Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Start WinDbg right after program crashes

Tags:

windbg

If you look at this Youtube video, you can see that WinDbg is automatically executed when the process dies.

I've followed the tutorial and tried to do the same on my system. I first ran windbg -I, and then changed the HKLM\Software\Microsoft\Windows NT\CurrentVersion\AeDebug\Auto registry key to 0. Is there any other step that I'm missing?

like image 891
Abundance Avatar asked Dec 20 '25 14:12

Abundance


1 Answers

Running the 64-bit version of WinDbg with -I command line option creates both 64 bit and 32 bit AeDebug entries. This can easily be proven with Process Monitor:

WinDbg x64 AeDebug creation

The 32-bit version of WinDbg creates 32 bit entries only. So, if you ran the 32 bit version, 64 bit programs are not handled. That's what I expect has happened. Another option would be that you ran it without administrative privileges and didn't read the failure message carefully.

In case you want both 32-bit and 64-bit crashes to be handled by WinDbg, run WinDbg -I for both versions. You'll find that WinDbg is smart enough to handle any order:

  • WinDbg32 will overwrite an existing entry created by WinDbg64 before
  • WinDbg64 will not overwrite an existing entry created by WinDbg32 before

Although WinDbg64 can debug 32 bit applications, it cannot load 32 bit extension DLLs, therefore you typically want both debuggers registered, not only the 64 bit version.

like image 133
Thomas Weller Avatar answered Dec 22 '25 14:12

Thomas Weller



Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!