WinDbg Tricks

本文搜集了一些windbg常用的命令,方便自己查阅,老版本windbg现在已经集成在visual studio里面,新版本的直接在Microsoft Store里面可以搜到,不过新的windbg preview版本不是很稳定,不过UI挺友好的。下面的内容不定期补充,首先放一个官方对windbg命令介绍的地址

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/commands

符号

windbg里面下载微软符号都需要梯子,我是这样设置的

1
2
3
SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols 
srv*C:\symbols_folder*http://msdl.microsoft.com/download/symbols
SRV*c:\mysymbol* http://msdl.microsoft.com/download/symbols

如果符号没加载出来可以!sym noisy激活详细符号加载显示,然后再.reload重新加载看什么问题

断点

下面记录一些常用断点命令

  1. 硬件断点,最多下四个断点

    1
    ba e1 address
  2. 软件断点

    1
    bp address
  3. 条件断点

对寄存器进行监控,eax 等于0x41的时候断下

1
ba e1 address ".if @eax = 0x41  {} .else {gc}"

打印一些数据,当在address断下的时候可以打印函数名和rax寄存器里面的内容

1
bp address ".echo function name; dq rax; gc"

如果需要指定当前线程中对函数下断点,可以用下面的例子指定当前线程

1
ba e1 /t $thread xxx

进程操作

  1. !process 0 0显示进程列表
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    1: kd> !process 0 0
    **** NT ACTIVE PROCESS DUMP ****
    PROCESS ffff86851c08a300
    SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
    DirBase: 001ad002 ObjectTable: ffffc78ec3004b80 HandleCount: 2457.
    Image: System

    PROCESS ffff86851c12e080
    SessionId: none Cid: 00a0 Peb: 00000000 ParentCid: 0004
    DirBase: 02d72002 ObjectTable: ffffc78ec3007380 HandleCount: 0.
    Image: Registry

后面加xxx.exe可以指定进程

1
2
3
4
5
1: kd> !process 0 0 smss.exe
PROCESS ffff868520d36400
SessionId: none Cid: 01a4 Peb: 2238d4d000 ParentCid: 0004
DirBase: 12a451002 ObjectTable: ffffc78ec3507480 HandleCount: 53.
Image: smss.exe

也可以根据PID直接搜索

1
2
3
4
5
6
1: kd> !process 470 0
Searching for Process with Cid == 470
PROCESS ffff868523618340
SessionId: 0 Cid: 0470 Peb: d294a3d000 ParentCid: 02bc
DirBase: 1b824002 ObjectTable: ffffc78ec70f7b40 HandleCount: 657.
Image: svchost.exe

  1. 如果windbg正在调试内核,可以直接修改当前process调试ring3的进程,.process命令指定要用作进程上下文的进程,直接使用.process可显示当前进程的EPROCESS,下面展示了一次切换进程上下文的例子,将0xffff86851c08a300切换为了ffff868520f77080,这样就可以直接调ring3的进程,不过需要重新g跑一下

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    1: kd> .process
    Implicit process is now ffff8685`1c08a300
    1: kd> .process /i /p ffff8685`20f77080
    You need to continue execution (press 'g' <enter>) for the context
    to be switched. When the debugger breaks in again, you will be in
    the new process context.
    1: kd> g
    Break instruction exception - code 80000003 (first chance)
    nt!DbgBreakPointWithStatus:
    fffff805`0c27cb30 cc int 3
    0: kd> .process
    Implicit process is now ffff8685`20f77080
    ...
  2. 可以通过!dml_proc命令直接查看所有进程,非常方便

    1
    2
    3
    4
    5
    6
    1: kd> !dml_proc
    Address PID Image file name
    ffff8685`1c08a300 4 System
    ffff8685`1c12e080 a0 Registry
    ffff8685`20d36400 1a4 smss.exe
    ...

查看句柄

可以通过!handle命令查看当前进程所有句柄,需要在内核调试器下才能看句柄信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
1: kd> !handle

PROCESS ffff868523618340
SessionId: 0 Cid: 0470 Peb: d294a3d000 ParentCid: 02bc
DirBase: 1b824002 ObjectTable: ffffc78ec70f7b40 HandleCount: 657.
Image: svchost.exe

Handle table at ffffc78ec70f7b40 with 657 entries in use

0004: Object: ffff868521fda960 GrantedAccess: 001f0003 (Protected) (Inherit) Entry: ffffc78ec72a1010
Object: ffff868521fda960 Type: (ffff86851c0a87a0) Event
ObjectHeader: ffff868521fda930 (new version)
HandleCount: 1 PointerCount: 32767

0008: Object: ffff868521fda3e0 GrantedAccess: 001f0003 (Protected) (Inherit) Entry: ffffc78ec72a1020
Object: ffff868521fda3e0 Type: (ffff86851c0a87a0) Event
ObjectHeader: ffff868521fda3b0 (new version)
HandleCount: 1 PointerCount: 32718
...

加上/f选项即可查看句柄详细信息,此功能大多用在查看驱动设备名

1
2
3
4
5
6
7
8
9
10
11
12
13
1: kd> !handle 0xa0 /f

PROCESS ffff868523618340
SessionId: 0 Cid: 0470 Peb: d294a3d000 ParentCid: 02bc
DirBase: 1b824002 ObjectTable: ffffc78ec70f7b40 HandleCount: 657.
Image: svchost.exe

Handle table at ffffc78ec70f7b40 with 657 entries in use

00a0: Object: ffff868523605b80 GrantedAccess: 00000804 (Protected) (Audit) Entry: ffffc78ec72a1280
Object: ffff868523605b80 Type: (ffff86851c1f56c0) EtwRegistration
ObjectHeader: ffff868523605b50 (new version)
HandleCount: 1 PointerCount: 1