WINEDBG(1)

📦
version 10.0 · 4 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

WINEDBG(1) 💅 Wine Developers Manual

okay bestie, buckle UP because this is the page for winedbg, and she's kind of a big deal 💖

✨ NAME ✨

winedbg — the Wine debugger, no cap 🐛🔍

🌸 SYNOPSIS 🌸

winedbg [ options ] [ program_name [ program_arguments ] | wpid ]

winedbg --gdb [ options ] [ program_name [ program_arguments ] | wpid ]

winedbg --auto wpid

winedbg --minidump [ file.mdmp ] wpid

winedbg file.mdmp

🦋 DESCRIPTION 🦋

so winedbg is literally the debugger for Wine. she's here to help you with:

  • debugging native Win32 applications 🖥️
  • debugging Winelib applications 🍷
  • being a drop-in replacement for Dr Watson 👑

👑 MODES 👑

winedbg can run in five modes, and the way she picks is: the first argument to the program decides which mode she's in. periodt.

  • default — with no explicit mode at all, this is just standard winedbg operating mode. winedbg acts as the front end for you, the user. main character energy tbh.
  • --gdb — here winedbg becomes a proxy for gdb. gdb is the front end handling commands, and winedbg proxies all the debugging requests from gdb over to the Win32 APIs. it's giving middle management 💼
  • --auto — this mode kicks in when winedbg is set up in the AeDebug registry entry as the default debugger. winedbg will then show basic info about a crash. super useful for users who don't actually want to debug a crash, they just want to gather the relevant deets about it to send off to developers 📨
  • --minidump — basically the --auto mode's sibling, except instead of printing the info on screen (like --auto does), it saves it into a minidump file. the filename is either passed on the command line, or generated by WineDbg when you don't give one. later on you can reload that file back into winedbg for further examination 🔍
  • file.mdmp — in this mode winedbg reloads the state of a debuggee that got saved into a minidump file. see either the minidump command below, or the --minidump mode above 💾

💖 OPTIONS 💖

🌟 when you're in default mode 🌟

these are your options:

  • --command string — winedbg runs the string exactly like you'd typed it on the winedbg command line, then exits. handy for grabbing the pid of running processes, like winedbg --command "info proc" 🕵️
  • --exec filename — sets the executable name, without starting the executable. so it's just vibes and a name, no launch 🚫🚀
  • --file filename — winedbg runs the list of commands contained in file filename exactly like you'd typed them on the winedbg command line, then exits 📜

🎀 when you're in gdb proxy mode 🎀

these are your options:

  • --no-start — don't launch gdb directly. instead, print the target remote GDB command to execute and listen for a connection from any GDB-compatible debugger. normally --gdb starts both the proxy debugging server and an instance of gdb for the front end. this option tells winedbg to skip launching gdb, and instead prints the GDB command you can use to manually connect to the server. that command looks like:
target remote localhost:<port>

where <port> is the TCP port winedbg's proxy debugging server is bound to.

this lets you swap gdb out for some other debugger front end — like ddd, kgdb, gdbgui, or Qt Creator. and heads up: whether or not you pass --no-start, winedbg will quit after the first connection hangs up (e.g. when gdb detaches from the debuggee) 👋

  • --port port — start the GDB proxy debugging server on the given port. if you don't specify this option, winedbg lets the operating system choose any available port. you can pair this with --no-start to say exactly which port the server shall be bound to 🔌
  • --with-xterm — this runs the gdb front end in a new xterm(1) window instead of using the current Unix terminal for its interface 🪟✨. this option is ignored if --no-start is specified 🙈

🌈 in all modes 🌈

the rest of the command line, when it's passed, is used to figure out which program (if any) is gonna be debugged:

  • program_name — the name of an executable to start for a debugging session. winedbg will actually create a process with this executable. if program_arguments are also given, they get used as arguments for creating the process to be debugged 🏃♀️
  • wpid — winedbg attaches to the process whose Windows pid is wpid. use the info proc command inside winedbg to list running processes and their Windows pids 📋
  • default — if you specify nothing at all, you enter the debugger with no run and no attached process. you'll have to do the job yourself, bestie 🫡
lowkey important: that's just part 1 of 3! more incoming, don't go anywhere 💜

💅 COMMANDS 💅

🌸 Default mode, and while reloading a minidump file:

okay bestie, so most of the commands in winedbg are literally the same vibe as gdb's. if you want the deep lore, go read the gdb docs. but check the gdb differences section further down so you know where this debugger does its own little thing 💖

✨ Misc. commands

  • abort — aborts the debugger. just. yeets it. 💀
  • quit — exits the debugger.

✨ Process handling

  • attach N — attach to a Wine process, where N is its Windows ID, numeric or hexadecimal. you can get these IDs with the info process command. heads up though: info process hands back hexadecimal values 👀
  • attach file.mdmp — reload the state of a debuggee from the minidump file.mdmp. (peep the minidump command if you wanna save one of these bad boys.)
  • detach — detach the current Wine process. it's no longer being debugged by WineDbg, but it's still running (for a live target).
  • kill — kills the current Wine process. it's no longer debugged by WineDbg and it's terminated (for a live target).
  • minidump file.mdmp — saves the debugging context of the debuggee into a minidump file called file.mdmp.
  • run — re-run the same process with the same arguments. note: all breakpoints of precedent process are no longer available. rip 😭
  • run arg1 arg2... — re-run the same process with arguments arg1 arg2.... note: all breakpoints of precedent process are no longer available.
  • thread N — change the current thread to N (its Windows TID, numeric or hexadecimal).

✨ Help commands

  • help — prints some help on the commands.
  • help info — prints some help on info commands.

✨ Flow control commands

  • cont — continue execution until next breakpoint or exception.
  • pass — pass the exception event up to the filter chain.
  • step — continue execution until next C line of code (enters function call).
  • next — continue execution until next C line of code (doesn't enter function call).
  • stepi — execute next assembly instruction (enters function call).
  • nexti — execute next assembly instruction (doesn't enter function call).
  • finish — execute until return of current function is reached.

cont, step, next, stepi, nexti can be postfixed by a number (N), meaning that the command must be executed N times before control is returned to the user. so like, step 5 = five steps, bestie, no taps needed 🫶

✨ Breakpoints, watchpoints

  • enable N — enables (break|watch)-point N.
  • disable N — disables (break|watch)-point N.
  • delete N — deletes (break|watch)-point N.
  • cond N — removes any existing condition to (break|watch)-point N.
  • cond N expr — adds condition expr to (break|watch)-point N. expr will be evaluated each time the (break|watch)-point is hit. if the result is a zero value, the breakpoint isn't triggered.
  • break * N — adds a breakpoint at address N.
  • break id — adds a breakpoint at the address of symbol id.
  • break id N — adds a breakpoint at the line N inside symbol id.
  • break N — adds a breakpoint at line N of current source file.
  • break — adds a breakpoint at current $PC address.
  • watch * N — adds a watch command (on write) at address N (on 4 bytes).
  • watch id — adds a watch command (on write) at the address of symbol id. size depends on size of id.
  • rwatch * N — adds a watch command (on read) at address N (on 4 bytes).
  • rwatch id — adds a watch command (on read) at the address of symbol id. size depends on size of id.
  • info break — lists all (break|watch)-points (with their state).

you can use the symbol EntryPoint to stand for the entry point of the Dll. iconique.

when setting a (break|watch)-point by id, if the symbol can't be found (for example, the symbol is contained in a not yet loaded module), winedbg will recall the name of the symbol and will try to set the breakpoint each time a new module is loaded — until it succeeds. it's giving main character energy, honestly, it does NOT give up 💅

✨ Stack manipulation

  • bt — print calling stack of current thread.
  • bt N — print calling stack of thread of ID N. note: this doesn't change the position of the current frame as manipulated by the up & dn commands.
  • up — goes up one frame in current thread's stack.
  • up N — goes up N frames in current thread's stack.
  • dn — goes down one frame in current thread's stack.
  • dn N — goes down N frames in current thread's stack.
  • frame N — sets N as the current frame for current thread's stack.
  • info locals — prints information on local variables for current function frame.

✨ Directory & source file manipulation

  • show dir — prints the list of dirs where source files are looked for.
  • dir pathname — adds pathname to the list of dirs where to look for source files.
  • dir — deletes the list of dirs where to look for source files.
  • symbolfile pathname — loads external symbol definition file pathname.
  • symbolfile pathname N — loads external symbol definition file pathname (applying an offset of N to addresses).
  • list — lists 10 source lines forwards from current position.
  • list - — lists 10 source lines backwards from current position.
  • list N — lists 10 source lines from line N in current file.
  • list pathname:N — lists 10 source lines from line N in file pathname.
  • list id — lists 10 source lines of function id.
  • list * N — lists 10 source lines from address N.

you can specify the end target (to change that 10 lines value) using the , separator. for example:

list 123, 234

lists source lines from line 123 up to line 234 in current file.

list foo.c:1,56

lists source lines from line 1 up to 56 in file foo.c. ate. 🔥

✨ Displaying

a display is an expression that's evaluated and printed after the execution of any winedbg command. it's like a little post-command gossip update, she keeps you posted 💖

  • display
  • info display — lists the active displays.
  • display expr — adds a display for expression expr.
  • display /fmt expr — adds a display for expression expr. printing evaluated expr is done using the given format (see the print command for more on formats).
  • del display N
  • undisplay N — deletes display N.

✨ Disassembly

  • disas — disassemble from current position.
  • disas expr — disassemble from address expr.
  • disas expr,expr — disassembles code between addresses specified by the two expressions.

✨ Memory (reading, writing, typing)

  • x expr — examines memory at address expr.
  • x /fmt expr — examines memory at address expr using format fmt.
  • print expr — prints the value of expr (possibly using its type).
  • print /fmt expr — prints the value of expr (possibly using its type).
  • set var = expr — writes the value of expr in var variable.
  • whatis expr — prints the C type of expression expr.

fmt is either letter or count letter, where letter can be:

  • s — an ASCII string.
  • u — a UTF16 Unicode string.
  • i — instructions (disassemble).
  • x — 32-bit unsigned hexadecimal integer.
  • d — 32-bit signed decimal integer.
  • w — 16-bit unsigned hexadecimal integer.
  • c — character (only printable 0x20-0x7f are actually printed).
  • b — 8-bit unsigned hexadecimal integer.
  • g — Win32 GUID.

✨ Expressions

expressions in Wine Debugger are mostly written in a C form. however, there are a few discrepancies:

  • identifiers can take a ! in their names. this mainly allows you to specify a module where to look the ID from, e.g. USER32!CreateWindowExA.
  • in a cast operation, when specifying a structure or a union, you must use the struct or union keyword (even if your program uses a typedef).

when specifying an identifier, if several symbols with this name exist, the debugger will prompt for the symbol you want to use. pick up the one you want from its number. choose your fighter bestie 🎀

✨ Information on Wine internals

  • info class — lists all Windows classes registered in Wine.
  • info class id — prints information on Windows class id.
  • info share — lists all the dynamic libraries loaded in the debugged program (including .so files, NE and PE DLLs).
  • info share N — prints information on module at address N.
  • info regs — prints the value of the CPU registers.
  • info all-regs — prints the value of the CPU and Floating Point registers.
  • info segment — lists all allocated segments (i386 only).
  • info segment N — prints information on segment N (i386 only).
  • info stack — prints the values on top of the stack.
  • info map — lists all virtual mappings used by the debugged program.
  • info map N — lists all virtual mappings used by the program of Windows pid N.
  • info wnd — displays the window hierarchy starting from the desktop window.
  • info wnd N — prints information of Window of handle N.
  • info process — lists all w-processes in Wine session.
  • info thread — lists all w-threads in Wine session.
  • info frame — lists the exception frames (starting from current stack frame). you can also pass, as optional argument, a thread id (instead of current thread) to examine its exception frames.

debug messages can be turned on and off as you are debugging using the set command — but only for channels initialized with the WINEDEBUG environment variable. iykyk.

  • set warn + win — turns on warn on win channel.
  • set + win — turns on warn/fixme/err/trace on win channel.
  • set - win — turns off warn/fixme/err/trace on win channel.
  • set fixme - all — turns off fixme class on all channels.

🌈 Gdb mode:

for all the gdb commands, go see the gdb documentation. periodt.

however, a few Wine extensions are available, through the monitor command:

  • monitor wnd — lists all windows in the Wine session.
  • monitor proc — lists all processes in the Wine session.
  • monitor mem — displays memory mapping of debugged process.

🌸 Auto and minidump modes:

since no user input is possible, no commands are available. yeah. that's it. no notes. 💀

🦋 ENVIRONMENT 🦋

  • WINE_GDB — when used in gdb proxy mode, WINE_GDB specifies the name (and the path) of the executable to be used for gdb. "gdb" is used by default.

👑 AUTHORS 👑

the first version was written by Eric Youngdale.

see Wine developers list for the rest of contributors. love that for them 💖

💀 BUGS 💀

bugs can be reported on the Wine bug tracker.

⭐ AVAILABILITY ⭐

winedbg is part of the Wine distribution, which is available through WineHQ, the Wine development headquarters.

🌈 SEE ALSO 🌈

okay bestie, you're at the end and that's lowkey iconic of you 💅 but before you go, here's where to wander next:

  • wine(1) — the whole main character. run your Windows apps with it, it's giving core functionality 🍷
  • Wine documentation and support — the docs and the support vibes, for when you need more than a manpage can give you 🫶

and that's a wrap fr fr ✨ you made it all the way through a whole WINEDBG(1) page, which is honestly main character energy 👑

this lil' page came from Wine 10.0, dated October 2005 🌸 so yeah, it's been around a minute, but it still ate. now go forth and debug responsibly, bestie 💖🦋🎀

📦 where this page comes from