Windbg introduction (4) - Extension DLL

Usually debugger has 3 kinds of commands:

Normal Commands
…Directly executed by debugger
…Typical debugger operations
……Examples : dd 70003478, x ntdll!Nt*Port*, uf ntdll!ZwClose
!commands ( Debugger Extension DLL Commands)
…Executed by extension DLL
…Syntax is !ExtensionDLL.Command
……Omitting ExtensionDLLcauses debugger to use default debugger extension DLL
…Most debugger extensions have a “.help” command that lists the supported commands and their usage syntax
……link –dump –exports extension.dllalso shows list of commands
…WinDBG documentation also contains description of these commands
…Proprietary extension DLLs can be created using WinDBG SDK
……SDK is not installed by “Typical” debugger installation option
…Examples : !runaway, !rpcext.sizes, !uexts.help
.commands (Meta commands)
…Controls the debugger behavior (debugger settings)
…WinDBG and KD have same .command sets
…Example : .echotimestamps, .logappend logfile.txt


Generally, Debugger Extensions are Win32 DLLs that run in the WinDBG / KD environment, which call functions exported by the debugger engine. Interfaces (APIs) available for writing extension DLLs are: Managed Debugger Extension API (MDbgEng.dll); C++ Class framework library (EngExtCpp); COM based debugger engine interface; “C” function call based legacy debugger engine interface. Debugger interfaces use 64 bit addresses, and the same extension DLL works for both 32 bit and 64 bit targets.

Following are the functionalities exported by the debugger engine:
…Read and Write Memory
…Manipulate Breakpoints
…Control Execution
…Evaluate Expressions
…Query Symbol Table
…Query Type Information
…Enable Source Level Debugging.

Debugger Extension DLLs don’t need to be installed or registered, which can be copied in any directory in the debugger’s extension DLL search path. WinDBG/KD automatically picks the right version of the extension DLL corresponding to the target OS (nt4chk, nt4fre, w2kchk, w2kfre, winxp & winext directories). Pre-WinXP extension DLLs are OS version and type (checked or free) specific since the structure type information are hardcoded; Newer version of extension DLLS query structure type information from symbol table (.PDB file) at run time. DLLs in winxp directory support WinXP all subsequent versions of the OS.

Notice that debugger can load at the most 32 different extension DLLs. You can use following extension dll related commands:
…“!ExtensionDLL.help” can print out a list of commands supported by extension DLL
…“.chain” can print information on all currently loaded extension DLLs
…”.extpath” can set the extension DLL search path
…”.load” or “.loadby” can load a new extension DLL into the debugger
…”.unload” can unload an extension DLL from the debugger
…”.unloadall” can unload all extension DLLs from the debugger
…”.setdll” can change the default extension DLL for the debugger

Debugger has following user mode extension DLLs:
…exts.dll
……User and Kernel Mode Extension DLL
……Contains commands that can be used on both user mode and kernel mode targets
…uext.dll
……User Mode Debugger Extension
……Contains OS independent debugger extension commands
…logexts.dll
……Windows API Logging Extension
……Provides commands for runtime Win32 API Logging and Monitoring
…ntsdexts.dll
……User Mode Extension DLL
……Contains the OS dependent user mode debugger extension commands
…rpcexts.dll
……Remote Procedure Call Extension DLL
……Contains over 50 different RPC commands

Next session will introduce how to write a Debugger extension dll.