windowsdebuggingwindbgcdb

How to keep breakpoints between sessions using cdb (windbg command line)?


My goal is to keep breakpoints between debugging sessions in CDB (the command line version of windbg). I am able to correctly restart by using .restart, however I always lose my breakpoints (I am setting my breakpoints by using the bu and/or bm commands.

Is it even possible when using just cdb?


Solution

  • cdb is not possible use .bpcmds before .restart and save to someplace and reuse it after restart

    for windbg you can use workspaces to save breakpoints between sessions

    edit a demo

    suppose you have these breakpoints

    0:000> bl
     0 e 00007ff6`0fc4109c     0001 (0001)  0:**** calc!wWinMain
     1 e 00007ff6`0fc41820     0001 (0001)  0:**** calc!wWinMainCRTStartup
     2 e 00007ff6`0fc41960     0001 (0001)  0:**** calc!matherr
     3 e 00007ffb`f033d880     0001 (0001)  0:**** ntdll!NtCreateTimer2
     4 e 00007ffb`f033d6a0     0001 (0001)  0:**** ntdll!NtCreateNamedPipeFile
     5 e 00007ffb`f02a2000     0001 (0001)  0:**** ntdll!RtlDefaultNpAcl+0x190
     6 e 00007ffb`ede53000     0001 (0001)  0:**** KERNELBASE!EnumDynamicTimeZoneInformation+0x60
    

    .bpcmds will show you how set them (the last two are symbol less bps based on rva )

    and if you had set them using bp they may not work the next time
    due to ASLR as the module may be loaded at a different Address

    0:000> .bpcmds
    bu0 calc!wWinMain;
    bu1 calc!wWinMainCRTStartup;
    bu2 calc!wsetargv;
    bu3 ntdll!ZwCreateTimer2;
    bu4 ntdll!ZwCreateNamedPipeFile;
    bu5 ntdll+2000;
    bu6 kernelbase+3000;
    0:000>  
    

    copy paste to some scratch space and after .restart copy paste back to cdb console

    you can use .logopen {some_path_to_some_textfile} do .bpcmds and .restart also

    in this case you can copy paste the bps from logfile and don't have to open the log file again as windbg/cdb doesn't close the logfile on .restart

    here is .restart also capturted to logfile

    bu6 kernelbase+3000;
    0:000> .restart
    CommandLine: calc