客户端开发 Windows驱动开发（3）注意调试工具gdb和windbg常用调试命令

由于工作的需要，本人常常需要在gdb和windbg调试器上来回切换， 经常会弄混淆这两者的命令，现做个对照表，方便随时查阅。本人也经常用到ollydbg，但由于od界面很友好，不太需要用到命令，况且od的命令插件都是根据windbg做的， 所以就不列出来了。

命令                                          windbg                                   gdb
附加                                          attach                                      attach
脱离附加                                  detach                                     detach
运行                                          g/F5                                          run/r
继续                                          g/F5                                          continue/c
步过                                          p/F10                                         n/ni
步进                                          F11                                            s/si
执行到返回                             gu                                               finish
下断点                                     bp ba                                         break/br
查看断点                                 bl                                                info break
禁止断点                                 bd                                              disable breakpoint
开启断点                                be                                               enable breakpoint
删除断点                                bc                                               delete breakpoints
查看寄存器                            r                                                  info register/i r
修改寄存器                            r                                                  set
查看内存                               db dw dd                                      x
修改内存                               eb ew ed                                     set {type}address
查看调用栈                           k kb kb kPL                                bt
查看全部线程                       ~*                                                 info threads
线程切换                             ~ threadid s                                 thread threadid

查看进程                                   | *                                             info inferior

进程切换                                   | pid s                                      inferior

查看符号                                   x module!symbol                   info symbol

反汇编                                       u uf                                           x /i            disassemble

寄存器表示                                eax....                                      $eax  ...

 

条件断点举例，设置断点当esp+4指向的四字节内存值为31时停下：

windbg:   bp address if(poi(@esp+4)=0x1f)  

gdb:         break *address if {int}($esp+4)  == 0x1f