WinDBG - how to set all exception to be passed into app?

Question

How can I set all exceptions behavior to pass to application and not appear in debugger?

I'm using IDA Pro 6.6 and WinDbg.

Answer 1

It's a bit awkward to do that for all exception types at once

.foreach(exc {sx}) {.catch{sxd ${exc}}}

What it does:

• {sx}: list all exception types (and current settings, which you actually don't want)
• exc: assign a variable
• .foreach(...) {...}: cut it into pieces of single words and execute a command
• sxd ${exc}: disable whatever is in variable exc
• .catch{...}: ignore all the error messages which come from the settings information

The advantage of the above approach is that it is WinDbg version independent. If new exception codes are introduced, it will still work.

Processing of unwanted text can be avoided with PyKd. Save the following script into a file sdx.py and run !py sxd.py:

from pykd import *

sx = dbgCommand("sx")
for s in sx.splitlines():
    ex = s[:4]
    if  not ex=="" or ex.isspace():
        print("sxd "+ex)
        dbgCommand("sxd "+ex)

Another option is processing all the exceptions manually:

.foreach(exc {.echo "ct et cpr epr ld ud ser ibp iml out av asrt aph bpe bpec eh clr clrn cce cc dm dbce gp ii ip dz iov ch hc lsq isc 3c svh sse ssec sbo sov vs vcpp wkd rto rtt wob wos *"}) {.catch{sxd ${exc}}}

However, if there are new exception codes in WinDbg, you have to add them to the .echo command.

Answer 2

In Windbg the sx family of commands is used to control how exceptions should be handled.

For passing an exception directly to the application, use the sxd command which disable a specific exception. (Actually disable mean ignore first chance exception) To my knowledge, you must use sxd on all specific exceptions, because sxd * means all exceptions that are not otherwise explicitly named.

Use the sx command to see the available exceptions and current settings. And use sxd on all you want to disable.

 0:000> sx
   ct - Create thread - ignore
   et - Exit thread - ignore
  cpr - Create process - ignore
 <cut> 
   av - Access violation - break - not handled

 0:000> sxd av
 0:000> sx
 ct - Create thread - ignore
 et - Exit thread - ignore
 <cut> 
 av - Access violation - second-chance break - not handled

The output is in my opinion a bit difficult to interpret; the av (access violation) will now not be handled by the debugger in any visible way.

The “Controlling Exceptions and Events” section in the help explains the first chance and second-chance concept.