SinaKarvandi / windbg2ida

Windbg2ida lets you dump each step in Windbg then shows these steps in IDA
https://windbg2ida.ntdebug.com
GNU General Public License v3.0
70 stars 29 forks source link

Unable to get property 'split' #3

Open Waterman178 opened 4 years ago

Waterman178 commented 4 years ago

Unable to get property 'split' of undefined or null reference [at windbg2ida (line 144 col 9)]

0033:000000007730e92a 4883e920 sub rcx,20h rax = 0000000000000000 rcx = 00000000737e46e0 [gotonewline][ds:002b:00000000737e46f8=0000000000000000] 0033:000000007730e92e 48894118 mov qword ptr [rcx+18h],rax ds:002b:00000000737e46f8=0000000000000000 rcx = 00000000737e46e0 r10 = 0000000000000000 [gotonewline][ds:002b:00000000737e46f0=0000000000000000] 0033:000000007730e932 4c895110 mov qword ptr [rcx+10h],r10 ds:002b:00000000737e46f0=0000000000000000 rax = 0000000000000000 rcx = 00000000737e46e0 rdx = ffffffff941aa330 [gotonewline][ds:002b:000000000798ea18=0000000000000000] 0033:000000007730e936 488b440a08 mov rax,qword ptr [rdx+rcx+8] ds:002b:000000000798ea18=0000000000000000 rcx = 00000000737e46e0 rdx = ffffffff941aa330 r10 = 0000000000000000 [gotonewline][ds:002b:000000000798ea10=0000000000000000] 0033:000000007730e93b 4c8b140a mov r10,qword ptr [rdx+rcx] ds:002b:000000000798ea10=0000000000000000 r9 = 0000000000000003
0033:000000007730e93f 49ffc9 dec r9 rax = 0000000000000000 rcx = 00000000737e46e0 [gotonewline][ds:002b:00000000737e46e8=0000000000000000] 0033:000000007730e942 48894108 mov qword ptr [rcx+8],rax ds:002b:00000000737e46e8=0000000000000000 Error: Unable to get property 'split' of undefined or null reference [at windbg2ida (line 144 col 9)] 1: kd> u 7730e942 ntdll!memmove+0x272: 000000007730e942 48894108 mov qword ptr [rcx+8],rax 000000007730e946 4c8911 mov qword ptr [rcx],r10 000000007730e949 75d5 jne ntdll!memmove+0x250 (000000007730e920) 000000007730e94b 4983e01f and r8,1Fh 000000007730e94f e973ffffff jmp ntdll!memmove+0x1f7 (000000007730e8c7) 000000007730e954 666666660f1f840000000000 nop word ptr [rax+rax] 000000007730e960 6690 xchg ax,ax 000000007730e962 4881fa00f0ffff cmp rdx,0FFFFFFFFFFFFF000h ` image

SinaKarvandi commented 3 years ago

are you sure you are using the latest version of Windbg?

Waterman178 commented 3 years ago

are you sure you are using the latest version of Windbg?

yes image

image image