1WINEDBG(1) Wine Developers Manual WINEDBG(1)
2
6 winedbg - Wine debugger
7
9 winedbg [ options ] [ program_name [ program_arguments ] | wpid ]
10 winedbg --gdb [ options ] [ program_name [ program_arguments ] | wpid ]
12 winedbg --auto wpid
14 winedbg --minidump [ file.mdmp ] wpid
16 winedbg file.mdmp
18
20 winedbg is a debugger for Wine. It allows:
21 + debugging native Win32 applications
22 + debugging Winelib applications
23 + being a drop-in replacement for Dr Watson
24
26 winedbg can be used in five modes. The first argument to the program
27 determines the mode winedbg will run in.
28 default
30 Without any explicit mode, this is standard winedbg operating
31 mode. winedbg will act as the front end for the user.
32 --gdb winedbg will be used as a proxy for gdb. gdb will be the front
34 end for command handling, and winedbg will proxy all debugging
35 requests from gdb to the Win32 APIs.
36 --auto This mode is used when winedbg is set up in AeDebug registry en‐
38 try as the default debugger. winedbg will then display basic in‐
39 formation about a crash. This is useful for users who don't want
40 to debug a crash, but rather gather relevant information about
41 the crash to be sent to developers.
42 --minidump
44 This mode is similar to the --auto one, except that instead of
45 printing the information on the screen (as --auto does), it's
46 saved into a minidump file. The name of the file is either
47 passed on the command line, or generated by WineDbg when none is
48 given. This file could later on be reloaded into winedbg for
49 further examination.
50 file.mdmp
52 In this mode winedbg reloads the state of a debuggee which has
53 been saved into a minidump file. See either the minidump command
54 below, or the --minidump mode.
55
58 When in default mode, the following options are available:
59 --command string
61 winedbg will execute the command string as if it was keyed on
62 winedbg command line, and then will exit. This can be handy for
63 getting the pid of running processes (winedbg --command "info
64 proc").
65 --file filename
67 winedbg will execute the list of commands contained in file
68 filename as if they were keyed on winedbg command line, and then
69 will exit.
70 When in gdb proxy mode, the following options are available:
72 --no-start
74 Don't launch gdb directly; instead, print the target remote GDB
75 command to execute and listen for connection from any GDB-com‐
76 patible debugger. Normally, --gdb will start both the proxy de‐
77 bugging server and an instance of gdb for the front end. This
78 option instructs winedbg to skip launching of gdb, and instead
79 prints the GDB command that can be used to manually connect to
80 the server. This command is in the form
81 target remote localhost:<port>
83 where <port> is the TCP port winedbg's proxy debugging server is
85 bound to.
86 This option allows the user to replace gdb with some other de‐
88 bugger front end, such as ddd, kgdb, gdbgui, or Qt Creator. Re‐
89 gardless of whether --no-start is specified, winedbg will quit
90 after the first connection is hung up (e.g. gdb detaches from
91 the debuggee).
92 --port port
94 Start the GDB proxy debugging server on the given port. If this
95 option is not specified, winedbg will let the operating system
96 choose any available port. This option can be used in conjunc‐
97 tion with --no-start to specify the port the server shall be
98 bound to.
99 --with-xterm
101 This will run the gdb front end in a new xterm(1) window instead
102 of using the current Unix terminal for its interface. This op‐
103 tion is ignored if --no-start is specified.
104 In all modes, the rest of the command line, when passed, is used to
106 identify which program, if any, is to be debugged:
107 program_name
109 This is the name of an executable to start for a debugging ses‐
110 sion. winedbg will actually create a process with this exe‐
111 cutable. If program_arguments are also given, they will be used
112 as arguments for creating the process to be debugged.
113 wpid winedbg will attach to the process whose Windows pid is wpid.
115 Use the info proc command within winedbg to list running pro‐
116 cesses and their Windows pids.
117 default
119 If nothing is specified, you will enter the debugger without any
120 run nor attached process. You'll have to do the job yourself.
121
124 Default mode, and while reloading a minidump file:
125 Most of commands used in winedbg are similar to the ones from gdb.
126 Please refer to the gdb documentations for some more details. See the
127 gdb differences section later on to get a list of variations from gdb
128 commands.
129 Misc. commands
131 abort Aborts the debugger.
133 quit Exits the debugger.
135 Process handling
137 attach N
139 Attach to a Wine process (N is its Windows ID, numeric or hexa‐
140 decimal). IDs can be obtained using the info process command.
141 Note the info process command returns hexadecimal values
142 detach Detach from a Wine-process.
144 thread N
146 Change the current thread to N (its Windows TID, numeric or
147 hexadecimal).
148 run Re-run the same process with the same arguments. Note: all
150 breakpoints of precedent process are no longer available.
151 run arg1 arg2...
153 Re-run the same process with arguments arg1 arg2.... Note: all
154 breakpoints of precedent process are no longer available.
155 Help commands
157 help Prints some help on the commands.
159 help info
161 Prints some help on info commands
162 Flow control commands
164 cont Continue execution until next breakpoint or exception.
166 pass Pass the exception event up to the filter chain.
168 step Continue execution until next C line of code (enters function
170 call)
171 next Continue execution until next C line of code (doesn't enter
173 function call)
174 stepi Execute next assembly instruction (enters function call)
176 nexti Execute next assembly instruction (doesn't enter function call)
178 finish Execute until return of current function is reached.
180 cont, step, next, stepi, nexti can be postfixed by a number (N), mean‐
182 ing that the command must be executed N times before control is re‐
183 turned to the user.
184 Breakpoints, watchpoints
186 enable N
188 Enables (break|watch)-point N
189 disable N
191 Disables (break|watch)-point N
192 delete N
194 Deletes (break|watch)-point N
195 cond N Removes any existing condition to (break|watch)-point N
197 cond N expr
199 Adds condition expr to (break|watch)-point N. expr will be eval‐
200 uated each time the (break|watch)-point is hit. If the result is
201 a zero value, the breakpoint isn't triggered.
202 break * N
204 Adds a breakpoint at address N
205 break id
207 Adds a breakpoint at the address of symbol id
208 break id N
210 Adds a breakpoint at the line N inside symbol id.
211 break N
213 Adds a breakpoint at line N of current source file.
214 break Adds a breakpoint at current $PC address.
216 watch * N
218 Adds a watch command (on write) at address N (on 4 bytes).
219 watch id
221 Adds a watch command (on write) at the address of symbol id.
222 Size depends on size of id.
223 rwatch * N
225 Adds a watch command (on read) at address N (on 4 bytes).
226 rwatch id
228 Adds a watch command (on read) at the address of symbol id. Size
229 depends on size of id.
230 info break
232 Lists all (break|watch)-points (with their state).
233 You can use the symbol EntryPoint to stand for the entry point of the
235 Dll.
236 When setting a (break|watch)-point by id, if the symbol cannot be found
238 (for example, the symbol is contained in a not yet loaded module),
239 winedbg will recall the name of the symbol and will try to set the
240 breakpoint each time a new module is loaded (until it succeeds).
241 Stack manipulation
243 bt Print calling stack of current thread.
245 bt N Print calling stack of thread of ID N. Note: this doesn't change
247 the position of the current frame as manipulated by the up & dn
248 commands).
249 up Goes up one frame in current thread's stack
251 up N Goes up N frames in current thread's stack
253 dn Goes down one frame in current thread's stack
255 dn N Goes down N frames in current thread's stack
257 frame N
259 Sets N as the current frame for current thread's stack.
260 info locals
262 Prints information on local variables for current function
263 frame.
264 Directory & source file manipulation
266 show dir
268 Prints the list of dirs where source files are looked for.
269 dir pathname
271 Adds pathname to the list of dirs where to look for source files
272 dir Deletes the list of dirs where to look for source files
274 symbolfile pathname
276 Loads external symbol definition file pathname
277 symbolfile pathname N
279 Loads external symbol definition file pathname (applying an off‐
280 set of N to addresses)
281 list Lists 10 source lines forwards from current position.
283 list - Lists 10 source lines backwards from current position
285 list N Lists 10 source lines from line N in current file
287 list pathname:N
289 Lists 10 source lines from line N in file pathname
290 list id
292 Lists 10 source lines of function id
293 list * N
295 Lists 10 source lines from address N
296 You can specify the end target (to change the 10 lines value) using the
298 ',' separator. For example:
299 list 123, 234
301 lists source lines from line 123 up to line 234 in current file
302 list foo.c:1,56
304 lists source lines from line 1 up to 56 in file foo.c
305 Displaying
307 A display is an expression that's evaluated and printed after the exe‐
309 cution of any winedbg command.
310 display
312 info display
314 Lists the active displays
315 display expr
317 Adds a display for expression expr
318 display /fmt expr
320 Adds a display for expression expr. Printing evaluated expr is
321 done using the given format (see print command for more on for‐
322 mats)
323 del display N
325 undisplay N
327 Deletes display N
328 Disassembly
330 disas Disassemble from current position
332 disas expr
334 Disassemble from address expr
335 disas expr,expr
337 Disassembles code between addresses specified by the two expres‐
338 sions
339 Memory (reading, writing, typing)
341 x expr Examines memory at address expr
343 x /fmt expr
345 Examines memory at address expr using format fmt
346 print expr
348 Prints the value of expr (possibly using its type)
349 print /fmt expr
351 Prints the value of expr (possibly using its type)
352 set var = expr
354 Writes the value of expr in var variable
355 whatis expr
357 Prints the C type of expression expr
358 fmt is either letter or count letter, where letter can be:
360 s an ASCII string
362 u a UTF16 Unicode string
364 i instructions (disassemble)
366 x 32-bit unsigned hexadecimal integer
368 d 32-bit signed decimal integer
370 w 16-bit unsigned hexadecimal integer
372 c character (only printable 0x20-0x7f are actually printed)
374 b 8-bit unsigned hexadecimal integer
376 g Win32 GUID
378 Expressions
380 Expressions in Wine Debugger are mostly written in a C form. However,
382 there are a few discrepancies:
383 Identifiers can take a '!' in their names. This allows mainly to
385 specify a module where to look the ID from, e.g. USER32!CreateWin‐
386 dowExA.
387 In a cast operation, when specifying a structure or a union, you
389 must use the struct or union keyword (even if your program uses a
390 typedef).
391 When specifying an identifier, if several symbols with this name exist,
393 the debugger will prompt for the symbol you want to use. Pick up the
394 one you want from its number.
395 Misc.
397 minidump file.mdmp saves the debugging context of the debuggee into a
399 minidump file called file.mdmp.
400 Information on Wine internals
402 info class
404 Lists all Windows classes registered in Wine
405 info class id
407 Prints information on Windows class id
408 info share
410 Lists all the dynamic libraries loaded in the debugged program
411 (including .so files, NE and PE DLLs)
412 info share N
414 Prints information on module at address N
415 info regs
417 Prints the value of the CPU registers
418 info all-regs
420 Prints the value of the CPU and Floating Point registers
421 info segment
423 Lists all allocated segments (i386 only)
424 info segment N
426 Prints information on segment N (i386 only)
427 info stack
429 Prints the values on top of the stack
430 info map
432 Lists all virtual mappings used by the debugged program
433 info map N
435 Lists all virtual mappings used by the program of Windows pid N
436 info wnd
438 Displays the window hierarchy starting from the desktop window
439 info wnd N
441 Prints information of Window of handle N
442 info process
444 Lists all w-processes in Wine session
445 info thread
447 Lists all w-threads in Wine session
448 info frame
450 Lists the exception frames (starting from current stack frame).
451 You can also pass, as optional argument, a thread id (instead of
452 current thread) to examine its exception frames.
453 Debug messages can be turned on and off as you are debugging using the
455 set command, but only for channels initialized with the WINEDEBUG envi‐
456 ronment variable.
457 set warn + win
459 Turns on warn on win channel
460 set + win
462 Turns on warn/fixme/err/trace on win channel
463 set - win
465 Turns off warn/fixme/err/trace on win channel
466 set fixme - all
468 Turns off fixme class on all channels
469 Gdb mode:
471 See the gdb documentation for all the gdb commands.
472 However, a few Wine extensions are available, through the monitor com‐
474 mand:
475 monitor wnd
477 Lists all windows in the Wine session
478 monitor proc
480 Lists all processes in the Wine session
481 monitor mem
483 Displays memory mapping of debugged process
484 Auto and minidump modes:
486 Since no user input is possible, no commands are available.
487
490 WINE_GDB
491 When used in gdb proxy mode, WINE_GDB specifies the name (and
492 the path) of the executable to be used for gdb. "gdb" is used by
493 default.
494
496 The first version was written by Eric Youngdale.
497 See Wine developers list for the rest of contributors.
499
501 Bugs can be reported on the Wine bug tracker ⟨https://bugs.winehq.org⟩.
502
504 winedbg is part of the Wine distribution, which is available through
505 WineHQ, the Wine development headquarters ⟨https://www.winehq.org/⟩.
506
508 wine(1),
509 Wine documentation and support ⟨https://www.winehq.org/help⟩.
510Wine 8.19 October 2005 WINEDBG(1)