In windbg, How to set breakpoint on all functions in kernel32.dll ?

Question

I want figure out the call sequence and functions to kernel32.dll in a function example() in example.DLL.

In windbg, how to set breakpoint on all functions in kernel32.dll?

I tried bm kernel32!* , but seems not work.

Answer 1

Kernel32 is a heavily used DLL - you'll probably find that breaking on every function is way too noisy. You also don't need to break on every kernel32 function, just the ones it exports.

If I were you, I'd run "link /dump /exports kernel32.dll", write the outputs to a file, then write a simple script that will grab the function name and write out "bp kernel32!" + the function name to a new file. Then, simply paste the contents of that file into the windbg command window.

There is probably a straightforward way to do this with the scripting support in the debuggers, but you could hack the above script together in the time less time it'd take to learn how to do it via debugger scripting.

Answer 2

I would not do just as stated. Of course it is possible, but if done with bm /a kernel32!* you inadvertently set bps also on data symbols (as opposed to actual functions). In your case wt - trace and watch data (you can look it up in the debugger.chm provided with your windbg package) might be what you're after.