Search code examples
windowsdebuggingassemblyreverse-engineeringwindbg

WinDbg - Disable source mode


I'm trying to stop WinDbg from displaying source code at all. I tried to disable by unchecking the Debug->Source Mode option but source code still appear as I step through the assembly.

enter image description here

What can I do to completely disable source code debugging?

I tried the following approaches without success:

  1. unchecking the Debug->Source Mode option
  2. .lines -d command.
  3. l-t command.
  4. Stepping by p and t instead of F10 and F11

Solution

  • Instead of modifying PDBs or similar, I suggest writing an AutoIt script that closes the source files.

    While(True)
        CloseWinDbgSource()
    WEnd
    
    Func CloseWinDbgSource()
        WinWait("[CLASS:WinBaseClass]", ".cpp", 10)
        WinClose("[CLASS:WinBaseClass]", ".cpp")
    EndFunc
    

    Or you can patch the method windbgx86!WinBase::Create():

    0:000> .dbgdbg
    

    and then in CDB

    0:000> bp windbgx86!WinBase::Create
    0:000> g
    [Force opening of a window here]
    0:000> bc 0
    0:000> a eip
    ret
    <Enter>
    0:000> g
    

    The benefit of that approach is that you don't need to bother with any other windows as well, since no windows will be opened any more.