View address of entry point in eax register for a suspended process in windbg

Question

For a 32 bit process on 32 bit system, EAX register holds the address of entry point. But windbg always shows 0 for this thread.

After creating a process in suspended state and doing

 .thread <thread_address>
 r

shows

eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=828b0c26 esp=8fe0ba04 ebp=8fe0ba48 iopl=0         nv up di pl nz na po nc
cs=0008  ss=0010  ds=0000  es=0000  fs=0000  gs=0000             efl=00000000
nt!KiSwapContext+0x26:
828b0c26 8b2c24          mov     ebp,dword ptr [esp]  ss:0010:8fe0ba04=8fe0ba48

On checking using GetThreadContext() , I get the current value in EAX .

if (!CreateProcess("test.exe", nullptr, nullptr, nullptr, false, CREATE_SUSPENDED, nullptr, nullptr, &StartupInfo, &ProcessInfo))
{
    std::cout << "Failed to create process " << GetLastError();
    return 1;
}

CONTEXT Ctx;
Ctx.ContextFlags = CONTEXT_FULL;
GetThreadContext(ProcessInfo.hThread, &Ctx);
std::cout << Ctx.Eax << "\n"; //ImageBase + AddressOfEntryPoint

Why does windbg show 0 instead of the address of entry point.

Answer 1

Assuming you have created a suspended process like below in your target (vm / physical machine)
and You are connected to that machine using a kernel debugger
and you have proper private pdbs for the binary you can simply ask windbg to give you the Context.Eax using ?? c++ expression Evaluator

code for test

#include <windows.h>
#include <stdio.h>

int main (void) 
{
    printf("lets Create a suspended process and look at it in kd\n");
    STARTUPINFO si ={0};
    PROCESS_INFORMATION pi ={0};
    si.cb = sizeof(si);
    char *cmdln = "c:\\windows\\system32\\calc.exe\0";
    if( !CreateProcess( NULL,cmdln,NULL,NULL,FALSE,CREATE_SUSPENDED,NULL,NULL,&si,&pi ))
    {
        printf( "CreateProcess failed (%x).\n", GetLastError() );
        return 0;
    }
    CONTEXT ctx ={0};
    ctx.ContextFlags = CONTEXT_FULL;
    GetThreadContext(pi.hThread, &ctx);
    printf("Eax = %x\n",ctx.Eax);

    int ans = 'n';
    while (ans != 'y') 
    {
        Sleep(5000);
        ans = getchar();        
    }
    printf("resuming the process\n");
    ResumeThread(pi.hThread);    
    WaitForSingleObject( pi.hProcess, INFINITE );
    printf("wait returned closing handles\n");
    CloseHandle( pi.hProcess );
    CloseHandle( pi.hThread );
}

compiled an linked with

cl /Zi /W4 /analyze /Od /EHsc cpsusp.cpp /link /release

copied the compiled executable to a vm running 32bit win7sp1 and double clicked it it executed printed the eax and is waiting for a keypress

and in the kd that is connected to this vm you can find this actual value of eax

kd> !process 0 2 cpsusp.exe  <<< find the DirectoryBase and Threads of Process one is interested in 

PROCESS 841cad40  SessionId: 1  Cid: 0110    Peb: 7ffd5000  ParentCid: 008c
    DirBase: 0f90a000  ObjectTable: 95d5d210  HandleCount:  12.
    Image: cpsusp.exe

        THREAD 841b8d48  Cid 0110.0644  Teb: 7ffdf000 Win32Thread: 00000000 WAIT:
 (WrLpcReply) UserMode Non-Alertable
            841b8f7c  Semaphore Limit 0x1

kd> .thread /p /r /P 841b8d48    << setting the thread context (just .thread isn't enough
Implicit thread is now 841b8d48    Implicit process is now 841cad40
.cache forcedecodeptes done
kd> kb
  *** Stack trace for last set context - .thread/.cxr resets it
 # ChildEBP RetAddr  Args to Child              
00 8ce3bae8 8285bd75 841b8d48 82925f08 82922d20 nt!KiSwapContext+0x26
XXXXXXXXXXXXXXXXXX snipped off irrelevent stack 
16 0015f8e0 013d13d4 00000001 002cfe60 002d0bd8 cpsusp!main+0x114 [e:\code\cpsusp\cpsusp.cpp @ 25] 
YYYYYYYYYYYYY  snipped of iirelevent stack 
1b 0015f98c 00000000 013d14b9 7ffd5000 00000000 ntdll!_RtlUserThreadStart+0x1b

kd> .frame /r /c 0x16   <<<< seeting the frame and forcing to retrieve the actual volatile registers
16 0015f8e0 013d13d4 cpsusp!main+0x114 [e:\code\cpsusp\cpsusp.cpp @ 25]
cpsusp!main+0x114:
001b:013d1114 89852cfdffff    mov     dword ptr [ebp-2D4h],eax
kd> dv
            ctx = struct _CONTEXT   <<<<<<<<<
          cmdln = 0x014101d8 "c:\windows\system32\calc.exe"
             pi = struct _PROCESS_INFORMATION
            ans = 0n110
             si = struct _STARTUPINFOA
kd> ?? ctx.Eax  <<<<<<
unsigned long 0x212d6c   <<<< this is the value you got printed in the remote machine