Useful Links on assembly level instruction

In order to learn debugging using windbg, knowlege of assembly language is must. 

Please find few good links for basic assembly level instructions.

•Under the Hood (Feb 98):

 http://www.microsoft.com/msj/0298/hood0298.aspx

•Under the Hood (June 98):

 http://www.microsoft.com/msj/0698/hood0698.aspx

 

Setting up Microsoft symbol Server to debug using windbg

What are Symbols?
Symbol is a name assigned to a location in memory.  In case of private symbol they include function name, type, parameter, variables and line number.

Public symbols do not include the line number and local variables.

How to reference the Microsoft Symbol Server to obtain symbol debugging information?
The Microsoft Symbol Server is built by using the SymSrv technology (SymSrv.dll) that is provided with the Debugging Tools for Windows package. SymSrv builds a local symbol cache for fast, automatic symbol resolution.

It is as simple to use the Symbol Server as it is to use the appropriate syntax in your symbol path. Typically, the syntax takes the following format:

SRV*your local symbol folder*http://msdl.microsoft.com/download/symbols

where your local symbol folder is any drive or share that is used as a symbol destination.

For example, to set the symbol path in the WinDbg debugger, type the following command in the command window of the debugger:

.sympath SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols

 

Setting the _NT_SYMBOL_PATH environment variable

The common Microsoft debugging tools use the SymSrv technology if you provide the correct symsrv syntax in the _NT_SYMBOL_PATH environment variable. These tools automatically include whatever you provide in the variable as the symbol path.

You can set this variable as a system variable or as a user environment variable. To do this from the desktop, right-click My Computer, and then click Properties. On the Advanced tab, click Environment Variables.

You can also set this variable temporarily at a command prompt. In this way, all applications that you start through the command prompt inherit this setting. For example:

Set _NT_SYMBOL_PATH = symsrv*symsrv.dll*f:\localsymbols*http://msdl.microsoft.com/download/symbols

 

Using the Microsoft Symbol Server with WinDbg

To use the Symbol Server Web site from within WinDbg, follow these steps:

1. Start the Windows Debugger (WinDbg.exe).
2. On the File menu, click Symbol File Path.
3. In the Symbol path box, type the following command:
   SRV*your local folder for symbols*http://msdl.microsoft.com/download/symbols
   where your local folder for symbols is the folder in which you copy your local symbol cache. The debug symbols are downloaded to this location.
   
   Note You can point to any local path or share that your computer can reach; it does not have to be a location on the computer's hard disk.

Alternatively, you can also use the .sympath command at a command prompt to set the symbol path.

You can combine the symsrv syntax with other symbol paths. For example, use the following syntax to specify two or more symbol paths:

f:\MySymbols;SRV*f:\localsymbols*http://msdl.microsoft.com/download/symbols

First and Second chance exception

What is a first chance exception?

When an application is being debugged, the debugger gets notified whenever an exception is encountered At this point, the application is suspended and the debugger decides how to handle the exception. The first pass through this mechanism is called a "first chance" exception. Depending on the debugger's configuration, it will either resume the application and pass the exception on or it will leave the application suspended and enter debug mode. If the application handles the exception, it continues to run normally.

In Visual Studio, you may see a message in the output window that looks like this:

A first chance exception of type 'System.ApplicationException' occurred in myapp.exe

If the application does not handle the exception, the debugger is re-notified. This is known as a "second chance" exception. The debugger again suspends the application and determines how to handle this exception. Typically, debuggers are configured to stop on second chance (unhandled) exceptions and debug mode is entered, allowing you to debug.

Does a first chance exception mean there is a problem in my code?First chance exception messages most often do not mean there is a problem in the code. For applications / components which handle exceptions gracefully, first chance exception messages let the developer know that an exceptional situation was encountered and was handled.

For code without exception handling, the debugger will receive a second chance exception notification and will stop with a unhandled exception.

How to set Windbg as default debugger using .reg file

Capturing Dump Using Windbg

Copy following lines in a text file and save as .reg file. Dump files will be saved in c:\dump folder.

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug]
"Auto"="1"
"UserDebuggerHotKey"=dword:00000000
"Debugger"="\"c:\\Program Files\\Debugging Tools for Windows (x86)\\windbg.exe\" -p %ld -e %ld -g -Q -c \".dump /mfhtpu /u c:\\dump.dmp;q\""

How to Set WinDbg as a Default Windows Postmortem Debugger

Sometimes it’s difficult to capture a user dump inside a terminal session because Dr. Watson doesn’t work as the default debugger.

The could be possibly caused by security permissions in Windows Server 2003.

Steps to set Windbg as default Postmortem debugger.

Resolution

1. Install the latest Debugging Tools for Windows:

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

2. Set WinDbg as a default debugger by issuing the following command:
           WinDbg -I

Note: The I must be capitalized.

3. Create a folder where the dump must be stored and give it full control permissions for users or remote desktop users.

For this example, the c:\TEMP folder is used.

4. Inspect the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug

For example, it has the following value:

"C:\Program Files\Debugging Tools for Windows\windbg.exe" -p %ld -e %ld -g

Take the current key value and append the following string:

-c '.dump /o /f c:\TEMP\new.dmp; q' -Q -QS -QY -QSY

The new key should have the following value:

"C:\Program Files\Debugging Tools for Windows\windbg.exe" -p %ld -e %ld -g -c '.dump /o /f c:\TEMP\new.dmp; q' -Q -QS -QY -QSY

On 64-bit Windows, use the 64-bit Debugging Tools for Windows. However if you want to save dumps from 32-bit processes (shown as *32 in Task Manager) you also need to change Wow6432Node registry hive and use the 32-bit WinDbg.exe from the 32-bit Debugging Tools for Windows:

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\AeDebug

5. Whenever there is an exception inside a session, a dump is stored in the TEMP folder.