WinDbg Tricks

发表于 | 更新于 | 分类于 ， | 阅读次数：
本文字数： 7k | 阅读时长 ≈ 6 分钟

本文搜集了一些windbg常用的命令，方便自己查阅，老版本windbg现在已经集成在visual studio里面，新版本的直接在Microsoft Store里面可以搜到，不过新的windbg preview版本不是很稳定，不过UI挺友好的。下面的内容不定期补充，首先放一个官方对windbg命令介绍的地址

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/commands

符号

windbg里面下载微软符号都需要梯子，我是这样设置的

1
2
3
SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols 
srv*C:\symbols_folder*http://msdl.microsoft.com/download/symbols
SRV*c:\mysymbol* http://msdl.microsoft.com/download/symbols

如果符号没加载出来可以!sym noisy激活详细符号加载显示，然后再.reload重新加载看什么问题

断点

下面记录一些常用断点命令

1.硬件断点，最多下四个断点

1
ba e1 address

2.软件断点

1
bp address

3.条件断点

对寄存器进行监控，eax 等于0x41的时候断下

1
ba e1 address ".if @eax = 0x41  {} .else {gc}"

打印一些数据，当在address断下的时候可以打印函数名和rax寄存器里面的内容

1
bp address ".echo function name; dq rax; gc"

如果需要指定当前线程中对函数下断点，可以用下面的例子指定当前线程

1
ba e1 /t $thread xxx

修改数据

1.修改寄存器命令，将eax置为1，如果要修改浮点寄存器，需要按格式修改，如下所示

1
2
r @eax=1
r xmm0 = 1 1 1 1

2.修改内存命令，将内存为80505648的数据改为00001234

1
ed 80505648 00001234

进程操作

内核态

1.!process 0 0显示进程列表

1
2
3
4
5
6
7
8
9
10
11
1: kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS ffff86851c08a300
    SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 001ad002  ObjectTable: ffffc78ec3004b80  HandleCount: 2457.
    Image: System

PROCESS ffff86851c12e080
    SessionId: none  Cid: 00a0    Peb: 00000000  ParentCid: 0004
    DirBase: 02d72002  ObjectTable: ffffc78ec3007380  HandleCount:   0.
    Image: Registry

后面加xxx.exe可以指定进程

1
2
3
4
5
1: kd> !process 0 0 smss.exe
PROCESS ffff868520d36400
    SessionId: none  Cid: 01a4    Peb: 2238d4d000  ParentCid: 0004
    DirBase: 12a451002  ObjectTable: ffffc78ec3507480  HandleCount:  53.
    Image: smss.exe

也可以根据PID直接搜索

1
2
3
4
5
6
1: kd> !process 470 0
Searching for Process with Cid == 470
PROCESS ffff868523618340
    SessionId: 0  Cid: 0470    Peb: d294a3d000  ParentCid: 02bc
    DirBase: 1b824002  ObjectTable: ffffc78ec70f7b40  HandleCount: 657.
    Image: svchost.exe

2.如果windbg正在调试内核，可以直接修改当前process调试ring3的进程，.process命令指定要用作进程上下文的进程，直接使用.process可显示当前进程的EPROCESS，下面展示了一次切换进程上下文的例子，将0xffff86851c08a300切换为了ffff868520f77080，这样就可以直接调ring3的进程，不过需要重新g跑一下

1
2
3
4
5
6
7
8
9
10
11
12
13
1: kd> .process
Implicit process is now ffff8685`1c08a300
1: kd> .process /i /p ffff8685`20f77080
You need to continue execution (press 'g' <enter>) for the context
to be switched. When the debugger breaks in again, you will be in
the new process context.
1: kd> g
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPointWithStatus:
fffff805`0c27cb30 cc              int     3
0: kd> .process
Implicit process is now ffff8685`20f77080
...
  1. 可以通过!dml_proc命令直接查看所有进程，非常方便
    1
    2
    3
    4
    5
    6
    1: kd> !dml_proc
    Address           PID  Image file name
    ffff8685`1c08a300 4    System         
    ffff8685`1c12e080 a0   Registry       
    ffff8685`20d36400 1a4  smss.exe       
    ...

用户态

1.~ 显示所有线程简略信息， ~* 显示所有线程详细信息，最左边有小点的就是当前线程

1
2
3
4
5
6
7
8
9
10
11
12
0:008> ~
   0  Id: d50c.6dcc Suspend: 1 Teb: 00000084`30e52000 Unfrozen
   ...
.  8  Id: d50c.d60 Suspend: 1 Teb: 00000084`30e62000 Unfrozen
0:008> ~*
   0  Id: d50c.6dcc Suspend: 1 Teb: 00000084`30e52000 Unfrozen
      Start: mstsc!WinMainCRTStartup (00007ff7`1f2e37c0)
      Priority: 0  Priority class: 32  Affinity: fff
   ...
.  8  Id: d50c.d60 Suspend: 1 Teb: 00000084`30e62000 Unfrozen
      Start: ntdll!DbgUiRemoteBreakin (00007ffd`8c01c840)
      Priority: 0  Priority class: 32  Affinity: fff

显示当前线程

1
2
3
4
0:008> ~.
.  8  Id: d50c.d60 Suspend: 1 Teb: 00000084`30e62000 Unfrozen
      Start: ntdll!DbgUiRemoteBreakin (00007ffd`8c01c840)
      Priority: 0  Priority class: 32  Affinity: fff

查看数据

查看句柄

可以通过!handle命令查看当前进程所有句柄，需要在内核调试器下才能看句柄信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
1: kd> !handle

PROCESS ffff868523618340
    SessionId: 0  Cid: 0470    Peb: d294a3d000  ParentCid: 02bc
    DirBase: 1b824002  ObjectTable: ffffc78ec70f7b40  HandleCount: 657.
    Image: svchost.exe

Handle table at ffffc78ec70f7b40 with 657 entries in use

0004: Object: ffff868521fda960  GrantedAccess: 001f0003 (Protected) (Inherit) Entry: ffffc78ec72a1010
Object: ffff868521fda960  Type: (ffff86851c0a87a0) Event
    ObjectHeader: ffff868521fda930 (new version)
        HandleCount: 1  PointerCount: 32767

0008: Object: ffff868521fda3e0  GrantedAccess: 001f0003 (Protected) (Inherit) Entry: ffffc78ec72a1020
Object: ffff868521fda3e0  Type: (ffff86851c0a87a0) Event
    ObjectHeader: ffff868521fda3b0 (new version)
        HandleCount: 1  PointerCount: 32718
...

加上/f选项即可查看句柄详细信息，此功能大多用在查看驱动设备名

1
2
3
4
5
6
7
8
9
10
11
12
13
1: kd> !handle 0xa0 /f

PROCESS ffff868523618340
    SessionId: 0  Cid: 0470    Peb: d294a3d000  ParentCid: 02bc
    DirBase: 1b824002  ObjectTable: ffffc78ec70f7b40  HandleCount: 657.
    Image: svchost.exe

Handle table at ffffc78ec70f7b40 with 657 entries in use

00a0: Object: ffff868523605b80  GrantedAccess: 00000804 (Protected) (Audit) Entry: ffffc78ec72a1280
Object: ffff868523605b80  Type: (ffff86851c1f56c0) EtwRegistration
    ObjectHeader: ffff868523605b50 (new version)
        HandleCount: 1  PointerCount: 1

2.查看浮点寄存器，如果直接用 r xmm0 查看寄存器会是科学计数，用下面指令就很方便了

1
2
3
4
5
6
7
8
9
10
0: kd> .formats xmm0
Evaluate expression:
  Hex:     00000005`00000002
  Decimal: 21474836482
  Octal:   0000000000240000000002
  Binary:  00000000 00000000 00000000 00000101 00000000 00000000 00000000 00000010
  Chars:   ........
  Time:    Mon Jan  1 08:35:47.483 1601 (UTC + 8:00)
  Float:   low 2.8026e-045 high 7.00649e-045
  Double:  1.061e-313

插件

chain 可以查看Windbg此时已经加载的插件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
0:000> .chain
Extension DLL search Path:
    C:\Program Files\...
Extension DLL chain:
    dbghelp: image 10.0.20153.1000, API 10.0.6, 
        [path: C:\Program Files\WindowsApps\...]
    ext: image 10.0.20153.1000, API 1.0.0, 
        [path: C:\Program Files\WindowsApps\...]
    exts: image 10.0.20153.1000, API 1.0.0, 
        [path: C:\Program Files\WindowsApps\...]
    uext: image 10.0.20153.1000, API 1.0.0, 
        [path: C:\Program Files\WindowsApps\...]
    ntsdexts: image 10.0.20153.1000, API 1.0.0, 
        [path: C:\Program Files\WindowsApps\...]

.load 可以加载插件，需要指定全部路径，下面是例子

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
0:000> .load E:\..\segmentheap.dll
0:000> .chain // 检查是否成功加载插件
Extension DLL search Path:
    C:\Program Files\WindowsApps\...
Extension DLL chain:
    E:\..\segmentheap.dll: API 1.0.6, built Tue Dec  8 11:11:55 2020
        [path: E:\..\segmentheap.dll]
    dbghelp: image 10.0.20153.1000, API 10.0.6, 
        [path: C:\Program Files\WindowsApps\..\dbghelp.dll]
    ext: image 10.0.20153.1000, API 1.0.0, 
        [path: C:\Program Files\WindowsApps\..\ext.dll]
    exts: image 10.0.20153.1000, API 1.0.0, 
        [path: C:\Program Files\WindowsApps\..\exts.dll]
    uext: image 10.0.20153.1000, API 1.0.0, 
        [path: C:\Program Files\WindowsApps\..\uext.dll]
    ntsdexts: image 10.0.20153.1000, API 1.0.0, 
        [path: C:\Program Files\WindowsApps\..\ntsdexts.dll]
0:000> !heapinfo 250befe0000 // 成功加载
Try to find Bucket Manager................................................................................
Search 0x20 pages, FIND BUCKET HEADER FAILURE...CHECK HEAP ADDRESS...