WinDbg的好教程?

q09*_*987 34 windbg

有没有很好的教程来展示如何使用WinDbg

Col*_*ith 136

基础教程和使用演示

"开始"/附加WinDbg的不同方法

工作区(了解它们的工作原理)

Cmdtree

允许您定义调试器命令的"菜单",以便轻松访问常用命令,而无需记住简洁命令名称.不必将所有命令定义放在同一个cmdtree文本文件中....您可以将它们分开并加载多个(然后它们将获得自己的窗口).

启动脚本

您可以在命令行上使用-c选项在启动WinDbg时自动运行WinDbg脚本.

Gives opportunity to turn on DML (Debugger Markup Language) mode, load particular extensions, set .NET exception breakpoints, set kernel flags (e.g. when kernel debugging you might need to change the DbgPrint mask so you see tracing information....ed nt!Kd_DEFAULT_Mask 0xFFFFFFFF), load cmdtrees, etc.

An example script:

$$ Include a directory to search for extensions
$$ (point to a source controlled or UNC common directory so that all developers get access)
.extpath+"c:\svn\DevTools\WinDBG\Extensions"
$$ When debugging a driver written with the Windows Driver Framework/KMDF
$$ load this extension that comes from the WinDDK.
!load C:\WinDDK\7600.16385.1\bin\x86\wdfkd.dll
!wdftmffile C:\WinDDK\7600.16385.1\tools\tracing\i386\wdf01009.tmf
$$ load some extensions
.load msec.dll
.load byakugan.dll
.load odbgext.dll
.load sosex
.load psscor4
$$ Make commands that support DML (Debugger Markup Language) use it
.prefer_dml 1
.dml_start
$$ Show NTSTATUS codes in hex by default
.enable_long_status 1
$$ Set default extension
.setdll psscor4
$$ Show all loaded extensions
.chain /D
$$ Load some command trees
.cmdtree c:\svn\DevTools\WinDBG\cmdtree\cmdtree1.txt
.cmdtree c:\svn\DevTools\WinDBG\cmdtree\cmdtree2.txt
$$ Show some help for the extensions
!wdfkd.help
!psscor4.help
.help /D
Run Code Online (Sandbox Code Playgroud)

Command Cheat Sheets

Extensions (extend the range of commands/features supported)

  • AddSym
    - allows transfer of symbol names between IDA and WinDbg
  • bigLasagne (bldbgexts & blwdbgue)
    - assembly syntax highlighting and a driver mapping tool)
  • BigLib Number Reader
  • 的Byakugan
    -检测反调试方法,远景堆可视化/仿真,轨道缓冲器存储器
  • CmdHist
    - 记录您在调试会话中执行的每个命令,以便您可以轻松地重新执行
  • 核心分析器
    - 检查堆结构是否损坏,检测线程共享的对象等.
  • dom WinDbg扩展
    - (!stlpvector,!idt,!unhex,!grep等)
  • dumppe
    - 从内存中转储PE文件
  • 图像查看器扩展(Vladimir Vukicevic)
  • 英特尔UEFI开发套件调试工具
    - 调试UEFI固件
  • leaktrap
    - GDI/USER处理跟踪器以帮助检测泄漏
  • Mona(需要PyKD)
    - 一组命令,以帮助进行高级分析/查找漏洞利用
  • MSEC
    - provides automated crash analysis and security risk assessment
  • narly
    - lists info about loaded modules such as if using SafeSEH, ASLR, DEP, /GS (Buffer Security Checks)
  • netext (Rodney Viana)
    - (!wservice - list WCF service objects, !wconfig - show .config lines, !whttp - list HttpContexts, !wselect/!wfrom - support SQL like queries on arrays)
  • ODbgExt
    - open debugger extensions
  • OllyMigrate
    - pass debuggee to another debugger without restarting
  • Psscor2
    - a superset of SOS for assisting in debugging .NET 2.0 managed code
  • Psscor4
    - a superset of SOS for assisting in debugging .NET 4 managed code
  • PyDBGExt
    - allows Python scripting to be used
  • PyKD
    - allows Python to be used to script WinDbg
  • sdbgext (Nynaeve)
    -(!valloc, !vallocrwx, !heapalloc, !heapfree, !remotecall, !remotecall64, !loaddll, !unloaddll, !close, !killthread, !adjpriv, !ret)
  • SieExtPub
    -legacy extension...now built into WinDbg in ext.dll
  • SOSEX
    - more commands for helping to debug managed NET 2.0 or 4.0 code
  • SPT/SDBGExt2 (Steve Niemitz)
    - (!DumpHttpContext, !DumpASPNetRequests, !DumpSqlConnectionPools, !DumpThreadPool, etc.)
  • Uniqstack
    - source to a debugger extension (need an OSR Online account to access it)
  • viscope
    - code coverage graph
  • Wait Chain Traversal/wct.dll (CodePlex Debugging Extensions
    - display wait chains of application threads (helps find deadlocks)
  • windbgshark
    - integrates the Wireshark protocol analyser to enable VM traffic manipulation and analysis
  • WinDbg Extensions (Sasha Goldstein)
    - Tracer, WCT, heap_stat, bkb, traverse_map, traverse_vector)
  • WinDbg Highlight (ColorWindbg.dll) (Use Google Translate to translate link)
    - assembly language syntax highlighting

Write your own extension

Debugging Managed Code

Scripting (C#, PS, Python, and WinDbg)

Debuggers/Tools that use the dbgeng.dll API/WinDbg Tools

Different Ways to Generate Crash Dump Files for Post-Mortem Analysis

Dump Analysis Tools

  • BlueScreenView - finds the minidump .dmp files saved by Windows after a BSOD, and extracts information about what caused the crash
  • Debug.Analyzer (can anal

    • 如果您将链接更改为内联链接,您将节省空间(使用“[这是一个链接](http://example.com)”语法)。 (2认同)