How can I load a dump thru Powerdbg's "New-DbgSession" command? - powershell

Question

I am trying to use the Powerdbg module to analyse a kernel dump. I have managed to successfully install the module. But I am unable to start a new session.
New-DbgSession -dump F:\Downloads\021715-61105-01.dmp
But it opens a blank command prompt titled "CDB.exe" and does nothing. I have Windbg installed on my machine. and the `debuggerroot' variable is rightly pointed to its path. What could I be doing wrong?
The codeplex Powerdbg discussion page isn't active.

Answer 1

i have been intending to try this so i downloaded the latest package and tested it result is as follows see if you can follow through it
i created a bat file which sets the DebuggingTools Environment variable to windows 8.0 debugger installation (xp virtual machine)
in the bat file i invoke powershell with Import-module
when i get a ps command prompt i start a new verbose dbgSession with a dumpfile test.dmp located at c:\
:dir /b
Install_PowerDbg.bat
PowerDbg.psm1
PowerDbgConsole.ps1
PowerDbg_6.10.10.22.zip
runpdbg.bat
:type runpdbg.bat
set DebuggingTools=c:\Program Files\Windows Kits\8.0\Debuggers\x86
c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -nologo -noexit -comma
nd "Import-Module" .\powerdbg.psm1
:runpdbg.bat
:set DebuggingTools=c:\Program Files\Windows Kits\8.0\Debuggers\x86
:c:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe -nologo -noexit -comm
and "Import-Module" .\powerdbg.psm1
WARNING: Some imported command names include unapproved verbs which might make
them less discoverable. Use the Verbose parameter for more detail or type
Get-Verb to see the list of approved verbs.
WARNING: Some imported command names contain one or more of the following
restricted characters: # , ( ) {{ }} [ ] & - / \ $ ^ ; : " ' < > | ? # ` * % +
= ~
PS C:\Documents and Settings\Admin\Desktop\PowerDbg_6.10.10.22> New-DbgSession -
verbose -dump C:\test.dmp
VERBOSE: Using debugging tools from c:\Program Files\Windows
Kits\8.0\Debuggers\x86
VERBOSE: c:\Program Files\Windows Kits\8.0\Debuggers\x86\CDB.exe -z C:\test.dmp
VERBOSE:
Verb :
Arguments : -z C:\test.dmp
CreateNoWindow : False
EnvironmentVariables : {pathext, homepath, symbol_path, clientname...}
RedirectStandardInput : True
RedirectStandardOutput : True
RedirectStandardError : True
StandardErrorEncoding :
StandardOutputEncoding :
UseShellExecute : False
Verbs : {Enable/Disable Digital Signature Icons, open, Open
i
n PPEE (puppy), Open with CFF Explorer...}
UserName :
Password :
Domain :
LoadUserProfile : False
FileName : c:\Program Files\Windows
Kits\8.0\Debuggers\x86\CDB.e
xe
WorkingDirectory : C:\Documents and
Settings\Admin\Desktop\PowerDbg_6.10
.10.22
ErrorDialog : False
ErrorDialogParentHandle : 0
WindowStyle : Normal
VERBOSE: RX (discard)
VERBOSE: TX: .echo PowerDbg connected
VERBOSE: RX: PowerDbg connected
VERBOSE: RX: 0:000> PowerDbg_Complete_184742.640
VERBOSE: RX Complete
VERBOSE: RX (discard) 0:000>
VERBOSE: TX: .printf "%d\n", #$ptrsize
VERBOSE: RX: 4
VERBOSE: RX: 0:000> PowerDbg_Complete_184742.656
VERBOSE: RX Complete
VERBOSE: Connected to 32 bit process/dump
PS C:\Documents and Settings\Admin\Desktop\PowerDbg_6.10.10.22>
this command also seems to start a session correctly (you may need to add debugger path explicitly in $searchpath in powerdbg.psm1 line arount 440 in function Get-DbgToolsLocation()
powershell.exe -nologo -noexit -File PowerDbgConsole.ps1 -verbose -dump c:\test.dmp