WinDbg Tricks

本文搜集了一些windbg常用的命令，方便自己查阅，老版本windbg现在已经集成在visual studio里面，新版本的直接在Microsoft Store里面可以搜到，不过新的windbg preview版本不是很稳定，不过UI挺友好的。下面的内容不定期补充，首先放一个官方对windbg命令介绍的地址

https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/commands

符号

windbg里面下载微软符号都需要梯子，我是这样设置的

SRV*C:\MyLocalSymbols*http://msdl.microsoft.com/download/symbols 
srv*C:\symbols_folder*http://msdl.microsoft.com/download/symbols
SRV*c:\mysymbol* http://msdl.microsoft.com/download/symbols

如果符号没加载出来可以!sym noisy激活详细符号加载显示，然后再.reload重新加载看什么问题

断点

下面记录一些常用断点命令

1. 硬件断点，最多下四个断点

ba e1 address

3. 软件断点

bp address

4. 条件断点

对寄存器进行监控，eax 等于0x41的时候断下

ba e1 address ".if @eax = 0x41  {} .else {gc}"

打印一些数据，当在address断下的时候可以打印函数名和rax寄存器里面的内容

bp address ".echo function name; dq rax; gc"

如果需要指定当前线程中对函数下断点，可以用下面的例子指定当前线程

ba e1 /t $thread xxx

进程操作

1. !process 0 0显示进程列表

1: kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS ffff86851c08a300
    SessionId: none  Cid: 0004    Peb: 00000000  ParentCid: 0000
    DirBase: 001ad002  ObjectTable: ffffc78ec3004b80  HandleCount: 2457.
    Image: System

PROCESS ffff86851c12e080
    SessionId: none  Cid: 00a0    Peb: 00000000  ParentCid: 0004
    DirBase: 02d72002  ObjectTable: ffffc78ec3007380  HandleCount:   0.
    Image: Registry

后面加xxx.exe可以指定进程

1: kd> !process 0 0 smss.exe
PROCESS ffff868520d36400
    SessionId: none  Cid: 01a4    Peb: 2238d4d000  ParentCid: 0004
    DirBase: 12a451002  ObjectTable: ffffc78ec3507480  HandleCount:  53.
    Image: smss.exe

也可以根据PID直接搜索

1: kd> !process 470 0
Searching for Process with Cid == 470
PROCESS ffff868523618340
    SessionId: 0  Cid: 0470    Peb: d294a3d000  ParentCid: 02bc
    DirBase: 1b824002  ObjectTable: ffffc78ec70f7b40  HandleCount: 657.
    Image: svchost.exe

2. 如果windbg正在调试内核，可以直接修改当前process调试ring3的进程，.process命令指定要用作进程上下文的进程，直接使用.process可显示当前进程的EPROCESS，下面展示了一次切换进程上下文的例子，将0xffff86851c08a300切换为了ffff868520f77080，这样就可以直接调ring3的进程，不过需要重新g跑一下

1: kd> .process
Implicit process is now ffff8685`1c08a300
1: kd> .process /i /p ffff8685`20f77080
You need to continue execution (press 'g' <enter>) for the context
to be switched. When the debugger breaks in again, you will be in
the new process context.
1: kd> g
Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPointWithStatus:
fffff805`0c27cb30 cc              int     3
0: kd> .process
Implicit process is now ffff8685`20f77080
...

3. 可以通过!dml_proc命令直接查看所有进程，非常方便

1: kd> !dml_proc
Address           PID  Image file name
ffff8685`1c08a300 4    System         
ffff8685`1c12e080 a0   Registry       
ffff8685`20d36400 1a4  smss.exe       
...

查看句柄

可以通过!handle命令查看当前进程所有句柄，需要在内核调试器下才能看句柄信息

1: kd> !handle

PROCESS ffff868523618340
    SessionId: 0  Cid: 0470    Peb: d294a3d000  ParentCid: 02bc
    DirBase: 1b824002  ObjectTable: ffffc78ec70f7b40  HandleCount: 657.
    Image: svchost.exe

Handle table at ffffc78ec70f7b40 with 657 entries in use

0004: Object: ffff868521fda960  GrantedAccess: 001f0003 (Protected) (Inherit) Entry: ffffc78ec72a1010
Object: ffff868521fda960  Type: (ffff86851c0a87a0) Event
    ObjectHeader: ffff868521fda930 (new version)
        HandleCount: 1  PointerCount: 32767

0008: Object: ffff868521fda3e0  GrantedAccess: 001f0003 (Protected) (Inherit) Entry: ffffc78ec72a1020
Object: ffff868521fda3e0  Type: (ffff86851c0a87a0) Event
    ObjectHeader: ffff868521fda3b0 (new version)
        HandleCount: 1  PointerCount: 32718
...

加上/f选项即可查看句柄详细信息，此功能大多用在查看驱动设备名

1: kd> !handle 0xa0 /f

PROCESS ffff868523618340
    SessionId: 0  Cid: 0470    Peb: d294a3d000  ParentCid: 02bc
    DirBase: 1b824002  ObjectTable: ffffc78ec70f7b40  HandleCount: 657.
    Image: svchost.exe

Handle table at ffffc78ec70f7b40 with 657 entries in use

00a0: Object: ffff868523605b80  GrantedAccess: 00000804 (Protected) (Audit) Entry: ffffc78ec72a1280
Object: ffff868523605b80  Type: (ffff86851c1f56c0) EtwRegistration
    ObjectHeader: ffff868523605b50 (new version)
        HandleCount: 1  PointerCount: 1