使用CorDbg进行托管调试
Cordbg是和.Net Framework,以及Windows SDK一起ship的托管代码的调试工具,相对于VS来说,它是一个比较low-level的调试工具.
本文的主要目的,就是看看Cordbg如何来进行托管调试,然后演示下其功能,看看其和其它的托管调试工具,譬如MDBG和windbg+SOS有啥不同.
Mdbg,是一个使用dbgeng.dll的调试接口来开发的一个开源调试工具,版本ms现在是2.0,很久没更新了,主要是如果想依托MS的调试接口来开发一个调试器的话,可以参考这个open source的调试工具实现.不过mdbg也有一些比较有意思不错的命令.
调试环境:
VS2008, Shared Source CLI 2.0, Clix.exe, Cordbg (Ver 2.0)
最新的MS关于Cordbg的命令行参考可以参考:
http://msdn.microsoft.com/en-us/library/a6zb7c8d.aspx#cpgrfruntimedebuggercordbgexeanchor4
A Victim Sample:
D:\Rotor\sscli20\binaries.x86dbg.rotor\test>type hello.cs
using System;
public class Hello
{
public static void Main()
{
string name = null;
int age = 0;
Console.Write("Enter your name: ");
name = Console.ReadLine();
Console.Write("Enter your age: ");
age = int.Parse(Console.ReadLine());
Console.WriteLine("Welcome {0}! You are {1} years old.",name, age);
}
}
这里,咱使用自己编译出来的csc.exe:
D:\Rotor\sscli20\binaries.x86dbg.rotor\test>csc
Microsoft (R) Shared Source CLI C# Compiler version 2.0.0001
for Microsoft (R) Shared Source CLI version 2.0.0
Copyright (C) Microsoft Corporation. All rights reserved.
还有cordbg也是build出来的,还是build出来的好:
D:\Rotor\sscli20\binaries.x86dbg.rotor\test>cordbg
Microsoft (R) Common Language Runtime Test Debugger Shell Version 2.0.50826.0
Copyright (c) Microsoft Corporation. All rights reserved.
(cordbg)
编译victim sample:
D:\Rotor\sscli20\binaries.x86dbg.rotor\test>csc /debug+ hello.cs
Microsoft (R) Shared Source CLI C# Compiler version 2.0.0001
for Microsoft (R) Shared Source CLI version 2.0.0
Copyright (C) Microsoft Corporation. All rights reserved.
得到两个编译之后的文件,hello.exe和hello.ildb,一个是可执行文件,一个是sscli调试下生成的symbol文件.
然后加载cordbg开始调试:
D:\Rotor\sscli20\binaries.x86dbg.rotor\test>cordbg hello.exe
Microsoft (R) Common Language Runtime Test Debugger Shell Version 2.0.50826.0
Copyright (c) Microsoft Corporation. All rights reserved.
(cordbg) run hello.exe
Process 3036/0xbdc created.
[thread 0x6e4] Thread created.
005: {
(cordbg)
这种是直接启动hello.exe,然后停到源代码第五行的大括号上面,也可以attach到一个process上面去.这个时候,可以直接查看源代码,使用show命令:
(cordbg) sh
001: using System;
002: public class Hello
003: {
004: public static void Main()
005:* {
006: string name = null;
007: int age = 0;
008:
009: Console.Write("Enter your name: ");
010: name = Console.ReadLine();
011: Console.Write("Enter your age: ");
012: age = int.Parse(Console.ReadLine());
013: Console.WriteLine("Welcome {0}! You are {1} years old.",name, age);
014: }
015: }
(cordbg)
*号显示的地方,表示的是当前调试step到的地方,一开始的时候是刚进入到main函数.也可以直接显示diassemble之后的代码:
(cordbg) dis
*[IL:0000] 00: nop
[IL:0001] 14: ldnull
[IL:0002] 0a: stloc.0
[IL:0003] 16: ldc.i4.0
[IL:0004] 0b: stloc.1
[IL:0005] 72:01000070 ldstr 70000001
(cordbg)
下一个断点:
(cordbg) b hello::Main
#1 <UnknownModule>!hello::Main:0 [unbound]
(cordbg) b
#1 <UnknownModule>!hello::Main:0 [unbound]
显示调用堆栈:
(cordbg) w
Thread 0x6e4 Current State:Normal
0)* hello!Hello::Main +0028 in D:\Rotor\sscli20\binaries.x86dbg.rotor\test\hello
.cs:5
--- Managed transition ---
(cordbg)
想往前step一下的时候,可以使用:
ss[ingle] Step into the next native or IL instruction
so Step over the next source line
si Step into the next source line
s[tep] Step into the next source line
i[n] Step into the next source line
(cordbg) s
006: string name = null;
(cordbg)
显示寄存器内容:
(cordbg) reg
Thread 0xf84:
EIP = 038bfdb3 ESP = 001ae75c EBP = 001ae778 EAX = 00000000 ECX = 00000000
EDX = 001aed30 EBX = 7ffd5000 ESI = 00000000 EDI = 00000000
ST0 = n/a ST1 = n/a ST2 = n/a ST3 = n/a ST4 = n/a
ST5 = n/a ST6 = n/a ST7 = n/a
EFL = 0246 CS = 001b CY = 0 PE = 1 AC = 0 ZR = 1 PL = 0 EI = 1 UP = 0 OV = 0
ControlWord = ffff027f StatusWord = ffff0020 TagWord = ffffffff
ErrorOffset = 79c04362 ErrorSelector = 051c001b DataOffset = 001aaf28
DataSelector = ffff0023 Cr0NpxState = 00000000
(cordbg)
基本命令还有一些,不过大部分对经常使用基于dbgeng.dll的调试工具的人来说都不陌生.不过有一个命令使用起来特别有意思,感觉在显示call tree方面是目前为止看到最强悍的:
Wt Track native instruction count and display call tree
(cordbg) wt
15 Hello::Main
20 Console::Write
55 Console::get_Out
40 Console::InitializeStdOutError
62 Console::get_InternalSyncObject
28 Object::.ctor
48 Console::get_InternalSyncObject
82 Console::InitializeStdOutError
54 Console::OpenStandardOutput
46 Console::GetStandardFile
24 SafeFileHandle::.ctor
33 SafeHandleZeroOrMinusOneIsInvalid::.ctor
22 SafeHandle::.ctor
20 CriticalFinalizerObject::.ctor
28 Object::.ctor
17 CriticalFinalizerObject::.ctor
53 SafeHandle::.ctor
22 GC::.cctor
28 Object::.ctor
24 GC::.cctor
61 GC::SuppressFinalize
7 SafeHandle::.ctor
41 BCLDebug::get_SafeHandleStackTracesEnabled
40 BCLDebug::CheckRegistry
22 AppDomain::get_CurrentDomain
26 Thread::GetDomain
74 Thread::get_CurrentThread
<Ctrl-C>
Async break not allowed at this time.
ControlC Trap
62 Thread::GetDomain
1054 instructions total
(cordbg)
这里的输出要很久才能显示完,故输出了几行就ctrl+c打断了.
总的来说,用cordbg来进行托管调试还是不错的,包含了windbg+sos的大部分功能.但是功能没有windbg+sos强大,也没有windbg图形化调试各个窗口的状态实时查看的清楚.所以,在某些场合下用用还是可以的.
Enjoy it. Cheer!
Lbq1221119@cnblogs first posted http://sscli.cnblogs.com
2008-11-13 00:53:28 AM