Using Windbg for reverse engineering

This article is a tutorial on how to use Windbg. The "classic" version of the debugger will be considered. Let's customize the look and explore the commands that can be used to explore the application.

Installation

Windows SDK. Windows 10 . SDK . .

, "Windows Kits". . . . , :

• : File → Symbol File Path. : "SRVC:\symbolshttp://msdl.microsoft.com/download/symbols". C:\symbols;

  
  
  
  
  

• WorkPlace . Workspace . , notepad.exe , :

  
  
  
  
  

. .

".hh". , . .

, , , , . .

1. . , EntryPoint , . EntryPoint . , , .

   
   
   
   
   

- lm. , , .

, - d? (b,c,a,p,w,q). . . , :

!dh . , -f. , .

, , , .

. : ? - , uf - , bp - . :

.

ret .

, , , . bl.

, , - g.

:

main. , , :

s. . , . , .

, , , , . ba. , . 4 . g. :

, , . . k.

, , "For_Crackme+0x15f2".

2. . . . uf - u "For_Crackme+0x15f"



:

, :

• offset For_Crackme+0x40a2
  
  
  
  

  
  
  
  
  

• offset For_Crackme+0x40bb
  
  
  
  

  
  
  
  
  

, db:

, . - . 2 , :

...
00401612 c744241c30372f31 mov     dword ptr [esp+1Ch],312F3730h
0040161a c7442420302f3937 mov     dword ptr [esp+20h],37392F30h
...

      
      

        
        
        
      

    
        
        
        
      
      

        
        
        
      

    
    

, : "07/10/97". .formats 312F3730h. Char . , LittleEndian , , .

Windbg .

---

"Reverse-Engineering. Professional". , " ". :

•