windbg dump分析之分析命令

1. 查看目标系统

vertarget 是version命令的一个功能子集

vertarget显示调试目标所在的操作系统版本

version则会显示调试环境的其它信息

eg：

0:000> version
Windows XP Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
kernel32.dll version: 5.1.2600.5781 (xpsp_sp3_gdr.090321-1317)
Machine Name:
Debug session time: Sat Jun 30 08:45:50.437 2012 (GMT+8)
System Uptime: 0 days 1:14:31.091
Process Uptime: 0 days 0:23:58.671
  Kernel time: 0 days 0:00:00.000
  User time: 0 days 0:00:00.015
Live user mode: <Local>


Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


command line: '"C:\Program Files\Debugging Tools for Windows (x86)\windbg.exe" '  Debugger Process 0x12C 
dbgeng:  image 6.11.0001.404, built Thu Feb 26 09:55:43 2009
        [path: C:\Program Files\Debugging Tools for Windows (x86)\dbgeng.dll]
dbghelp: image 6.11.0001.404, built Thu Feb 26 09:55:30 2009
        [path: C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll]
        DIA version: 11212
Extension DLL search Path:
    C:\Program Files\Debugging Tools for Windows (x86)\WINXP;C:\Program Files\Debugging Tools for Windows (x86)\winext;C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\Program Files\Debugging Tools for Windows (x86)\pri;C:\Program Files\Debugging Tools for Windows (x86);C:\Program Files\Debugging Tools for Windows (x86)\winext\arcade;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Program Files\Intel\Wireless\Bin\;C:\Program Files\ThinkPad Wireless LAN Adapter Software;C:\Program Files\Common Files\Lenovo;D:\Program Files\TortoiseSVN\bin;d:\Program Files\T58KTV\9158VirtualCamera\Package\bpl;d:\Program Files\T58KTV\9158VirtualCamera\bin;C:\Program Files\QuickTime\QTSystem\;d:\Program Files\Lua\5.1;d:\Program Files\Lua\5.1\clibs;d:\Program Files\Tencent\QQPCMgr\6.6.2135.201;C:\Program Files\IDM Computer Solutions\UltraEdit\;d:\Program Files\Tencent\QQPCMgr\6.6.2135.201
Extension DLL chain:
    dbghelp: image 6.11.0001.404, API 6.1.6, built Thu Feb 26 09:55:30 2009
        [path: C:\Program Files\Debugging Tools for Windows (x86)\dbghelp.dll]
    ext: image 6.11.0001.404, API 1.0.0, built Thu Feb 26 09:55:30 2009
        [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\ext.dll]
    exts: image 6.11.0001.404, API 1.0.0, built Thu Feb 26 09:55:24 2009
        [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\exts.dll]
    uext: image 6.11.0001.404, API 1.0.0, built Thu Feb 26 09:55:26 2009
        [path: C:\Program Files\Debugging Tools for Windows (x86)\winext\uext.dll]
    ntsdexts: image 6.1.7015.0, API 1.0.0, built Thu Feb 26 09:54:43 2009
        [path: C:\Program Files\Debugging Tools for Windows (x86)\WINXP\ntsdexts.dll]

2.查看寄存器值

r

eg：

0:000> r
eax=00251eb4 ebx=7ffd7000 ecx=00000001 edx=00000002 esi=00251f48 edi=00251eb4
eip=7c92120e esp=0012fb20 ebp=0012fc94 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000202
ntdll!DbgBreakPoint:
7c92120e cc              int     3

reax

eg：

0:000> reax
eax=00251eb4

reax=1

eg：

0:000> reax=1
0:000> reax
eax=00000001

3.处理器当前执行代码

u . 当前eip指向地址上8条指令

uf  . 当前eip指向地址整个函数

ub . 当前eip指向地址之前8条指令

u .L2之后2条指令

ub .L2之前2条指令

4.查看当前调用栈

k 显示调用栈

kP 5 显示在调用栈中前五个函数以及它们的参数

kb 5 显示在调用栈中五个函数的前三个参数

kf 5 显示在调用栈中五个函数所使用的栈大小

eg：

0:000> kf 5
  Memory  ChildEBP RetAddr  
          0012fb1c 7c96031d ntdll!DbgBreakPoint
      178 0012fc94 7c941c87 ntdll!LdrpInitializeProcess+0x1014
       88 0012fd1c 7c92e457 ntdll!_LdrpInitialize+0x183
          00000000 00000000 ntdll!KiUserApcDispatcher+0x7

k = 栈基指针 栈顶指针 指令指针用来手动重新构造栈

5.在代码中设置断点

bl列出所有断点

bc * 清除所有断点

bp module!myclass:memfun设置断点

6.查看变量的值

dv显示局部变量的值

dv /i显示值以及存储位置

dt this 已知符号this指针

dt KBTest 0x1111111解析地址0x1111111，类型为KBTest 变量值

7.查看内存命令

d[type] [AddressRange]