WINEDBG(1)

🎀 NAME 🎀

winedbg(1) from the Wine Developers Manual: winedbg is the Wine debugger, bestie. 💖

✨ SYNOPSIS ✨

winedbg [ options ] [ program_name [ program_arguments ] | wpid ]

winedbg --gdb [ options ] [ program_name [ program_arguments ] | wpid ]

winedbg --auto wpid

winedbg --minidump [ file.mdmp ] wpid

winedbg file.mdmp

💜 DESCRIPTION 💜

Okay so winedbg is a debugger for Wine. It allows:

• debugging native Win32 applications
• debugging Winelib applications
• being a drop-in replacement for Dr Watson

🌈 MODES 🌈

winedbg can be used in five modes. The first argument to the program determines the mode winedbg will run in. Five whole modes, bestie — the first argument is the vibe check. 💅

• default — No explicit mode? This is standard winedbg operating mode. winedbg will act as the front end for the user.
• --gdb — winedbg will be used as a proxy for gdb. gdb will be the front end for command handling, and winedbg will proxy all debugging requests from gdb to the Win32 APIs.
• --auto — This mode is used when winedbg is set up in AeDebug registry entry as the default debugger. winedbg will then display basic information about a crash. This is useful for users who don't want to debug a crash, but rather gather relevant information about the crash to be sent to developers.
• --minidump — This mode is similar to the --auto one, except that instead of printing the information on the screen (as --auto does), it's saved into a minidump file. The name of the file is either passed on the command line, or generated by WineDbg when none is given. This file could later on be reloaded into winedbg for further examination.
• file.mdmp — In this mode winedbg reloads the state of a debuggee which has been saved into a minidump file. See either the minidump command below, or the --minidump mode.

💅 OPTIONS 💅

When in default mode, the following options are available:

• --command string — winedbg will execute the command string as if it was keyed on winedbg command line, and then will exit. This can be handy for getting the pid of running processes (winedbg --command "info proc").
• --exec filename — Sets the executable name, without starting the executable.
• --file filename — winedbg will execute the list of commands contained in file filename as if they were keyed on winedbg command line, and then will exit.

When in gdb proxy mode, the following options are available:

• --no-start — Don't launch gdb directly; instead, print the target remote GDB command to execute and listen for connection from any GDB-compatible debugger. Normally, --gdb will start both the proxy debugging server and an instance of gdb for the front end. This option instructs winedbg to skip launching of gdb, and instead prints the GDB command that can be used to manually connect to the server. This command is in the form target remote localhost:<port> where <port> is the TCP port winedbg's proxy debugging server is bound to.

This option allows the user to replace gdb with some other debugger front end, such as ddd, kgdb, gdbgui, or Qt Creator. Regardless of whether --no-start is specified, winedbg will quit after the first connection is hung up (e.g. gdb detaches from the debuggee).

• --port port — Start the GDB proxy debugging server on the given port. If this option is not specified, winedbg will let the operating system choose any available port. This option can be used in conjunction with --no-start to specify the port the server shall be bound to.
• --with-xterm — This will run the gdb front end in a new xterm(1) window instead of using the current Unix terminal for its interface. This option is ignored if --no-start is specified.

In all modes, the rest of the command line, when passed, is used to identify which program, if any, is to be debugged:

• program_name — This is the name of an executable to start for a debugging session. winedbg will actually create a process with this executable. If program_arguments are also given, they will be used as arguments for creating the process to be debugged.
• wpid — winedbg will attach to the process whose Windows pid is wpid. Use the info proc command within winedbg to list running processes and their Windows pids.
• default — If nothing is specified, you will enter the debugger without any run nor attached process. You'll have to do the job yourself. 🫶

💬 COMMANDS

🌸 Default mode, and while reloading a minidump file

okay so first thing's first: most of the commands you already know from winedbg are literally the same vibes as the ones from gdb, so if you need the deep lore, please refer to the gdb documentations 💖. also pls check out the gdb differences section later on to get the full list of where winedbg switches it up from gdb commands — iykyk.

✨ Misc. commands

• abort — just straight up aborts the debugger. 💀 no cap.
• quit — exits the debugger. bye bestie 🫶

🧚 Process handling

• attach N — attaches to a Wine process, where N is its Windows ID, and yes it can be numeric or hexadecimal. you can grab those IDs with the info process command. 💅 note: the info process command returns hexadecimal values!
• attach file.mdmp — reloads the state of a debuggee from the minidump file.mdmp. peek the minidump command if you wanna save one of these bad boys.
• detach — detaches the current Wine process. the process is no longer debugged by WineDbg, but it's still running (this is for a live target, obvi).
• kill — kills the current Wine process. the process is no longer debugged by WineDbg, and it's also terminated (again, for a live target). 🔥
• minidump file.mdmp — saves the debugging context of the debuggee into a minidump file called file.mdmp ✨
• run — re-runs the same process with the same arguments. ⚠️ note: all breakpoints of the precedent process are no longer available. rip to those breakpoints 🪦
• run arg1 arg2... — re-runs the same process with the arguments arg1 arg2.... same warning bestie: all breakpoints of the precedent process are no longer available.
• thread N — changes the current thread to N, which is its Windows TID, numeric or hexadecimal. 🧵

🎀 Help commands

• help — prints some help on the commands.
• help info — prints some help on info commands. so meta 🦋

⭐ Flow control commands

• cont — continues execution until the next breakpoint or exception.
• pass — passes the exception event up to the filter chain.
• step — continues execution until the next C line of code (enters function call).
• next — continues execution until the next C line of code (doesn't enter function call).
• stepi — executes the next assembly instruction (enters function call).
• nexti — executes the next assembly instruction (doesn't enter function call).
• finish — executes until the return of the current function is reached.

bestie listen 👀 cont, step, next, stepi, nexti can be postfixed by a number (N), meaning the command must be executed N times before control is returned to you. literally so handy.

👑 Breakpoints, watchpoints

• enable N — enables (break|watch)-point N.
• disable N — disables (break|watch)-point N.
• delete N — deletes (break|watch)-point N.
• cond N — removes any existing condition to (break|watch)-point N.
• cond N expr — adds the condition expr to (break|watch)-point N. expr will be evaluated each time the (break|watch)-point is hit. if the result is a zero value, the breakpoint isn't triggered. ✨
• break * N — adds a breakpoint at address N.
• break id — adds a breakpoint at the address of symbol id.
• break id N — adds a breakpoint at line N inside symbol id.
• break N — adds a breakpoint at line N of the current source file.
• break — adds a breakpoint at the current $PC address. yes, with no args at all 💅
• watch * N — adds a watch command (on write) at address N (on 4 bytes).
• watch id — adds a watch command (on write) at the address of symbol id. size depends on the size of id.
• rwatch * N — adds a watch command (on read) at address N (on 4 bytes).
• rwatch id — adds a watch command (on read) at the address of symbol id. size depends on the size of id.
• info break — lists all (break|watch)-points (with their state).

you can use the symbol EntryPoint to stand for the entry point of the Dll 🫶

and here's a lil detail that's lowkey iconic: when you set a (break|watch)-point by id and the symbol can't be found (for example, the symbol is contained in a not yet loaded module), winedbg will recall the name of the symbol and will try to set the breakpoint each time a new module is loaded (until it succeeds). it literally remembers for you. main character energy fr.

🦋 Stack manipulation

• bt — prints the calling stack of the current thread.
• bt N — prints the calling stack of the thread of ID N. note: this doesn't change the position of the current frame as manipulated by the up & dn commands. 🙈
• up — goes up one frame in the current thread's stack.
• up N — goes up N frames in the current thread's stack.
• dn — goes down one frame in the current thread's stack.
• dn N — goes down N frames in the current thread's stack.
• frame N — sets N as the current frame for the current thread's stack.
• info locals — prints information on local variables for the current function frame.

🌈 Directory & source file manipulation

• show dir — prints the list of dirs where source files are looked for.
• dir pathname — adds pathname to the list of dirs where to look for source files.
• dir — deletes the list of dirs where to look for source files. empty. gone. ✨
• symbolfile pathname — loads external symbol definition file pathname.
• symbolfile pathname N — loads external symbol definition file pathname (applying an offset of N to addresses).
• list — lists 10 source lines forwards from the current position.
• list - — lists 10 source lines backwards from the current position.
• list N — lists 10 source lines from line N in the current file.
• list pathname:N — lists 10 source lines from line N in file pathname.
• list id — lists 10 source lines of function id.
• list * N — lists 10 source lines from address N.

and here's the cute part: you can specify the end target (to change that 10 lines value) using the , separator. for example:

• list 123, 234 — lists source lines from line 123 up to line 234 in the current file 🌸
• list foo.c:1,56 — lists source lines from line 1 up to 56 in file foo.c

🍓 Displaying

quick definition bestie: a display is an expression that's evaluated and printed after the execution of any winedbg command. so it just... keeps showing up. obsessed.

• display
• info display — lists the active displays.
• display expr — adds a display for the expression expr.
• display /fmt expr — adds a display for the expression expr. printing the evaluated expr is done using the given format (see the print command for more on formats).
• del display N
• undisplay N — deletes display N. (both spellings, slay 💅)

💜 Disassembly

• disas — disassemble from the current position.
• disas expr — disassemble from the address expr.
• disas expr,expr — disassembles code between the addresses specified by the two expressions.

🧚 Memory (reading, writing, typing)

• x expr — examines memory at address expr.
• x /fmt expr — examines memory at address expr using format fmt.
• print expr — prints the value of expr (possibly using its type).
• print /fmt expr — prints the value of expr (possibly using its type).
• set var = expr — writes the value of expr in the var variable.
• whatis expr — prints the C type of the expression expr.

okay so fmt is either a letter or a count letter, where letter can be:

• s — an ASCII string
• u — a UTF16 Unicode string
• i — instructions (disassemble)
• x — 32-bit unsigned hexadecimal integer
• d — 32-bit signed decimal integer
• w — 16-bit unsigned hexadecimal integer
• c — character (only printable 0x20-0x7f are actually printed)
• b — 8-bit unsigned hexadecimal integer
• g — Win32 GUID

🔥 Expressions

expressions in Wine Debugger are mostly written in a C form. cute, right? however, there are a few discrepancies you gotta know about:

• Identifiers can take a ! in their names. this mainly lets you specify a module where to look the ID from, e.g. USER32!CreateWindowExA. 💅
• In a cast operation, when specifying a structure or a union, you must use the struct or union keyword (even if your program uses a typedef). no skipping, bestie.

also: when specifying an identifier, if several symbols with this name exist, the debugger will prompt for the symbol you want to use. just pick up the one you want from its number 🫶

🌟 Information on Wine internals

• info class — lists all Windows classes registered in Wine.
• info class id — prints information on Windows class id.
• info share — lists all the dynamic libraries loaded in the debugged program (including .so files, NE and PE DLLs).
• info share N — prints information on the module at address N.
• info regs — prints the value of the CPU registers.
• info all-regs — prints the value of the CPU and Floating Point registers.
• info segment — lists all allocated segments (i386 only).
• info segment N — prints information on segment N (i386 only).
• info stack — prints the values on top of the stack.
• info map — lists all virtual mappings used by the debugged program.
• info map N — lists all virtual mappings used by the program of Windows pid N.
• info wnd — displays the window hierarchy starting from the desktop window.
• info wnd N — prints information of the Window of handle N.
• info process — lists all w-processes in the Wine session.
• info thread — lists all w-threads in the Wine session.
• info frame — lists the exception frames (starting from the current stack frame). you can also pass, as an optional argument, a thread id (instead of the current thread) to examine its exception frames. 🧵

debug messages can be turned on and off as you're debugging using the set command — but only for channels initialized with the WINEDEBUG environment variable. that part matters, don't forget it ✨

• set warn + win — turns on warn on the win channel.
• set + win — turns on warn/fixme/err/trace on the win channel.
• set - win — turns off warn/fixme/err/trace on the win channel.
• set fixme - all — turns off the fixme class on all channels.

---

🎀 Gdb mode

see the gdb documentation for all the gdb commands, bestie — that's the whole reference.

however! a few Wine extensions are available, through the monitor command 👑

• monitor wnd — lists all windows in the Wine session.
• monitor proc — lists all processes in the Wine session.
• monitor mem — displays memory mapping of the debugged process.

🦋 Auto and minidump modes

since no user input is possible, no commands are available. that's it. that's the whole section 💀

🌸 ENVIRONMENT

• WINE_GDB — when used in gdb proxy mode, WINE_GDB specifies the name (and the path) of the executable to be used for gdb. "gdb" is used by default. 🫶

🎀 AUTHORS

the first version was written by Eric Youngdale. 👑

see the Wine developers list for the rest of the contributors 💖

⭐ BUGS

bugs can be reported on the Wine bug tracker. go off, report them 🐛

👑 AVAILABILITY

winedbg is part of the Wine distribution, which is available through WineHQ, the Wine development headquarters. 🌈

✨ SEE ALSO ✨

okay so when you're done vibing with winedbg and you wanna go read more, here's the reading list bestie 🫶

• wine(1) — literally the whole reason we're here, go say hi to the main character 👑
• Wine documentation and support — the docs and the support situation, your safe space when things get messy 😭

---

and that's a wrap on WINEDBG(1), bestie!! 🎀 you made it all the way to the bottom, I'm so proud of you fr fr 💖 go forth and debug slayfully ✨

this icon was brought to you by Wine 11.21, dated October 2005 — vintage, iconic, still serving 💅🌸