Debugging

Debugger Tips

Context Operator

Syntax

• There are two ways of specifying context:

  1. {,,[module] } expression

  2. The braces must contain two commas and the module (executable or DLL) name or full path.

  3. For example, to set a breakpoint at the SomeFunction function of EXAMPLE.dll:

     • {,,EXAMPLE.dll}SomeFunction
     • module!expression

  4. module!expression

  5. Ex: EXAMPLE.dll!SomeFunction

• module is the name of a module. You can use a full path to disambiguate between modules with the same name.

  • If the module path includes a comma, an embedded space, or a brace, you must use quotation marks around the path so that the context parser can properly recognize the string. Single quotation marks are considered part of a Windows file name, so you must use double quotation marks. For example,
  • {,,"a long, long, library name.dll"} g_Var

• expression is any valid C++ expression that resolves to a valid target, such as a function name, variable name, or pointer address in module.

  • When the expression evaluator encounters a symbol in an expression, it searches for the symbol in the following order:
  • Lexical scope outward, starting with the current block, series of statements enclosed in braces, and continuing outward with the enclosing block. The current block is the code containing the current location, instruction pointer address.
  • Function scope. The current function.
  • Class scope, if the current location is inside a C++ member function. Class scope includes all base classes. The expression evaluator uses the normal dominance rules.
  • Global symbols in the current module.
  • Public symbols in the current program.

From https://docs.microsoft.com/en-us/visualstudio/debugger/context-operator-cpp

Commands & PseudoVars

• alias: List useful commands
• Command window: ? … to execute immediate window things

• Immediate window: > … to execute commands

  • Ex: ">shell cmd"

https://docs.microsoft.com/en-us/visualstudio/debugger/pseudovariables

Format Specifiers

https://docs.microsoft.com/en-us/visualstudio/debugger/format-specifiers-in-cpp

Format Pointers as Arrays

Magic Numbers

From http://en.wikipedia.org/wiki/Magic_number_(programming)

CRT runtime Debugging Techniques http://msdn.microsoft.com/en-us/library/zh712wwf(v=vs.120).aspx http://msdn.microsoft.com/en-us/library/k70yt3e2.aspx

Global in Watch Window

The way to scope the global is as follows using the Context Operator: {,,foobar.dll}g_pMyStruct where foobar.dll defines g_pMyStruct as a global pointer. The same syntax can be used to scope breakpoints as well.

Advanced Debugging Tricks

• Common Visual Studio Commands:

  • https://docs.microsoft.com/en-us/visualstudio/ide/reference/visual-studio-commands
  • Complete commands can be found in Keyboard, EnvironmentOptions dialog box

• Can use VCMD to create macros as commands

• In the immediate window, prefix a command with > to execute. Ex: >Debug.AttachDetach

• Execute code in a macro:

  DTE.Debugger.ExecuteStatement("variable_name=0")

  Reference From http://stackoverflow.com/questions/3868810/visual-studio-breakpoint-macro-to-modify-a-value

• Can execute code in Action:print message section of breakpoint settings by wrapping the value in textfield with {}. Ex:

  • { variable_name=0} will set variable_name=0

• You can also concatenate several instructions on the same line. They simply have to be separated by curly braces:

  { {done = (i == 100);} { object.x -= 1.0f; } { data\[15] = 3; } }

  Reference From https://colinbarrebrisebois.com/2011/05/19/a-taste-of-live-code-editing-with-visual-studios-tracepoints

Tools

• WinDBG
• Perfmon
• Process Explorer
• Windows Performance Toolkit

Rules of thumb

• If CPU kernel utilization is high, then it's a driver problem

• If System interrupts .1%, driver problem

  • In process monitor, look at System|interrupts process and look at threads/modules to see what's pegging CPU
• Driverquery |find "driverdllname" to find info about a driver (don't use
• strings binary.exe: >bla.txt sysinternals tool to produce all string parameters for a binary

Misc

When trying to find all the libraries the project is loading & the order, add this flag to linker additional options: /verbose:lib

Use dumpbin & dependencywalker to find what libraries/dlls are linked against (MSVCRT/MSVCRTD/LIBCMT/x64 vs x86)

dumpbin.exe /Directives (use to see the runtime library that is linked
dumpbin.exe /HEADERS  (use to see if x86 vs x64 in the machine entry)
 DUMPBIN /LINKERMEMBER[:{1|2}] <libraryname.lib>      (output all the exported symbols in a lib)