IDE : Windbg操作整理
行数指示
bl 看见断点列表后, 源文件的行号要打开该源文件, 将光标挪到该源文件, 看状态栏的行数指示.
反汇编地址
u module!function L长度
u 地址 L长度
反汇编该地址, 反汇编内容的长度为制定长度
反汇编函数
uf moudle!function
反汇编该函数, 指定模块函数符号名或直接指定地址
kd> uf nt!ObpAllocateObjectNameBuffer nt!ObpAllocateObjectNameBuffer: 805b754e 8bff mov edi,edi 805b7550 55 push ebp 805b7551 8bec mov ebp,esp kd> uf 805b754e nt!ObpAllocateObjectNameBuffer: 805b754e 8bff mov edi,edi 805b7550 55 push ebp 805b7551 8bec mov ebp,esp
显示地址内容
dd 地址 L长度
dd 导出的结构或函数名称 L长度
显示从该地址开始制定长度的DWORD内容
显示模块API
x module!*xx*
显示该模块的符号名称(结构， 导出函数, 支持通配符)
改变EIP
在调试中指定当前执行代码位置，就像应用层那样， 单步调试过了， 还想再单步一遍刚过去的函数.
现将光标落在代码行上, 然后从菜单指定.
查看栈
kd> kb ChildEBP RetAddr Args to Child 807e53f4 83f2a083 00000003 0e735803 00000065 nt!RtlpBreakWithStatusInstruction 807e5444 83f2ab81 00000003 855b9d48 00000000 nt!KiBugCheckDebugBreak+0x1c
手工制造一个蓝屏
.crash
如果在单步中发现程序需要修改, 不想等蓝屏了， 自己弄个蓝屏， 被调试计算机蓝屏重启， 节省时间.
分析当前驱动运行状态
!analyze -v
Windbg系统符号库路径设置样例
SRV*D:\WinDbgSysSymbolsWin7X86*http://msdl.microsoft.com/download/symbols/;
/// http://msdl.microsoft.com/download/symbols/ 为MS符号库
/// D:\WinDbgSysSymbolsWin7X86 为下载到本地后的MS符号库缓存
计算器应用
kd> n 16 ///< 设置输入的数字进制, 当前设置16进制数 base is 16 kd> ? 10 * 2 ///< 计算 0x10 * 0x2 的值 Evaluate expression: 32 = 00000020 kd> kd> kd> n 10 base is 10 kd> ? 10 * 2 Evaluate expression: 20 = 00000014
显示指定操作数的进制
二进制
十进制
16进制
查看被调试Windows的版本信息和Windbg配置
kd> version
Windows XP Kernel Version 2600 (Service Pack 3) UP Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp.080413-2111
Machine Name:
Kernel base = 0x804d8000 PsLoadedModuleList = 0x80554fc0
Debug session time: Thu May 16 19:59:07.075 2013 (UTC + 8:00)
System Uptime: 0 days 1:48:32.296
Remote KD: KdSrv:Server=@{<Local>},Trans=@{COM:Port=\\.\pipe\com_1,Baud=19200,Pipe,Timeout=4000}
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
command line: 'D:\WinDDK\7600.16385.1\Debuggers\windbg.exe -b -k com:pipe,port=\\.\pipe\com_1,resets=0' Debugger Process 0x2404
显示命令帮助
显示具体命令帮助
.hh [windbg命令名称]
.hh r
显示所有命令帮助
kd> ? ///< 帮助命令
Open debugger.chm for complete debugger documentation
B[C|D|E][<bps>] - clear/disable/enable breakpoint(s)
BL - list breakpoints
BA <access> <size> <addr> - set processor breakpoint
BP <address> - set soft breakpoint
D[type][<range>] - dump memory
DT [-n|y] [[mod!]name] [[-n|y]fields]
[address] [-l list] [-a[]|c|i|o|r[#]|v] - dump using type information
DV [<name>] - dump local variables
E[type] <address> [<values>] - enter memory values
G[H|N] [=<address> [<address>...]] - go
K <count> - stacktrace
KP <count> - stacktrace with source arguments
LM[k|l|u|v] - list modules
LN <expr> - list nearest symbols
P [=<addr>] [<value>] - step over
Q - quit
R [[<reg> [= <expr>]]] - view or set registers
S[<opts>] <range> <values> - search memory
SX [{e|d|i|n} [-c "Cmd1"] [-c2 "Cmd2"] [-h] {Exception|Event|*}] - event filter
T [=<address>] [<expr>] - trace into
U [<range>] - unassemble
version - show debuggee and debugger version
X [<*|module>!]<*|symbol> - view symbols
? <expr> - display expression
?? <expr> - display C++ expression
$< <filename> - take input from a command file
Hit Enter...
<expr> unary ops: + - not by wo dwo qwo poi hi low
binary ops: + - * / mod(%) and(&) xor(^) or(|)
comparisons: == (=) < > !=
operands: number in current radix, public symbol, <reg>
<type> : b (byte), w (word), d[s] (doubleword [with symbols]),
a (ascii), c (dword and Char), u (unicode), l (list)
f (float), D (double), s|S (ascii/unicode string)
q (quadword)
<pattern> : [(nt | <dll-name>)!]<var-name> (<var-name> can include ? and *)
<range> : <address> <address>
: <address> L <count>
Kernel-mode options:
~<processor>s - change current processor
I<b|w|d> <port> - read I/O port
O<b|w|d> <port> <expr> - write I/O
RDMSR <MSR> - read MSR
SO [<options>] - set kernel debugging options
UX [<address>] - disassemble X86 BIOS code
WRMSR <MSR> - write MSR
.cache [size] - set vmem cache size
.reboot - reboot target machine
x86 options:
DG <selector> - dump selector
<reg> : [e]ax, [e]bx, [e]cx, [e]dx, [e]si, [e]di, [e]bp, [e]sp, [e]ip, [e]fl,
al, ah, bl, bh, cl, ch, dl, dh, cs, ds, es, fs, gs, ss
dr0, dr1, dr2, dr3, dr6, dr7
cr0, cr2, cr3, cr4
gdtr, gdtl, idtr, idtl, tr, ldtr
xmm0-xmm7
<flag> : iopl, of, df, if, tf, sf, zf, af, pf, cf
<addr> : #<16-bit protect-mode [seg:]address>,
&<V86-mode [seg:]address>
Open debugger.chm for complete debugger documentation
重启被调试计算机
.reboot
显示和修改寄存器
kd> r eax=00000001 ebx=80087000 ecx=8054aa74 edx=8054aa44 esi=80087000 edi=00000000 eip=80528bdc esp=8054aa60 ebp=8054abe8 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202 nt!RtlpBreakWithStatusInstruction: 80528bdc cc int 3
r reg = xx ///< 寄存器就可以修改, 如果修改不当, Windbg直接就挂了. 一次执行多条Wdbg命令时， 用';' 分号隔开.
kd> r eax = 2; r ebx = 3; r ecx = 4; r eax=00000002 ebx=00000003 ecx=00000004 edx=8054aa44 esi=80087000 edi=00000000 eip=80528bdc esp=8054aa60 ebp=8054abe8 iopl=0 nv up ei pl nz na po nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000202 nt!RtlpBreakWithStatusInstruction: 80528bdc cc int 3
载入符号
kd> !sym noisy ///< 打开符号提示
noisy mode - symbol prompts on
kd> .reload /i ///< 重新装入符号
Connected to Windows XP 2600 x86 compatible target at (Fri May 17 08:53:31.187 2013 (UTC + 8:00)), ptr64 FALSE
DBGHELP: nt - public symbols
d:\windbgsyssymbolswin7x86\ntkrnlpa.pdb\30B5FB31AE7E4ACAABA750AA241FF3311\ntkrnlpa.pdb
Loading Kernel Symbols
.
DBGHELP: hal - public symbols
d:\windbgsyssymbolswin7x86\halaacpi.pdb\FCC14B4D76114FE7A8E9AEA280B60E401\halaacpi.pdb
列出所有模块符号信息
kd> lm start end module name 00730000 00c79000 xpsp2res (no symbols) 01000000 01006000 svchost (pdb symbols) d:\windbgsyssymbolswin7x86\svchost.pdb\A22ACFC8D5644DFBB8C4A0529E9146762\svchost.pdb
列出模糊匹配的模块符号名称
kd> lm m *nu* start end module name f7a91000 f7a94d80 serenum (pdb symbols) d:\windbgsyssymbolswin7x86\SerEnum.pdb\8A89A0C5EDB54520B1AF8E9092C3D9041\SerEnum.pdb f7add000 f7adf980 gameenum (pdb symbols) d:\windbgsyssymbolswin7x86\GameEnum.pdb\13E0E8CF00AE42EE8854423589ACB4841\GameEnum.pdb f7afb000 f7afc100 swenum (pdb symbols) d:\windbgsyssymbolswin7x86\swenum.pdb\0581E48D203A4E0886B13659DE0EBCEA1\swenum.pdb f7ce3000 f7ce3b80 Null (pdb symbols) d:\windbgsyssymbolswin7x86\null.pdb\77840F8CB3624E438D5D2F0913E4D30E1\null.pdb
列出指定模块调试信息
kd> !lmi Beep
Loaded Module Info: [beep]
Module: Beep
Base Address: f7b05000
Image Name: Beep.SYS
Machine Type: 332 (I386)
Time Stamp: 3b7d82e5 Sat Aug 18 04:47:33 2001
Size: 1080
CheckSum: c82c
Characteristics: 10e
Debug Data Dirs: Type Size VA Pointer
CODEVIEW 21, 80c, 80c RSDS - GUID: {65DC45B4-3916-4E4C-9DEF-F20E161DC74C}
Age: 1, Pdb: beep.pdb
Image Type: MEMORY - Image read successfully from loaded memory.
Symbol Type: PDB - Symbols loaded successfully from symbol server.
d:\windbgsyssymbolswin7x86\beep.pdb\65DC45B439164E4C9DEFF20E161DC74C1\beep.pdb
Load Report: public symbols , not source indexed
d:\windbgsyssymbolswin7x86\beep.pdb\65DC45B439164E4C9DEFF20E161DC74C1\beep.pdb
在所有模块中搜索符号
kd> x *!*buffer* 4a457e10 WINHTTP!DBLBUFFER::SetOutputInputBuffer = <no type information> 4a43fb54 WINHTTP!DIGEST_CTX::InitSecurityBuffers = <no type information> 4a457ce9 WINHTTP!DBLBUFFER::UpdateVars = <no type information>
在指定模块中搜索符号
kd> x /v nt!*buffer* pub global 805b754e 0 nt!ObpAllocateObjectNameBuffer = <no type information> pub global 806a9eb6 0 nt!CmpParseInfBuffer = <no type information> pub global 8056cee8 0 nt!NtFlushBuffersFile = <no type information>
在所有模块中搜索某一函数或符号
e.g. 查找 ZwQuerySystemInfomation, 因为此API没导出， 就想看看各内核模块中, 是否有类似的API
kd> x *!*query*system* 804f7d8c nt!KeQuerySystemTime = <no type information> 804ffb1c nt!ZwQuerySystemInformation = <no type information> 8060db6c nt!NtQuerySystemEnvironmentValue = <no type information> 804ffb30 nt!ZwQuerySystemTime = <no type information> 80515208 nt!MmQuerySystemSize = <no type information> 80608b48 nt!NtQuerySystemInformation = <no type information> 804ffaf4 nt!ZwQuerySystemEnvironmentValue = <no type information> 8060a9e4 nt!NtQuerySystemTime = <no type information> 8064d3d0 nt!ExQuerySystemLockInformation = <no type information> 8060db26 nt!NtQuerySystemEnvironmentValueEx = <no type information> 80568026 nt!xHalQuerySystemInformation = <no type information> 804ffb08 nt!ZwQuerySystemEnvironmentValueEx = <no type information> 806d1510 hal!_imp__KeQuerySystemTime = <no type information> 806e7bba hal!HaliQuerySystemInformation = <no type information> f731e99c Mup!_imp__KeQuerySystemTime = <no type information> f731eae8 Mup!_imp__MmQuerySystemSize = <no type information> f733abf8 NDIS!_imp__KeQuerySystemTime = <no type information> f7379bdc Ntfs!_imp__KeQuerySystemTime = <no type information> f7379f1c Ntfs!_imp__MmQuerySystemSize = <no type information> f73f1cfc KSecDD!_imp__ZwQuerySystemInformation = <no type information> f7406c20 sr!_imp__KeQuerySystemTime = <no type information> f74202d4 fltMgr!_imp__MmQuerySystemSize = <no type information> f743f044 SCSIPORT!_imp__KeQuerySystemTime = <no type information> f745b61c atapi!_imp__KeQuerySystemTime = <no type information> f7485d08 dmio!_imp__KeQuerySystemTime = <no type information> f748faac ftdisk!_imp__KeQuerySystemTime = <no type information> f7496fc8 ftdisk!FtpQuerySystemVolumeNameQueryRoutine = <no type information> f76018e8 MountMgr!MountMgrQuerySystemVolumeNameQueryRoutine = <no type information> f76019be MountMgr!MountMgrQuerySystemVolumeName = <no type information> f761de08 VolSnap!_imp__KeQuerySystemTime = <no type information> f76536c4 CLASSPNP!_imp__KeQuerySystemTime = <no type information> f7875bdc PartMgr!_imp__KeQuerySystemTime = <no type information> f7aef508 WMILIB!_imp__KeQuerySystemTime = <no type information>
产生内核dump文件
在可以用WinDbg链接目标计算机时, 如果发生崩溃, 使用WinDbg命令产生内核Dump文件到开发机.
.dump /a /m /o /u D:/dump/drivercrash.dmp如果dump出来的信息不够, 输入 .hh .dump 查看详细的 .dump命令.
在Windows中设置Dump文件产生方式
如果不挂WinDbg, 直接在WinXp中设置Dump文件的生成方式.
列出所有进程
!process 0 0
kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS 85539a20 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 00185000 ObjectTable: 89001be0 HandleCount: 510.
Image: System
PROCESS 8680ad40 SessionId: none Cid: 0104 Peb: 7ffd5000 ParentCid: 0004
DirBase: 3efb9020 ObjectTable: 8b649b68 HandleCount: 29.
Image: smss.exe
切换进程
.process /p [进程句柄值]
kd> .process /p 857313b0 Implicit process is now 857313b0 .cache forcedecodeuser done
重新加载用户态符号文件
.reload /f /user
重新加载用户态符号文件, 前提条件: 先切换到此用户进程
kd> .reload /f /user Loading User Symbols ..............
清空Windbg命令输出窗口
.cls
显示进程信息
.tlist /v
可以显示进程带入的命令行参数~
0n2456 VisualSVNServer.exe
Session: 0 Command Line: "D:\Program Files (x86)\VisualSVN Server\bin\VisualSVNServer.exe" -d "D:/Program Files (x86)/VisualSVN Server" -C "LoadModule log_visualsvn_module bin/mod_log_visualsvn.so" -E nul
显示单独的命令执行窗口
用处: 如果一个windbg命令的执行结果很长, 会和以前的命令输出窗口内容混在一起， 眼花.
在单独的命令执行窗口中输入的命令， 执行结果输出， 每次只有当前命令的输出.
如果是 ： uf 一个API反汇编内容较长的情况下， 单独的命令执行窗口输出的好处就出来了
如果是 ： 做调试笔记, 这也很有用, 一步一个输出结果.
还有一个好处~, 可以在单独命令窗口中执行一个命令, 在另一个命令输出窗口中执行另一个操作， 看着另外一个命令窗口的结果做参考.
可以通过 .browse开辟多个单独的命令输出窗口~
.browse
将WinDbg作为默认的本地调试器
在命令行输入 WinDbg -I
在调试过程中, 查看局部变量
dv /V 局部变量名称
kd> dv /V ulApiAddr f7a4cc60 @ebp-0x04 ulApiAddr = 0x804ed978
BSOD的异常码查询
http://msdn.microsoft.com/en-us/library/windows/hardware/hh450912(v=vs.85).aspx
查看内核中已经导出的结构定义名称
dt nt!*
kd> dt nt!*user*
ntkrnlpa!_HEAP_USERDATA_HEADER
ntkrnlpa!_HEAP_USERDATA_HEADER
ntkrnlpa!_RTL_USER_PROCESS_PARAMETERS
ntkrnlpa!_KUSER_SHARED_DATA