aliaswindbg

How to use alias interpreter inside another alias in WinDbg?


I have a bunch of aliases for accessing global debug variables in my code, which look something like this:

aS _dbg_log_last "dx mymodule!g_dbg_variable_with_a_long_name->logger.log_buffer[mymodule!g_dbg_variable_with_a_long_name->logger.size - 1]"

I am obviously not a fan of the last one with the repetition, so I tried to refactor it to the following:

aS _dbg_log "mymodule!g_dbg_variable_with_a_long_name->logger"
aS _dbg_log_last "dx ${_dbg_log} .log_buffer[${_dbg_log}.size - 1]"

If I copy the contents of the _dbg_log_last alias and run it manually, everything works. But if I actually try to invoke it, I am getting an error:

Error: unexpected token at {_dbg_log}...

So it look like it swallow the $ character when executing the alias. I have tried also unquoting either or both aliases, using as instead of aS, adding /f and other flags to alias interpreter, escaping the $ with \$ or $$, nothing works.

Minimal repro:

aS _foo "1"
aS _bar "dx ${_foo} ,x"

dx ${_foo} ,x
_bar

Expected:

1 ,x : 0x1
1 ,x : 0x1

Actual:

1 ,x : 0x1
Error: Unexpected token at '{_foo} ,x'

Solution

  • As Nietsa says mixing dx with as / aS may not be compatible

    but unless you force execute with a .block{} the aliases are not going to be expanded

    ill show an example with a public struct see if that helps you

    delete prior aliases if any and list

    0:000> ad *
    0:000> al
    No aliases
    

    define new alaises and list

    0:000> as foo ((ntdll!_PEB *)@$proc)->ProcessParameters
    0:000> as bar ${foo}->DesktopInfo
    0:000> al
      Alias            Value
     -------          -------
     bar              ${foo}->DesktopInfo
     foo              ((ntdll!_PEB *)@$proc)->ProcessParameters
    

    check the simple alias

    0:000> ?? ${foo}->WindowTitle
    struct _UNICODE_STRING
     "C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe"
       +0x000 Length           : 0x78
       +0x002 MaximumLength    : 0x7a
       +0x008 Buffer           : 0x000002c3`30ca2e3a  "C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe"
    

    check the compound alias without a surrounding .block{}

    0:000> ?? ${bar}
    Unexpected character in '${foo}->DesktopInfo'
    

    surround it with a .block to force expansion first

    0:000> .block { ?? ${bar} }
    struct _UNICODE_STRING
     "WinSta0\Default"
       +0x000 Length           : 0x1e
       +0x002 MaximumLength    : 0x20
       +0x008 Buffer           : 0x000002c3`30ca2eb4  "WinSta0\Default"
    0:000>
    

    supposedly if you have a script file that is based on foo and bar above as below

    .block { ?? ${bar}.Buffer[0] }
    .block { ?? ${bar}.Buffer[1] }
    .block { ?? ${bar}.Buffer[2] }
    .block { ?? ${bar}.Buffer[3] }
    .block { ?? ${bar}.Buffer[4] }
    .block { ?? ${bar}.Buffer[5] }
    .block { ?? ${bar}.Buffer[6] == '1' } 
    .block { ?? ${bar}.Buffer[6] == '0' } 
    

    running the script should yield

    0:000> $$>< d:\alias.wds
    wchar_t 0x57 'W'
    wchar_t 0x69 'i'
    wchar_t 0x6e 'n'
    wchar_t 0x53 'S'
    wchar_t 0x74 't'
    wchar_t 0x61 'a'
    bool false
    bool true
    0:000>