原文地址:http://blog.csdn.net/hjl243632044/article/details/7664645
上篇记录的够详细了,本篇只记数据。
计算器中放入123456。
符号文件路径填入这个;C:\symbols\dsds.pdb;srv*c:\symbols*http://msdl.microsoft.com/download/symbols;C:\symbols
用户模式数据:
WARNING: Non-directory path:'C:\symbols\dsds.pdb'
WARNING: Whitespace at end of path element
0:002> .reload
Reloading current modules
.........................
0:002> xcalc!g*
01014f08 calc!ghwndTimeOutDlg = <no typeinformation>
01014d9c calc!g_fHighContrast = <no typeinformation>
0100514d calc!GetKeyColor = <no typeinformation>
01014ef8 calc!gfExiting = <no typeinformation>
0100518d calc!GetHelpID = <no typeinformation>
01014c70 calc!ghnoPrecNum = <no typeinformation>
01014c08 calc!ghnoParNum = <no typeinformation>
01014038 calc!gszSep = <no typeinformation>
01014eec calc!ghcurOld = <no typeinformation>
01014d38 calc!g_ahnoChopNumbers = <notype information>
01014f00 calc!ghCalcDone = <no typeinformation>
01014db0 calc!gpszNum = <no type information>
01014f0c calc!gnPendingError = <no typeinformation>
01014000 calc!gnDecGrouping = <no typeinformation>
01014dc0 calc!gcio = <no typeinformation>
01014d98 calc!ghnoLastNum = <no typeinformation>
01014f04 calc!ghDogThread = <no typeinformation>
01014d80 calc!g_hDecMenu = <no typeinformation>
01014f48 calc!gbinexact = <no typeinformation>
01014d7c calc!g_hHexMenu = <no typeinformation>
01014efc calc!ghCalcStart = <no typeinformation>
01014da0 calc!g_fLayoutRTL = <no typeinformation>
01014db8 calc!gbRecord = <no typeinformation>
010149d8 calc!gcIntDigits = <no typeinformation>
01014d6c calc!g_hwndDlg = <no typeinformation>
01014d4c calc!gbUseSep = <no typeinformation>
01014d94 calc!ghnoMem = <no typeinformation>
010044b4 calc!GroupDigits = <no typeinformation>
01014f4c calc!gllfact = <no typeinformation>
01014d90 calc!ghnoNum = <no typeinformation>
01014064 calc!gldPrevious = <no typeinformation>
0:002> ddcalc!gpszNum
01014db0 000b0ff0 00000000 00000001 00000000
01014dc0 00000000 ffffffff 0000000000000000
01014dd0 00000006 00320031 0034003300360035
01014de0 00000000 00000000 0000000000000000
01014df0 00000000 00000000 0000000000000000
01014e00 00000000 00000000 0000000000000000
01014e10 00000000 00000000 0000000000000000
01014e20 00000000 00000000 0000000000000000
0:002> dd000b0ff0
000b0ff0 0032003100340033 00360035 0000002e
000b1000 00000000 00000000 00040094000c01ba
000b1010 74687130 00000001 bebacc9446625cd3
000b1020 31f3e0a1 69364999 58c99d9642ce2f9b
000b1030 ef37be91 82f86018 0002000300000000
000b1040 8a008bed 00000000 0000000000000000
000b1050 00000000 00000000 0000000000000000
000b1060 00000000 00000000 00000000 00000000
0:002> .formats 000b0ff0
Evaluateexpression:
Hex: 000b0ff0
Decimal: 724976
Octal: 00002607760
Binary: 00000000 00001011 00001111 11110000
Chars: ....
Time: Fri Jan 0917:22:56 1970
Float: low1.01591e-039 high 0
Double:3.58186e-318
再打开一个windbg进入内核模式:
lkd>.reload
Connected toWindows XP 2600 x86 compatible target, ptr64 FALSE
Loading KernelSymbols
......................................................................................................................
Loading UserSymbols
..............................
Loadingunloaded module list
............
lkd> !process 0 0
**** NT ACTIVEPROCESS DUMP ****
PROCESS81bbd830 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase:00039000 ObjectTable: e1000cc0 HandleCount: 243.
Image: System
PROCESS81894020 SessionId: none Cid: 015c Peb: 7ffd4000 ParentCid: 0004
DirBase:0856f000 ObjectTable: e14341c0 HandleCount: 21.
Image:smss.exe
PROCESS818a4020 SessionId: 0 Cid: 018c Peb: 7ffdc000 ParentCid: 015c
DirBase:0912e000 ObjectTable: e153ba40 HandleCount: 339.
Image:csrss.exe
PROCESS81899020 SessionId: 0 Cid: 01a4 Peb: 7ffdd000 ParentCid: 015c
DirBase:094f3000 ObjectTable: e1526508 HandleCount: 453.
Image:winlogon.exe
PROCESS818bc5c0 SessionId: 0 Cid: 01d0 Peb: 7ffdd000 ParentCid: 01a4
DirBase:09946000 ObjectTable: e183bc78 HandleCount: 259.
Image:services.exe
PROCESS81a5c6b0 SessionId: 0 Cid: 01dc Peb: 7ffd5000 ParentCid: 01a4
DirBase:09950000 ObjectTable: e183d898 HandleCount: 335.
Image:lsass.exe
PROCESS81aba808 SessionId: 0 Cid: 0270 Peb: 7ffd6000 ParentCid: 01d0
DirBase:09fa5000 ObjectTable: e18987b0 HandleCount: 24.
Image:vmacthlp.exe
PROCESS81ab3a20 SessionId: 0 Cid: 0288 Peb: 7ffdf000 ParentCid: 01d0
DirBase:0a26f000 ObjectTable: e18c0ec0 HandleCount: 200.
Image:svchost.exe
PROCESS819b0888 SessionId: 0 Cid: 02cc Peb: 7ffdc000 ParentCid: 01d0
DirBase:0a464000 ObjectTable: e19152d0 HandleCount: 226.
Image:svchost.exe
PROCESS81aaf650 SessionId: 0 Cid: 0324 Peb: 7ffd8000 ParentCid: 01d0
DirBase:0a9ed000 ObjectTable: e19b4038 HandleCount: 1187.
Image:svchost.exe
PROCESS819a4390 SessionId: 0 Cid: 0374 Peb: 7ffdb000 ParentCid: 01d0
DirBase:0adc3000 ObjectTable: e17f4bd0 HandleCount: 57.
Image:svchost.exe
PROCESS819ad768 SessionId: 0 Cid: 03d4 Peb: 7ffd6000 ParentCid: 01d0
DirBase:0af90000 ObjectTable: e1db0260 HandleCount: 198.
Image:svchost.exe
PROCESS81b7a020 SessionId: 0 Cid: 0480 Peb: 7ffde000 ParentCid: 0448
DirBase:0bc03000 ObjectTable: e17a53a0 HandleCount: 335.
Image:explorer.exe
PROCESS819feb68 SessionId: 0 Cid: 04d0 Peb: 7ffdc000 ParentCid: 01d0
DirBase:0bf55000 ObjectTable: e1e48680 HandleCount: 135.
Image:spoolsv.exe
PROCESS8198f4e8 SessionId: 0 Cid: 059c Peb: 7ffd9000 ParentCid: 0480
DirBase:0c65b000 ObjectTable: e1836920 HandleCount: 36.
Image:VMwareTray.exe
PROCESS81990880 SessionId: 0 Cid: 05a4 Peb: 7ffd6000 ParentCid: 0480
DirBase:0c52e000 ObjectTable: e191a510 HandleCount: 173.
Image:VMwareUser.exe
PROCESS81a13b18 SessionId: 0 Cid: 05ac Peb: 7ffdf000 ParentCid: 0480
DirBase:0c679000 ObjectTable: e1ead320 HandleCount: 88.
Image:ctfmon.exe
PROCESS81941180 SessionId: 0 Cid: 0708 Peb: 7ffd5000 ParentCid: 0480
DirBase: 0eba7000 ObjectTable: e1980c90 HandleCount: 47.
Image: calc.exe
PROCESS 81960340SessionId: 0 Cid: 074c Peb: 7ffdf000 ParentCid: 0480
DirBase:0fd9a000 ObjectTable: e19837b8 HandleCount: 106.
Image:windbg.exe
PROCESS8196bbe0 SessionId: 0 Cid: 07f8 Peb: 7ffd5000 ParentCid: 01d0
DirBase:0ae7e000 ObjectTable: e14ed2d0 HandleCount: 130.
Image:VMwareService.exe
PROCESS8194bda0 SessionId: 0 Cid: 0308 Peb: 7ffd4000 ParentCid: 0324
DirBase:0a6fb000 ObjectTable: e1e623c8 HandleCount: 134.
Image:wuauclt.exe
PROCESS818fc528 SessionId: 0 Cid: 053c Peb: 7ffdb000 ParentCid: 01d0
DirBase:0a45f000 ObjectTable: e2011bb0 HandleCount: 101.
Image: alg.exe
PROCESS818fda80 SessionId: 0 Cid: 05f0 Peb: 7ffde000 ParentCid: 0324
DirBase:0c932000 ObjectTable: e202ebc8 HandleCount: 38.
Image: wscntfy.exe
PROCESS81975a88 SessionId: 0 Cid: 035c Peb: 7ffd9000 ParentCid: 0480
DirBase:0f957000 ObjectTable: e1de5130 HandleCount: 72.
Image:windbg.exe
lkd> !dd 0eba7000
# eba7000 0ef9b067 0edd8067 0f01b067 0efff067
# eba70100ee96067 00000000 00000000 00000000
# eba702000000000 00000000 00000000 00000000
# eba703000000000 00000000 00000000 00000000
# eba704000000000 00000000 00000000 00000000
# eba705000000000 00000000 00000000 00000000
# eba706000000000 00000000 00000000 00000000
# eba707000000000 00000000 00000000 00000000
lkd> !dd 0ef9b000+b0*4
# ef9b2c0 0ef75067 0ee77067 0ef38067 0eef9067
# ef9b2d00f07a067 0f03b067 0efbd067 0ee3e067
# ef9b2e000000080 00000000 00000000 00000000
# ef9b2f000000000 00000000 00000000 00000000
# ef9b30000000000 00000000 00000000 00000000
# ef9b31000000000 00000000 00000000 00000000
# ef9b32000000000 00000000 00000000 00000000
# ef9b33000000000 00000000 00000000 00000000
lkd> !dd 0ef75000+ff0
# ef75ff0 00320031 00340033 00360035 0000002e
# ef7600000000000 00000000 00000000 00000000
# ef7601000000000 00000000 00000000 00000000
# ef7602000000000 00000000 00000000 00000000
# ef7603000000000 00000000 00000000 00000000
# ef7604000000000 00000000 00000000 00000000
# ef7605000000000 00000000 00000000 00000000
# ef7606000000000 00000000 00000000 00000000
虚拟地址000b0ff0经过手工转换后得到物理地址0ef75000+ff0,可以看到在物理地址中放的确实是123456。