Windbg：修订间差异
创建页面，内容为“分类:Windows 分类:C++ 分类:逆向” |
无编辑摘要 |
||
| （未显示同一用户的7个中间版本） | |||
| 第2行： | 第2行： | ||
[[分类:C++]] | [[分类:C++]] | ||
[[分类:逆向]] | [[分类:逆向]] | ||
=== 查看命令帮助 === | |||
<syntaxhighlight lang="bat"> | |||
.hh 命令 | |||
</syntaxhighlight> | |||
=== 64位dump转32位 === | |||
<syntaxhighlight lang="bat"> | |||
!wow64exts.sw | |||
</syntaxhighlight> | |||
=== 查看进程加载的dll === | |||
<syntaxhighlight lang="bat" line="1"> | |||
# .hh lm | |||
lmf | |||
# 过滤带有ook的 | |||
lmf m "*ook*" | |||
</syntaxhighlight> | |||
=== 导出进程加载的dll === | |||
- 安装插件 https://www.microsoft.com/en-us/download/details.aspx?id=53304<syntaxhighlight lang="shell" line="1"> | |||
.load E:\test\mex\Mex\x86\mex.dll | |||
!mex.writemodule -a -p e:\test\dll | |||
</syntaxhighlight> | |||
=== 内存泄露分析 === | |||
<syntaxhighlight lang="bat" line="1"> | |||
// 查看堆 | |||
!heap -s | |||
// 查看内存分配统计 | |||
!heap -stat -h <堆地址> | |||
// 查看某个尺寸的内存分配 | |||
!heap -flt s [size] | |||
// 查看调用堆栈 | |||
!heap -p -a [address] | |||
// 查看具体内存内容 | |||
db [UserPtr] | |||
</syntaxhighlight>https://cloud.tencent.com/developer/article/1973944 | |||
=== 查看线程 === | |||
=== 查看堆栈 === | |||
=== 下载符号 === | |||
# <code># 格式：<nowiki>https://msdl.microsoft.com/download/symbols/ntdll.pdb/</nowiki><地址名称>/ntdll.pdb</code> | |||
# <code><nowiki>https://msdl.microsoft.com/download/symbols/ntdll.pdb/CDE75D039306834203EBD8D4E7D503691/ntdll.pdb</nowiki></code> | |||
下载好后，它是一个blob的文件，然后将它重命名为<code>ntdll.pdb</code>名字，放到CDE75D039306834203EBD8D4E7D503691目录下 | |||
http://m.tnblog.net/hb/article/details/7658 | |||
=== 参考 === | |||
* https://windbg.org/ | |||