Wine HQ - WineDbg Command Reference

1.7.1. Misc

Table 1-1. WineDbg's misc. commands

abort	aborts the debugger
quit	exits the debugger
attach N	attach to a W-process (N is its ID, numeric or hexadecimal (0xN)). IDs can be obtained using the info process command. Note the info process command returns hexadecimal values.
detach	detach from a W-process.
help	prints some help on the commands
help info	prints some help on info commands

1.7.2. Flow control

Table 1-2. WineDbg's flow control commands

cont, c	continue execution until next breakpoint or exception.
pass	pass the exception event up to the filter chain.
step, s	continue execution until next 'C' line of code (enters function call)
next, n	continue execution until next 'C' line of code (doesn't enter function call)
stepi, si	execute next assembly instruction (enters function call)
nexti, ni	execute next assembly instruction (doesn't enter function call)
finish, f	execute until current function is exited

cont, step, next, stepi, nexti can be postfixed by a number (N), meaning that the command must be executed N times.

1.7.3. Breakpoints, watch points

Table 1-3. WineDbg's break & watch points

enable N	enables (break\|watch)point #N
disable N	disables (break\|watch)point #N
delete N	deletes (break\|watch)point #N
cond N	removes any existing condition to (break\|watch)point N
cond N <expr>	adds condition <expr> to (break\|watch)point N. <expr> will be evaluated each time the breakpoint is hit. If the result is a zero value, the breakpoint isn't triggered
*break N**	adds a breakpoint at address N
break <id>	adds a breakpoint at the address of symbol <id>
break <id> N	adds a breakpoint at the address of symbol <id> (N ?)
break N	adds a breakpoint at line N of current source file
break	adds a breakpoint at current $PC address
*watch N**	adds a watch command (on write) at address N (on 4 bytes)
watch <id>	adds a watch command (on write) at the address of symbol <id>
info break	lists all (break\|watch)points (with state)

You can use the symbol EntryPoint to stand for the entry point of the Dll.

When setting a break/watch-point by <id>, if the symbol cannot be found (for example, the symbol is contained in a not yet loaded module), winedbg will recall the name of the symbol and will try to set the breakpoint each time a new module is loaded (until it succeeds).

1.7.4. Stack manipulation

Table 1-4. WineDbg's stack manipulation

bt	print calling stack of current thread
bt N	print calling stack of thread of ID N (note: this doesn't change the position of the current frame as manipulated by the up and dn commands)
up	goes up one frame in current thread's stack
up N	goes up N frames in current thread's stack
dn	goes down one frame in current thread's stack
dn N	goes down N frames in current thread's stack
frame N	set N as the current frame for current thread's stack
info local	prints information on local variables for current function frame

1.7.5. Directory & source file manipulation

Table 1-5. WineDbg's directory & source file manipulation

show dir	prints the list of dir:s where source files are looked for
dir <pathname>	adds <pathname> to the list of dir:s where to look for source files
dir	deletes the list of dir:s where to look for source files
symbolfile <pathname>	loads external symbol definition
symbolfile <pathname> N	loads external symbol definition (applying an offset of N to addresses)
list	lists 10 source lines forwards from current position
list -	lists 10 source lines backwards from current position
list N	lists 10 source lines from line N in current file
list <path>:N	lists 10 source lines from line N in file <path>
list <id>	lists 10 source lines of function <id>
*list N**	lists 10 source lines from address N

You can specify the end target (to change the 10 lines value) using the ','. For example:

Table 1-6. WineDbg's list command examples

list 123, 234	lists source lines from line 123 up to line 234 in current file
list foo.c:1, 56	lists source lines from line 1 up to 56 in file foo.c

1.7.6. Displaying

A display is an expression that's evaluated and printed after the execution of any winedbg command.

winedbg will automatically detect if the expression you entered contains a local variable. If so, display will only be shown if the context is still in the same function as the one the debugger was in when the display expression was entered.

Table 1-7. WineDbg's displays

info display	lists the active displays
display	print the active displays' values (as done each time the debugger stops)
display <expr>	adds a display for expression <expr>
display /fmt <expr>	adds a display for expression <expr>. Printing evaluated <expr> is done using the given format (see print command for more on formats)
del display N, undisplay N	deletes display #N

1.7.7. Disassembly

Table 1-8. WineDbg's dissassembly

disas	disassemble from current position
disas <expr>	disassemble from address <expr>
disas <expr>,<expr>	disassembles code between addresses specified by the two <expr>

1.7.8. Memory (reading, writing, typing)

Table 1-9. WineDbg's memory management

x <expr>	examines memory at <expr> address
x /fmt <expr>	examines memory at <expr> address using format /fmt
print <expr>	prints the value of <expr> (possibly using its type)
print /fmt <expr>	prints the value of <expr> (possibly using its type)
set <lval> = <expr>	writes the value of <expr> in <lval>
whatis <expr>	prints the C type of expression <expr>

/fmt is either /<letter> or /<count><letter> letter can be

s	an ASCII string
u	an Unicode UTF16 string
i	instructions (disassemble)
x	32 bit unsigned hexadecimal integer
d	32 bit signed decimal integer
w	16 bit unsigned hexadecimal integer
c	character (only printable 0x20-0x7f are actually printed)
b	8 bit unsigned hexadecimal integer
g	GUID

1.7.9. Information on Wine's internals

Table 1-10. WineDbg's Win32 objects management

info class	lists all Windows' classes registered in Wine
info class <id>	prints information on Windows's class <id>
info share	lists all the dynamic libraries loaded in the debugged program (including .so files, NE and PE DLLs)
info share <N>	prints information on module at address <N>
info regs	prints the value of the CPU registers
info all-regs	prints the value of the CPU and Floating Point registers
info segment <N>	prints information on segment <N> (i386 only)
info segment	lists all allocated segments (i386 only)
info stack	prints the values on top of the stack
info map	lists all virtual mappings used by the debugged program
info map <N>	lists all virtual mappings used by the program of pid <N>
info wnd <N>	prints information of Window of handle <N>
info wnd	lists all the window hierarchy starting from the desktop window
info process	lists all w-processes in Wine session
info thread	lists all w-threads in Wine session
info exception	lists the exception frames (starting from current stack frame)

1.7.10. Debug channels

It is possible to turn on and off debug messages as you are debugging using the set command. See Chapter 2 for more details on debug channels.

Table 1-11. WineDbg's debug channels' management

set + warn win	turn on warn on 'win' channel
set + win	turn on warn/fixme/err/trace on 'win' channel
set - win	turn off warn/fixme/err/trace on 'win' channel
set - fixme	turn off the 'fixme' class