WinDbg -- debugging mixed x64 managed/unmanaged code

1.4k views Asked by At

I'm using WinDbg (Native x64 -- NOT Itanium) to debug an x64 (unmanaged) application that loads both managed an unmanaged DLLs.

I'm trying to set a breakpoint in one of the unmanaged DLLs. When the breakpoint is hit and I step through, the instructions displayed are totally different from what they should be. I verified with two different disassemblers that WinDbg is not displaying the correct disassembly as I step through.

When attaching to the application, I get a line like this:

ModLoad: 00000000`XXXXXXXX 00000000`YYYYYYYY  C:\MyDLL.DLL

I adjusted the addresses in the two disassemblers to reflect the base address XXXXXXXX.

What could be the problem?

2

There are 2 answers

6
Ana Betts On

Does uf modname!FuncName return the correct results? You can sometimes trick WinDbg if you unassemble / breakpoint at weird places. Remember, that x86/x64 is a variable-width instruction set, so if you start reading halfway through an instruction, the disassembler gets confused.

0
PiotrW On

Somewhere i've noticed info that this may be related to improper entry point in your DLL. But I have no clue what to do with this information (i'm beginner).