TWindbg

PEDA-like debugger UI for WinDbg

Introduction

This is a windbg extension ( using pykd ) to let user having a PEDA-like debugger UI in WinDbg.
It will display the following context in each step/trace:

• Registers
• Disassembled code near PC
• Contents of the stack pointer ( with basic smart dereference )

It also supports some peda-like commands ( see the support commands section )

For now it supports both x86 & x64 WinDbg.

Dependencies

• Python 2/3

For now the extension is Python2/3 compatible.
However since now Python2 has reached the EOL, all the feature will be tested on Python3 from now on.
I'll try my best to keep this extension as a Python2/3 compatible project, however there's still a possibility that I might drop the support of Python2 in the future.

• pykd

Installation

• Install Python2/3
• Install pykd
  • Download Pykd-Ext, unpack pykd.dll to the [WinDbg Directory]\x86(or x64)\winext\ directory.
    • This will allow you to run python in Windbg.
  • In the Windbg command line, enter command .load pykd to load the pykd module.
  • Enter !pip install pykd to install the pykd python package.
    • Upgrade the pykd module with command !pip install --upgrade pykd.
    • If something went wrong during the installation with pip install, try installing the wheel package instead of the one on PyPI. You can download the wheel package here.
• Download the repository
• Install the matrix theme by double-clicking the matrix_theme.reg
  • The matrix theme is required for letting the color theme work in TWindbg
  • You can preview the theme by importing the matrix_theme.WEW workspace into WinDbg.
• Copy the TWindbg folder into [WinDbg Directory]\x64\winext\ & [WinDbg Directory]\x86\winext\

Usage

Launch TWindbg manually

• Open an executable or attach to a process with WinDbg
• Use .load pykd to load the pykd extension
• Use !py -g winext\TWindbg\TWindbg.py to launch TWindbg

Launch TWindbg with command

[PATH_TO_WINDBG] -a pykd -c "!py -g winext\TWindbg\TWindbg.py"

Or you can write a simple batch file for the sake of convenience.

After that you can just use t or p to see if the extension is working.

Support Commands

• TWindbg: List all the command in TWindbg
• ctx: Print out the current context
• tel / telescope: Display memory content at an address with smart dereferences

Note

Maybe ( just maybe ) I'll add more command to make WinDbg behave more like PEDA ( or other debugger like pwndbg, GEF... ) in the future.