked
    on the web to find out more about the issue and found most individuals will go along with your views on this website.|
    What’s up, I read your new stuff daily. Your humoristic style is witty,
    keep doing what you’re doing!|
    I just couldn’t depart your site before suggesting that I really
    loved the usual information a person supply to your guests?

    Is going to be back ceaselessly to inspect new
    posts|
    I wanted to thank you for this fantastic read!! I absolutely loved
    every bit of it. I have you bookmarked to check out
    new stuff you post…|
    What’s up, just wanted to tell you, I loved this article.

    It was inspiring. Keep on posting!|
    I comment whenever I especially enjoy a post on
    a site or if I have something to valuable to contribute to the conversation.
    It’s triggered by the fire displayed in the post I read.
    And after this article Setting breakpoint on entry point with Windbg
    | Reverse Engineering. I was actually moved enough to drop a commenta response :
    -) I do have 2 questions for you if you don’t mind.

    Could it be only me or do a few of the responses come across like coming from brain dead folks?
    :-P And, if you are posting at additional places, I’d like to
    keep up with everything fresh you have to post.

    Could you make a list the complete urls of your public sites
    like your twitter feed, Facebook page or linkedin profile?|
    Hello, I enjoy reading all of your article post. I like to
    write a little comment to support you.|
    I constantly spent my half an hour to read this website’s posts all the time along with
    a mug of coffee.|
    I every time emailed this web site post page to all my friends, as if
    like to read it next my friends will too.|
    My coder is trying to convince me to move to .net from PHP.
    I have always disliked the idea because of the costs. But he’s tryiong
    none the less. I’ve been using WordPress on numerous websites for about a year and am nervous about switching to another platform.

    I have heard fantastic things about blogengine.net.
    Is there a way I can transfer all my wordpress content into it?
    Any kind of help would be really appreciated!|
    Hi there! I could have sworn I’ve visited this blog before but
    after browsing through some of the posts I realized it’s new to me.
    Nonetheless, I’m definitely happy I came across it and I’ll be bookmarking it and checking
    back frequently!|
    Great article! This is the kind of info that are meant
    to be shared around the web. Shame on the search engines for not positioning this post upper!
    Come on over and talk over with my website . Thanks =)|
    Heya i’m for the first time here. I found this board and I find It truly useful & it helped me out
    a lot. I hope to give something back and aid others like
    you aided me.|
    Howdy, I do think your web site may be having browser compatibility issues.
    When I take a look at your site in Safari, it looks fine however, if opening in IE, it has some
    overlapping issues. I just wanted to give you a quick heads
    up! Besides that, excellent website!|
    Someone necessarily help to make severely posts I might state.
    That is the very first time I frequented your web page and to this point?
    I surprised with the research you made to create this particular publish incredible.
    Great job!|
    Heya i am for the first time here. I came across this
    board and I find It truly helpful & it helped me out a lot.
    I’m hoping to provide something again and aid others such as you aided me.|
    Hello! I simply wish to offer you a big thumbs up for your excellent information you have got right here on this
    post. I’ll be coming back to your website for more soon.|
    I always used to read piece of writing in news papers but
    now as I am a user of web thus from now I am using net for articles or reviews, thanks
    to web.|
    Your way of telling everything in this article is truly
    good, all be able to simply be aware of it, Thanks a lot.|
    Hello there, I found your blog by means of Google even as looking for a similar subject, your site got here up, it
    looks good. I have bookmarked it in my google bookmarks.

    Hi there, simply become aware of your blog via Google, and found that it
    is truly informative. I’m going to be careful
    for brussels. I’ll appreciate in the event you continue this in future.
    Numerous other people will be benefited from your writing.
    Cheers!|
    I am curious to find out what blog platform you’re using?
    I’m experiencing some minor security issues with my latest
    blog and I’d like to find something more secure. Do you have any recommendations?|
    I am extremely impressed with your writing skills
    as well as with the layout on your weblog. Is this a
    paid theme or did you modify it yourself? Either way keep up
    the nice quality writing, it’s rare to see a nice blog like this one
    nowadays.|
    I am really inspired along with your writing talents as smartly as with the
    layout on your blog. Is this a paid theme or did you modify it
    yourself? Either way stay up the nice quality writing, it
    is uncommon to look a nice weblog like this one nowadays..|
    Hi, Neat post. There is a problem together with your site in internet explorer, would
    test this? IE nonetheless is the market leader and a good portion of other folks will leave out your great writing due
    to this problem.|
    I am not sure where you are getting your information, but great topic.

    I needs to spend some time learning more or understanding more.
    Thanks for fantastic info I was looking for this
    information for my mission.|
    Hi, i think that i saw you visited my website so i came to “return the favor”.I
    am trying to find things to improve my web site!I
    suppose its ok to use some of your ideas\

    Like

  10. I think this is among the most vital info for me.

    And i am glad reading your article. But wanna remark on some general things, The
    web site style is ideal, the articles is really excellent : D.
    Good job, cheers

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Follow

Get every new post delivered to your Inbox.

Join 1,812 other followers

%d bloggers like this: