attaching debugger to the DWM.exe

NTDEV
1

hii… I want to attach a debugger to the DWM.exe process in Vista,
and, set a breapoints in the d3d9.dll function that end with Cb
Then, switch the theme to Classic and back to Vista, and watch
the code-flow.

So what I tried was, I diassemble the d3d9.dll and through diassembling take out the offset of createcontextcb function. Than through listdll I looked for the address of d3d9.dll so that i can add the offset of createcontext into that address and by this I can set
the the breakpoint at that address. But I failed to find d3d9.dll in listdll application. I think d3d9.dll must be there if aero is working.
Is this the right approach to set debugpoint or is there any other approach.
Thanks and regards
Prashant

2
  1. Attach to the process
  2. .reload -f
  3. bp d3d9!createcontextcb

I don’t know anything about d3d9, but as a general procedure, the above
should work, assuming that ‘d3d9’ is indeed loaded. The way you are
trying to do it will not work, as it sounds like you are not adjusting
the RVA.

Good luck,

mm

xxxxx@gmail.com wrote:

hii… I want to attach a debugger to the DWM.exe process in Vista,
and, set a breapoints in the d3d9.dll function that end with Cb
Then, switch the theme to Classic and back to Vista, and watch
the code-flow.

So what I tried was, I diassemble the d3d9.dll and through diassembling take out the offset of createcontextcb function. Than through listdll I looked for the address of d3d9.dll so that i can add the offset of createcontext into that address and by this I can set
the the breakpoint at that address. But I failed to find d3d9.dll in listdll application. I think d3d9.dll must be there if aero is working.
Is this the right approach to set debugpoint or is there any other approach.
Thanks and regards
Prashant

3

hii mm … thanks for reply. D3D9.dll is dll of DWM(desktop windpw manager) which is responsible for AERO feature in Vista. I cannot use the method that you suggested because i fail to find the d3d9 module in the lm list. thats why i am trying by getting the address of the process.Is there any any way through i can get the the address of the process
regards
prashant

4

Prashant,

D3D9.dll is indeed used with Aero. I just attached to DWM.exe and did the
following…

  1. .reload /f; lm
    …
    714a0000 7165a000 d3d9 (pdb symbols)
    C:\WebSymbols\d3d9.pdb\22A9627E442C4891A776F83B624F6DBE2\d3d9.pdb
    …
  2. x d3d9!createcontext*
    714c0920 d3d9!CreateContextCb =

    3. bu d3d9!CreateContextCb or bp d3d9!CreateContextCb both work fine and set
    the breakpoints.

    Best to do this over a remote connection though. The last thing you need is
    your machine hanging while another process (quite often exporer) is waiting
    for the dwm LPCA port to respond…

    Carl

    wrote in message news:xxxxx@ntdev…
    > hii… I want to attach a debugger to the DWM.exe process in Vista,
    > and, set a breapoints in the d3d9.dll function that end with Cb
    > Then, switch the theme to Classic and back to Vista, and watch
    > the code-flow.
    >
    > So what I tried was, I diassemble the d3d9.dll and through diassembling
    > take out the offset of createcontextcb function. Than through listdll I
    > looked for the address of d3d9.dll so that i can add the offset of
    > createcontext into that address and by this I can set
    > the the breakpoint at that address. But I failed to find d3d9.dll in
    > listdll application. I think d3d9.dll must be there if aero is working.
    > Is this the right approach to set debugpoint or is there any other
    > approach.
    > Thanks and regards
    > Prashant
    >
    >
5

Thanks Carl for the reply. I will try as you mention.
Regards
Prashant

6

>D3D9.dll is indeed used with Aero. I just attached to DWM.exe and did the
following…

Hii Carl… How can i attach my debugger to DWM.EXE. i have tried to list the module through ‘lm’ command, but fails to notice either d3d9.dll or dwm.exe . Is there any other way by which I can attach debugger to it.
Regards
Prashant