windbg 备忘录 - 4

• u

0:000> u 71a00212
71a00212 0000            add     byte ptr [eax],al
71a00214 003e            add     byte ptr [esi],bh
71a00216 0000            add     byte ptr [eax],al

• x

0:020> x ntdll!zw*
7c92d379 ntdll!ZwAcceptConnectPort (<no parameter info>)
7c92d38e ntdll!ZwAccessCheck (<no parameter info>)
7c92d3a3 ntdll!ZwAccessCheckAndAuditAlarm (<no parameter info>)

• dds 查找二进制地址的符号
  

0:000> dds ebp
0012e738  0012e794
0012e73c  77d195f9 USER32!GetLastInputInfo+0x105
0012e740  00000002
0012e744  0012e760

 

• dds显示COM c++虚函数表

 

0:020> x ole32!OpaqueDataInfo::`vftable'
769a696c ole32!OpaqueDataInfo::`vftable' = <no type information>
769a6990 ole32!OpaqueDataInfo::`vftable' = <no type information>
0:020> dds 769a696c
769a696c  76aa4d85 ole32!ServerLocationInfo::QueryInterface
769a6970  76aa4d94 ole32!SpecialProperties::AddRef
769a6974  76aa4da3 ole32!ServerLocationInfo::Release
769a6978  76aa6186 ole32!OpaqueDataInfo::Serialize
769a697c  76aa619d ole32!OpaqueDataInfo::UnSerialize
769a6980  76aa61da ole32!OpaqueDataInfo::GetSize
769a6984  76aa622b ole32!OpaqueDataInfo::GetCLSID
769a6988  76aa624b ole32!OpaqueDataInfo::SetParent
769a698c  76aa6278 ole32!OpaqueDataInfo::SerializableQueryInterface
769a6990  76aa62f3 ole32!ScmReplyInfo::QueryInterface
769a6994  769cc09b ole32!InstanceInfo::AddRef
769a6998  769cbfd3 ole32!ServerLocationInfo::Release
769a699c  76aa602d ole32!OpaqueDataInfo::AddOpaqueData
769a69a0  76aa60a3 ole32!OpaqueDataInfo::GetOpaqueData
769a69a4  76aa60f9 ole32!OpaqueDataInfo::DeleteOpaqueData
769a69a8  769dbcde ole32!ScmRequestInfo::GetScmInfo
769a69ac  769ddeac ole32!ServerLocationInfo::GetApartment
769a69b0  76a42304 ole32!CDdeObject::COleObjectImpl::GetExtent
769a69b4  00000021
769a69b8  76a2d24b ole32!CClassMoniker::QueryInterface
769a69bc  76a33503 ole32!CErrorObject::AddRef
769a69c0  76a06762 ole32!CClassMoniker::Release
769a69c4  76a06a01 ole32!CClassMoniker::GetUnmarshalClass
769a69c8  76a06a1e ole32!CClassMoniker::GetMarshalSizeMax
769a69cc  76a06a61 ole32!CClassMoniker::MarshalInterface
769a69d0  76a2cdd1 ole32!CClassMoniker::UnmarshalInterface
769a69d4  76a07061 ole32!CClassMoniker::ReleaseMarshalData
769a69d8  769e2be8 ole32!CMonikerFactory::LockServer
769a69dc  76a2d23c ole32!CClassMoniker::QueryInterface
769a69e0  76a334e5 ole32!CErrorObject::AddRef
769a69e4  76a06a80 ole32!CClassMoniker::Release
769a69e8  76a06999 ole32!CClassMoniker::GetComparisonData