TLDR Tech / InfoSec
Debugging - WinDBG & WinDBGX Fundamentals
Corelan's corelanc0d3r published a comprehensive WinDBG and WinDBGX fundamentals guide covering installation, process attachment, breakpoint mechanics, memory inspection, and mona.py integration. Attaching to a running process rather than launching through the debugger avoids changes to NtGlobalFlag heap validation (0x70 in Classic, 0x10 in WinDBGX) that shift allocation layouts and invalidate exploit calculations. Defenders and researchers should anchor breakpoints to symbol names or module-relative offsets rather than absolute addresses to stay ASLR-resilient, and leverage breakpoint command chains with `gc` to build silent dynamic loggers without halting execution.
Read the full story