`ls` command not working as expected in windbg - windbg

I'm debugging a piece of code and I got it to break at an exception. I have the relevant source and symbol paths set up, but when I use ls, it doesn't show or list the current source file, even when it highlights the line in the open source file I'm interested in when I select the correct stack frame.
Why is that? What am I not understanding? What is meant by 'current source file'?

When you are on an address where source file is not available (like _dbgbreakpoint on ntdll) issuing ls will emit the message "No current source file":
0:000> ln #eip
(7c90120e) ntdll!DbgBreakPoint | (7c901212) ntdll!DbgUserBreakPoint
Exact matches:
ntdll!DbgBreakPoint = <no type information>
0:000> ls
No current source file
ls by itself requires a preloaded source file using lsf or you need to set the .srcpath.
This loaded source file remains loaded until you remove it or another source file is loaded automatically by an event (i.e. if you do .restart and break on _dbgbreak and do a ls, it will show the stale source file that was loaded with lsf earlier):
0:000> .restart
ntdll!DbgBreakPoint:
7c90120e cc int 3
0:000> ls
77: PAttributeHeader psecondheader = NULL ;
78: PAttributeHeader pthirdheader = NULL;
79: PFileInfoAttributeRecord pfinforecord = NULL;
80:
81: memset(&dump,0,sizeof(dump));
82: fopen_s( &fp,"\\\\.\\PHYSICALDRIVE0", "rb" );
Using lsa . (notice the .) instead of ls, it loads the source for the current address.
The current line is denoted by > in the paste below .
Notice ls fails due to no pre loaded source file whereas lsa . gives you the source line.
0:000> g wmain
00401000 55 push ebp
0:000> ls
No current source file
0:000> lsa .
67: }FileInfoAttributeRecord,*PFileInfoAttributeRecord;
68:
69:
70: int _tmain(int argc, _TCHAR* argv[])
> 71: {

Related

Dual regression error (multiple files in a text file)

So I'm running into some trouble using dual_regression. The problem here is that I'm using the following command and getting the following error:
> macminngh:session_one_and_three sondosayyash$ dual_regression /Users/sondosayyash/Downloads/FIX_sNorm/40_subjects.gica/groupmelodic.ica/melodic_IC.nii.gz 1 -1 5000 dualreg_40subj_output.dr 'cat /Users/sondosayyash/Desktop/Users.txt'
/Users/sondosayyash/abin/fsl/bin/dual_regression: line 126: [: too many arguments
mkdir: dualreg_40subj_output.dr: File exists
mkdir: dualreg_40subj_output.dr/scripts+logs: File exists
creating common mask
/bin/sh: line 1: syntax error near unexpected token `dualreg_40subj_output.dr/scripts+logs/drA'
/bin/sh: line 1: `file (dualreg_40subj_output.dr/scripts+logs/drA) does not exist -T 5 -N drB -l dualreg_40subj_output.dr/scripts+logs dualreg_40subj_output.dr/scripts+logs/drB'
doing the dual regressions
sorting maps and running randomise
/bin/sh: line 1: you: command not found
I don't know where I'm going wrong.
As for the text file listed as 'Users.txt' has many different file directories to filtered_func data.
I have a feeling there is a problem with the text file but I'm not entirely sure.

Getting emacs realgud:pry to work

Need some help getting realgud to play nice with pry-remote.
This is a sample ruby file (x.rb)
require 'pry-remote'
class Foo
def initialize(x, y)
binding.remote_pry
puts "hello"
end
end
Foo.new(1,3)
In a shell buffer:
bash: ruby x.rb
[pry-remote] Waiting for client on druby://127.0.0.1:9876
# check that I have a listening process
bash: ss -nlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 127.0.0.1:9876 *:*
In emacs:
M-x realgud:pry
pry-remote ; enter this at the prompt
This is what I see in emacs;
File Edit Options Buffers Tools Inf-Ruby Debugger Help
32: end
33:
34: return_value
35: end
=>[0G[1] pry(#<PryNav::Tracer>)>
-=--:**--F1 *pry +No filename+ shell* Bot L53 (Comint:r
stop unless RUBY_VERSION == '1.9.2'
return_value = nil
command = catch(:breakout_nav) do # Coordinates w$
return_value = yield
=> {} # Nothing thrown == no navigational command
end
-=--:%%--F1 tracer.rb 24% L21 (Ruby ShortKeys) ---
My question is: why am I seeing the breakpoint in tracer.rb? How do I get the breakpoint
to be in my source file?
Hitting 'n' twice in the source window causes the shell buffer to echo the following, but there
is no change in the source window itself.
=>[0G[1] pry(#<PryNav::Tracer>)> next 1
next 1
Also, the 'u' and 'd' keystrokes yield
Command down is not implemented for this debugger
Command up is not implemented for this debugger

How to use bibliography in different directory when knitting rmarkdown document to beamer presentation?

I'm knitting some beamer slides in an RMarkdown script in Rstudio on a Windows 7 PC. The slides are in the directory
C:/me/slides/myslides.Rmd
I have a master bibliography that lives in
C:/me/bib/masterbib.bib
I cannot figure out how to link to the bibliography file from the RMarkdown document. Here's the YAML from my attempt:
---
title: "Slides"
author: "me"
date: "2016-12-20"
bibliography: C:/me/bib/masterbib.bib
biblio-style: "apalike"
output:
beamer_presentation:
citation_package: natbib
---
Here's the error:
! Undefined control sequence.
<write> \string \bibdata {C:\me\bib\masterbib}
l.174 \end{frame}
Error: Failed to compile Slides.tex. See Slides.log for more info.
In addition: Warning message:
running command '"pdflatex" -halt-on-error -interaction=batchmode "Slides.tex"' had status 1
Execution halted
I've tried a couple other ways to specify the directory for masterbib.bib, but none have worked. I would prefer to keep the masterbib.bib file where it is, and not make an extra copy in the C:/me/slides/ directory. Thanks for your help!
Edit
When attempting to pass the following into YAML (quoteed with forward slashes):
bibliography: "C:/LaTeXstuff/BibTexLibrary/BrianBib.bib"
I get a fatal error with log output:
! Undefined control sequence.
<write> \string \bibdata {C:\me
\bib\masterbib}
l.174 \end{frame}
Here is how much of TeX's memory you used:
18047 strings out of 494045
334241 string characters out of 3145937
424206 words of memory out of 3000000
20891 multiletter control sequences out of 15000+200000
31808 words of font info for 44 fonts, out of 3000000 for 9000
715 hyphenation exceptions out of 8191
56i,11n,55p,434b,376s stack positions out of 5000i,500n,10000p,200000b,50000s
! ==> Fatal error occurred, no output PDF file produced!
When passing the following into YAML (quoted with backslashes)
bibliography: "C:\me\bib\masterbib.bib"
I get the following error in the Rstudio console
Error in yaml::yaml.load(enc2utf8(string), ...) :
Scanner error: while parsing a quoted scalar at line 4, column 15found unknown escape character at line 4, column 29
Calls: <Anonymous> ... yaml_load_utf8 -> mark_utf8 -> <Anonymous> -> .Call
Execution halted
When passing the following into YAML (unquoted with backslashes)
bibliography: C:\me\bib\masterbib.bib
I get the following error in the Rstudio console
! Undefined control sequence.
<write> \string \bibdata {C:\me
\bib\masterbib}
l.174 \end{frame}
Error: Failed to compile BibTest.tex. See BibTest.log for more info.
In addition: Warning message:
running command '"pdflatex" -halt-on-error -interaction=batchmode "BibTest.tex"' had status 1
Execution halted
Try unquoted with two backslashes:
...
bibliography: C:\\me\\bib\\masterbib.bib
...

Unable to verify checksum for exe

hi i have attached crash dump for an exe and symbols also.but i am getting this error:
Unable to verify checksum for abc.exe.
What would be the reason for this?
Unable to verify checksum is emitted when the checksum in the PE header isn't verifiable.
This can happen if the exe in question was compiled and linked without using /RELEASE linker option.
Normal project based compile linker sets this option. nmake or batch file based compilation can omit this switch and can lead to this output.
A simple hello world compiled and linked with and without /RELEASE linker option (PDB not generated for simpilicity and diffed to show the difference in timestamp and checksum). Loaded in WinDbg and checksum warning is generated only for the exe with no checksum in PE header.
simple hello world.cpp contents
testrelease:\>dir /b & type testrelease.cpp
testrelease.cpp
#include <stdio.h>
int main (void) {
printf("hello my relase\n");
return 0;
}
compiling without /RELEASE
testrelease:\>cl /nologo testrelease.cpp
testrelease.cpp
renaming the exe and compiling the same source with with /RELEASE
testrelease:\>ren testrelease.exe testrelease_norel.exe
testrelease:\>cl /nologo testrelease.cpp /link /release
testrelease.cpp
comparing both exes
testrelease:\>fc /b testrelease.exe testrelease_norel.exe
Comparing files testrelease.exe and TESTRELEASE_NOREL.EXE
000000E0: D6 CE
00000130: A3 00
00000131: 95 00
00000132: 01 00
analysing output of the comparison
testrelease:\>xxd -s +0x3c -l 1 testrelease.exe
000003c: d8 .
testrelease:\>xxd -s +0x3c -l 1 testrelease_norel.exe
000003c: d8 .
testrelease:\>echo d8 = NT_HEADER so e0 = TimeDateStamp and 130 = CheckSum
d8 = NT_HEADER so e0 = TimeDateStamp and 130 = CheckSum
loading both exes in windbg warning generated for only one exe without checksum
testrelease:\>cdb -c ".reload /f ; q" testrelease.exe
.*** ERROR: Module load completed but symbols could not be loaded for image00400
testrelease:\>cdb -c ".reload /f ; q" testrelease_norel.exe
.*** WARNING: Unable to verify checksum for image00400000
*** ERROR: Module load completed but symbols could not be loaded for image004000
no symbol header available error means the exe was compiled without debug information.
You can't do much about it unless you have a lot of expertise in recreating debug information from scratch.
Both the executables that are compiled above will generate the error because iIhave intentionally not created the debug information.
DBGHELP: image00400000 missing debug info. Searching for pdb anyway
DBGHELP: Can't use symbol server for image00400000.pdb - no header information available

cdb/windbg output too large

We are using cdb (command line version of winDBG) to resolve a cab.
For getting the output in a file we are using the -logo output to specify the output file.
For a certain cab we are getting "CvRegToMachine(x86) conversion failure for 0x7536" more than a million times.
Basically we get a huge resolved code log, nearly 1GB, and all of it filled with the above string on each line.
We are using the following cdb command
cdb -z "abc.cab" -y "SymbolsPath" -G -logo "outputfile" -lines -c ".kframes 100;!analyze -v;!load msec.dll;!exploitable -v;vertarget;lmv;q"
Does anyone have any clue about what could be wrong here?
you cannot use -c and -G at the same time -c needs the first break to read the initial
command and act upon it if you need to run the code use g; at the end of -c commands
also many times -c commands need to be provided first and the debugee needs
to be at the end of commandline
cdb -c "<some cmd;someother cmd;g>" -z foo.cab
.load not !load should be used to load third party extensions
the string emitted "CvReg.........." seems to be related to Either SYMFLAG_NULL or SYMFLAG_REGISTER in the Flags member of SYMBOLINFO Struct .
a sample trial didnt cross that code path in my machine so either the corrupt dmp or more information regarding the dmp file may be needed to find the reason for the spew
creating dump
C:\>dir /b *.cab
File Not Found
C:\>cdb -c ".dump /ma /b foo.cab;q" calc | grep -i -E "dmp|dump|wr"
0:000> cdb: Reading initial command '.dump /ma /b foo.cab;q'
Creating C:\DOCUME~1\Admin\LOCALS~1\Temp\foo.cab.dmp - mini user dump
Dump successfully written
Adding C:\DOCUME~1\Admin\LOCALS~1\Temp\foo.cab.dmp - added
Wrote foo.cab
C:\>dir /b *.cab
foo.cab
**loading dump as debugees(cdb) debuggee (foo.cab) and looking around **
C:\>cdb cdb -z foo.cab
0:000> s -u dbgeng l?39b000 "CvReg"
020341f8 0043 0076 0052 0065 0067 0054 006f 004d C.v.R.e.g.T.o.M.
0:000> # *(*20341f8 dbgeng l?39b000
dbgeng!MachineInfo::CvRegToMachine+0xfe:
021bf8ae 68f8410302 push offset dbgeng!`string' (020341f8)
0:000> # call*dbgeng!MachineInfo::CvRegToMachine dbgeng l?39b000
dbgeng!ImageInfo::CvRegToMachine+0x22:
021b62f2 e8b9940000 call dbgeng!MachineInfo::CvRegToMachine (021bf7b0)
0:000> # call*CvRegToMachine dbgeng l?39b000
dbgeng!ImageInfo::CvRegToMachine+0x22:
021b62f2 e8b9940000 call dbgeng!MachineInfo::CvRegToMachine (021bf7b0)
dbgeng!TypeInfoValueFromSymInfo+0x4b:
022541ab e82021f6ff call dbgeng!ImageInfo::CvRegToMachine (021b62d0)
dbgeng!TypedData::SetToSymbol+0x25f:
02285edf e8ec03f3ff call dbgeng!ImageInfo::CvRegToMachine (021b62d0)
dbgeng!TypedData::SetToSymbol+0x2da:
02285f5a e87103f3ff call dbgeng!ImageInfo::CvRegToMachine (021b62d0)
0:000> ln 0x21bf8ae
(021bf7b0) dbgeng!MachineInfo::CvRegToMachine+0xfe | (021bf8d0) dbgeng!Ma
chineInfo::GetContextState
doing and uf on this function yields the check where SymbolInfo->Flags is
checked and decided my sample dump above doesnt enter the path