windbg断点学习总结

WinDBG常用断点命令

http://blog.csdn.net/vangoals/article/details/4458051

WinDBG提供了多种设断点的命令：
bp 命令是在某个地址 下断点， 可以 bp 0x7783FEB 也可以 bp MyApp!SomeFunction 。 对于后者，WinDBG 会自动找到MyApp!SomeFunction 对应的地址并设置断点。 但是使用bp的问题在于：1）当代码修改之后，函数地址改变，该断点仍然保持在相同位置，不一定继续有效； 2）WinDBG 不会把bp断点保存工作空间中 。
bu 命令是针对某个符号 下断点。 比如 bu MyApp!SomeFunction 。 在代码被修改之后， 该断点可以随着函数地址改变而自动更新到最新位置。  而且bu 断点会保存在WinDbg工作空间中， 下次启动 Windbg 的时候该断点会自动设置上去。
还bu 可以对还不能识别的符号设置断点，当系统中有新模块加载进来时，调试器会对未定断点再次进行识别，如果找到了匹配的符号则会设置它。而bp 断点会失败（因为函数地址不存在），bu 断点则可以成功。 新版的WinDBG中 bp失败后会自动被转成bu 。

bm 命令也是针对符号 下断点。 但是它支持匹配表达式 。 很多时候你下好几个断点。 比如，把MyClass 所有的成员函数都下断点： bu MyApp!MyClass::* ， 或者把所有以CreateWindow开头的函数都下断点： bu user32!CreateWindow* 。

以上三个命令是对代码下断点， 我们还可以对数据下断点。

ba 命令就是针对数据 下断点的命令， 该断点在指定内存被访问时触发。 命令格式为
ba  Access  Size  [地址]
Access 是访问的方式， 比如 e (执行)， r (读/写)， w (写)
Size 是监控访问的位置的大小，以字节为单位。 值为 1、2或4，还可以是 8（64位机）。

比如要对内存0x0483DFE进行写操作的时候下断点，可以用命令 ba w4 0x0483DFE

这里顺便提以下其他断点命令：
bl   列出所有断点
bc   清除断点
bd 禁用断点
be 启动被bd 命令禁用的断点
========

windbg常用断点 (zz)

http://blog.csdn.net/is2120/article/details/7874007

windbg常用断点
//z 2012-08-16 16:43:36 IS2120@csdn.T3181799596[T8,L144,R4,V335]

拦截窗口： 
bp CreateWindow 创建窗口 
bp CreateWindowEx(A) 创建窗口 
bp ShowWindow 显示窗口 
bp UpdateWindow 更新窗口 
bp GetWindowText(A) 获取窗口文本 

拦截消息框： 
bp MessageBox(A) 创建消息框 
bp MessageBoxExA 创建消息框 
bp MessageBoxIndirect(A) 创建定制消息框 
bp IsDialogMessageW 

拦截警告声： 
bp MessageBeep 发出系统警告声(如果没有声卡就直接驱动系统喇叭发声) 

拦截对话框： 
bp DialogBox 创建模态对话框 
bp DialogBoxParam(A) 创建模态对话框 
bp DialogBoxIndirect 创建模态对话框 
bp DialogBoxIndirectParam(A) 创建模态对话框 
bp CreateDialog 创建非模态对话框 
bp CreateDialogParam(A) 创建非模态对话框 
bp CreateDialogIndirect 创建非模态对话框 
bp CreateDialogIndirectParam(A) 创建非模态对话框 
bp GetDlgItemText(A) 获取对话框文本 
bp GetDlgItemInt 获取对话框整数值 

拦截剪贴板： 
bp GetClipboardData 获取剪贴板数据 

拦截注册表： 
bp RegOpenKey(A) 打开子健 
bp RegOpenKeyEx 打开子健 
bp RegQueryValue(A) 查找子健 
bp RegQueryValueEx 查找子健 
bp RegSetValue(A) 设置子健 
bp RegSetValueEx(A) 设置子健 

功能限制拦截断点： 
bp EnableMenuItem 禁止或允许菜单项 
bp EnableWindow 禁止或允许窗口 

拦截时间： 
bp GetLocalTime 获取本地时间 
bp GetSystemTime 获取系统时间 
bp GetFileTime 获取文件时间 
bp GetTickCount 获得自系统成功启动以来所经历的毫秒数 
bp GetCurrentTime 获取当前时间（16位） 
bp SetTimer 创建定时器 
bp TimerProc 定时器超时回调函数 
GetDlgItemInt 得指定输入框整数值 
GetDlgItemText 得指定输入框输入字符串 
GetDlgItemTextA 得指定输入框输入字符串 

拦截文件： 
bp CreateFileA 创建或打开文件 (32位) 
bp OpenFile 打开文件 (32位) 
bp ReadFile 读文件 (32位) 
bp WriteFile 写文件 (32位) 
GetModuleFileNameA 
GetFileSize 
Setfilepointer 
fileopen 
FindFirstFileA 
ReadFile 

拦截驱动器： 
bp GetDriveTypeA 获取磁盘驱动器类型 
bp GetLogicalDrives 获取逻辑驱动器符号 
bp GetLogicalDriveStringsA 获取当前所有逻辑驱动器的根驱动器路径
//z 2012-08-16 16:43:36 IS2120@csdn.T3181799596[T8,L144,R4,V335]
========

windbg实用技术：windbg断点操作

windbg命令         

bp+address/符号地址       在address指令处加断点，但是这个地址所在的模块必须已经被加载

bu+address/符号地址        在address指令处加断点，但是这个地址所在的模块可以没有被加载，即延迟加载的模块。

ba: 内存访问断点，当访问这个内存地址时（一般是数据），程序会断住。

bl: 列出所有已经加载的断点和地址

bc: 清理断点。 bc *,清理所有的断点。 bc 1,清理1号断点。

bd: 使一个断点无效。

be: 使一个断点有效，与bd左右相反。
========

WinDBG 调试技巧之设置条件断点

http://blog.csdn.net/itmes/article/details/38016275  

WinDBG调试技巧之设置条件断点
Setting a Conditional Breakpoint
Conditional breakpoints can be veryuseful when you are trying to find bugs in your code. They cause a break tooccur only if a specific condition is satisfied.
当你在尝试找到你代码中的bug时，条件断点非常有用。当某个特殊条件满足时它才引起断点发生
A conditional breakpoint is created by combining a breakpoint command witheither thej (Execute If - Else) command or the.if token, followed by thegc (Go from Conditional Breakpoint)command. This breakpoint causes a break to occur only if a specific conditionis satisfied.
一个条件断点通过将一个断点命令和j命令或者.if关键字关联而创建，后面跟着gc命令。只有当某个特殊条件满足时这个断点才引起断点发生
The basic syntax for a conditional breakpoint using thej commandis as follows:
使用j命令的条件断点的基本命令是:
0:000> bp Address "j (Condition) 'OptionalCommands'; 'gc' "

The basic syntax for a conditional breakpoint using the.if tokenis as follows:
使用.if关键字的条件断点的基本语法是
0:000> bp Address ".if (Condition) {OptionalCommands} .else {gc}"

Conditional breakpoints are best illustrated with an example. Thefollowing command sets a breakpoint at line 143 of theMysource.cppsourcefile. When this breakpoint is hit, the variable MyVar is tested. If thisvariable is less than or equal to 20, execution continues; if it is greaterthan 20, execution stops.
条件断点最好用一个例子来描述。后面的命令在Mysource.cpp源文件的第143行设置一个条件断点。当这个断点命中时，变量MyVar被检测。如果这个变量小于或等于20，则继续执行；如果它大于20，停止执行
0:000> bp `mysource.cpp:143` "j (poi(MyVar)>0n20) ''; 'gc' " 
0:000> bp `mysource.cpp:143` ".if (poi(MyVar)>0n20) {} .else {gc}"

The preceding command has a fairly complicated syntax that contains thefollowing elements:
前面的命令有一个相当复杂的语法，包含着后面的元素：
The bp (Set Breakpoint) command sets breakpoints. Although the preceding example uses the bp command, you could also use thebu (Set Unresolved Breakpoint) command. For more information about the differences betweenbp andbu, and for a basic introduction to breakpoints, seeUsing Breakpoints.
Bp命令设置断点。尽管前面的例子使用了bp命令，你也可以使用bu命令。如果需要查看bp和bu之间的不同，和断点的简介，可以查看Using Breakpoints.
Source line numbers are specified by using grave accents ( ` ). For details, seeSource Line Syntax.
源代码行通过使用沉音符指定，详见Source Line Syntax.
When the breakpoint is hit, the command in straight quotation marks ( " ) is executed. In this example, this command is aj (Execute If - Else) command or an.if token, which tests the expression in parentheses.
当断点命中，直引号标记的命令被执行。在这个例子中，这个命令是一个j命令或者一个.if关键字，以检测圆括号中的表达式
In the source program, MyVar is an integer. If you are using C++ expression syntax, MyVar is interpreted as an integer. However, in this example (and in the default debugger configuration), MASM expression syntax is used. In a MASM expression,MyVar is treated as an address. Thus, you need to use the poi operator to dereference it. (If your variable actually is a C pointer, you will need to dereference it twice—for example,poi(poi(MyPtr)).) The0n prefix specifies that this number is decimal. For syntax details, seeMASM Numbers and Operators.
在源程序中，MyVar是一个整数。如果你使用C++表达式语法，MyVar被解释为一个整数。然而在这个例子中（并且在默认的调试器选项）,使用的是MASM表达式语法。在一个MASM表达式中，MyVar被认为是一个地址。因此你需要使用poi操作符去解引用它。（如果你的变量实际上是一个C指针，你需要两次解引用它-例如poi(poi(MyPtr)) ）0n前缀指定这个数字是10进制的。语法的详细内容参见MASM Numbers and Operators.
The expression in parentheses is followed by two commands, surrounded by single quotation marks (' ) for thej command and curly brackets ( {} ) for the.if token. If the expression is true, the first of these commands is executed. In this example, there is no first command, so command execution will end and control will remain with the debugger. If the expression in parentheses is false, the second command will execute. The second command should almost always be agc (Go from Conditional Breakpoint) command, because this command causes execution to resume in the same manner that was occurring before the breakpoint was hit (stepping, tracing, or free execution).
括号中的表达式后跟两个命令，使用j命令时用单引号括起来，使用.if关键字时使用花括号括起来。如果表达式为真，这些命令中的第一个将被执行。在这个例子中，没有第一个命令，所以命令的执行将会停止并且控制权继续交给调试器。如果在圆括号中的表达式为假，第二个命令将被执行。第二个命令几乎永远都是gc命令，因为这个命令使得执行被恢复到在断点被命中之前的相同的方式（单步，跟踪，或者自由执行）
If you want to see a message each time the breakpoint is passed or when itis finally hit, you can use additional commands in the single quotation marksor curly brackets. For example:
如果你想要在断点每次通过时或者最终命中时看到一个消息，你可以在单引号或花括号中使用附加的命令。例如：
0:000> bp `:143` "j (poi(MyVar)>5) '.echo MyVar Too Big'; '.echo MyVar Acceptable; gc' " 
0:000> bp `:143` ".if (poi(MyVar)>5) {.echo MyVar Too Big} .else {.echo MyVar Acceptable; gc} " 

These comments are especially useful if you have several such breakpointsrunning at the same time, because the debugger does not display its standard"Breakpoint n Hit" messages when you are using a commandstring in thebp command.
如果你在同一时间有几个这样的断点，这些注释将会特别有用，因为当你在bp命令中使用一个命令字符串时，调试器并不显示它的标准的"Breakpointn Hit"消息
Conditional Breakpoints and Register Sign Extension
条件断点和寄存器标记扩展
You can set a breakpoint that is conditional on a register value.
你可以设置一个断点，其条件是某个寄存器的值
The following command will break at the beginning of themyFunctionfunction if theeax register is equal to 0xA3:
下面的命令将会在eax寄存器等于0xA3时，在myFunction函数的开始处断下来
0:000> bp mydriver!myFunction "j @eax = 0xa3  '';'gc'" 
0:000> bp mydriver!myFunction ".if @eax = 0xa3  {} .else {gc}"

However, the following similar command willnot necessarily breakwheneax equals 0xC0004321:
然而，后面相似的命令将不一定会在eax等于0xC0004321时断下来。
0:000> bp mydriver!myFunction "j @eax = 0xc0004321  '';'gc'" 
0:000> bp mydriver!myFunction ".if @eax = 0xc0004321  {} .else {gc}"

The reason the preceding command will fail is that the MASM expressionevaluator sign-extends registers whose high bit equals one. Wheneax hasthe value 0xC0004321, it will be treated as 0xFFFFFFFF`C0004321 in computations—eventhougheax will still bedisplayed as 0xC0004321. However, thenumeral0xc0004321 is sign-extended in kernel mode, but not in usermode. Therefore, the preceding command will not work properly in user mode. Ifyou mask the high bits ofeax, the command will work properly in kernelmode—but now it will fail in user mode.
前面命令将会失败的原因是MASM表达式评估有符号扩展的寄存器时它们的高位等于1.当eax的值为0xC0004321，它将在评估时被认为是0xFFFFFFFF`C0004321-尽管eax仍然显示为0xC0004321。然而，数字0xc0004321在内核模式中被有符号扩展，用户模式中却不是这样。因此，前面的命令将不会在用户模式中正常的工作。如果你对eax的高位进行掩码，该命令则会在内核模式中正常工作-但是现在它在用户模式中就不行了
You should formulate your commands defensively against sign extension inboth modes. In the preceding command, you can make the command defensive bymasking the high bits of a 32-bit register by using an AND operation to combineit with 0x00000000`FFFFFFFF and by masking the high bits of a numeric constantby including a grave accent ( ` ) in its syntax.
你需要将你的命令公式化以防在两种模式中的符号扩展。在前面的命令中，你可以通过使用AND操作符将一个32位寄存器的高位与0x00000000`FFFFFFFF组合进行掩码，并且通过包含一个沉音符将其高位与一个数字常量进行掩码。
The following command will work properly in user mode and kernel mode:
下面的命令将会在用户模式和内核模式都正常工作
0:000> bp mydriver!myFunction "j (@eax & 0x0`ffffffff) = 0x0`c0004321  '';'gc'" 
0:000> bp mydriver!myFunction ".if (@eax & 0x0`ffffffff) = 0x0`c0004321  {} .else {gc}"

For more information about which numbers are sign-extended by thedebugger, seeSign Extension.
如果需要有关数字在调试器中是如何进行符号扩展的，可以查看Sign Extension.
Conditional Breakpoints in WinDbg
WinDbg中的条件断点
In WinDbg, you can create a conditional breakpoint by clickingBreakpoints from theEdit menu,entering a new breakpoint address into the Command box, and entering acondition into theCondition box.
在WinDbg中，你可以通过在Edit菜单中点击Breakpoints来创建一个条件断点，在command框输入一个新的断点的地址在Condition框中输入一个条件
For example, typingmymod!myFunc+0x3A into theCommand boxand myVar < 7 into the Condition box is equivalent to issuingthe following command:
例如，在Command框中输入mymod!myFunc+0x3A并且在Condition框中输入myVar < 7等价于下面的命令
0:000> bu mymod!myFunc+0x3A "j(myVar<7) '.echo "Breakpoint hit, condition myVar<7"'; 'gc'" 
0:000> bu mymod!myFunc+0x3A ".if(myVar<7) {.echo "Breakpoint hit, condition myVar<7"} .else {gc}" 

Restrictions on Conditional Breakpoints
条件断点的限制
If you arecontrolling the user-mode debugger from the kernel debugger,you cannot use conditional breakpoints or any other breakpoint command stringthat contains thegc (Go from Conditional Breakpoint) org (Go) commands. If you use thesecommands, the serial interface might not be able to keep up with the number ofbreakpoint passes, and you will be unable to break back into CDB.
如果你正在使用内核调试器控制用户态调试器，你就不能够使用条件断点或者其它任何包含gc或g命令的条件断点命令。如果你使用这些命令，当条件断点到达时串行接口可能不能继续，并且你将不能再中断到CDB
========

windbg --内存数据断点

http://blog.sina.com.cn/s/articlelist_1309247281_7_1.html
ba (Break on Access)
The ba command sets a data breakpoint. This breakpoint is triggered when the specified memory is accessed.
Syntax
User-Mode
[~Thread] ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] 
Kernel-Mode
ba[ID] Access Size [Options] [Address [Passes]] ["CommandString"] 
Parameters
Thread
Specifies the thread that the breakpoint applies to. For more information about syntax, see Thread Syntax. You can specify threads only in user mode.
ID
Specifies an optional number that identifies the breakpoint. If you do not specify ID, the first available breakpoint number is used. You cannot add space between ba and the ID number. Each processor supports only a limited number of data breakpoints. But there is no restriction on the value of the ID number. If you enclose ID in square brackets ([]), ID can include any expression. For more information about the syntax, see Numerical Expression Syntax.
Access
Specifies the type of access that satisfies the breakpoint. This parameter can be one of the following values.
Option Action
e (execute) Breaks into the debugger when the CPU retrieves an instruction from the specified address.
r (read/write) Breaks into the debugger when the CPU reads or writes at the specified address.
w (write) Breaks into the debugger when the CPU writes at the specified address.
i (i/o) (Microsoft Windows XP and later versions, kernel mode only, x86-based systems only) Breaks into the debugger when the I/O port at the specified Address is accessed.
You cannot add space between Access and Size.
Note  On Windows Server 2003 with Service Pack 1 (SP1), on an Itanium-based computer that uses WOW64 to emulate x86, data breakpoints do not work with the execute option but they do work with the read and write options.
Size
Specifies the size of the location, in bytes, to monitor for access. On an x86-based processor, this parameter can be 1, 2, or 4. However, if Access equals e, Size must be 1.
On an x64-based processor, this parameter can be 1, 2, 4, or 8. However, if Access equals e, Size must be 1.
On an Itanium-based processor, this parameter can be any power of 2, from 1 to 0x80000000.
You cannot add space between Access and Size.
Options
Specifies breakpoint options. You can use any number of the following options, except as indicated:
/1
Creates a "one-shot" breakpoint. After this breakpoint is triggered, the breakpoint is permanently removed from the breakpoint list.
/f PredNum
(Itanium only, user mode only) Specifies a predicate number. The breakpoint is predicated with the corresponding predicate register (for example, bp /f 4 address sets a breakpoint that is predicated with the p4 predicate register). For more information about predicate registers, see Itanium Architecture.
/p EProcess
(Kernel mode only) Specifies a process that is associated with this breakpoint. EProcess should be the actual address of the EPROCESS structure, not the PID. The breakpoint is triggered only if it is encountered in the context of this process.
/t EThread
(Kernel mode only) Specifies a thread that is associated with this breakpoint. EThread should be the actual address of the ETHREAD structure, not the thread ID. The breakpoint is triggered only if it is encountered in the context of this thread. If you use /p EProcess and /t EThread , you can enter them in either order.
/c MaxCallStackDepth
Causes the breakpoint to be active only when the call stack depth is less than MaxCallStackDepth. You cannot combine this option together with /C.
/C MinCallStackDepth
Causes the breakpoint to be active only when the call stack depth is larger than MinCallStackDepth. You cannot combine this option together with /c.
Address
Specifies any valid address. If the application accesses memory at this address, the debugger stops execution and displays the current values of all registers and flags. This address must be an offset and suitably aligned to match the Size parameter. (For example, if Size is 4, Address must be a multiple of 4.) If you omit Address, the current instruction pointer is used. For more information about the syntax, see Address and Address Range Syntax.
Passes
Specifies the number of times the breakpoint is passed by until it activates. This number can be any 16-bit value. The number of times the program counter passes through this point without breaking is one less than the value of this number. Therefore, omitting this number is the same as setting it equal to 1. Note also that this number counts only the times that the application executes past this point. Stepping or tracing past this point does not count. After the full count is reached, you can reset this number only by clearing and resetting the breakpoint.
CommandString
Specifies a list of commands to execute every time that the breakpoint is encountered the specified number of times. These commands are executed only if the breakpoint is hit after you issue a g (Go) command, instead of after a t (Trace) or p (Step) command. Debugger commands in CommandString can include parameters.
You must enclose this command string in quotation marks, and you should separate multiple commands by semicolons. You can use standard C control characters (such as \n and \"). Semicolons that are contained in second-level quotation marks (\") are intepreted as part of the embedded quoted string.
This parameter is optional
Environment
Modes User mode, kernel mode
Targets Live debugging only
Platforms All
Comments
The debugger uses the ID number to refer to the breakpoint in later bc (Breakpoint Clear), bd (Breakpoint Disable), and be (Breakpoint Enable), commands. Use the bl (Breakpoint List) command to see the ID numbers that are associated with all currently set breakpoints.
The ba command provides the same functionality that the debug registers provide. You can break execution when the particular memory location is read from, written to, or executed.
The breakpoint is satisfied only when the access occurs at the given address and for the specified number of bytes. If the memory that is accessed overlaps the specified area to monitor, the breakpoint is not satisfied.
Although the size is required for all breakpoint types, an execute breakpoint is satisfied only if the address is the first byte in the instruction.
When you debug a multiprocessor system in kernel mode, breakpoints that you set by using bp (Set Breakpoint) or ba apply to all processors. For example, if the current processor is 3 and you type ba e1 MemoryAddress to put a breakpoint at MemoryAddress, any processor (not only processor 3) that executes at that address causes a breakpoint trap.
You cannot set the initial breakpoint in a user-mode process by using the ba command.
You cannot create multiple breakpoints at the same address that differ only in their CommandString values. However, you can create multiple breakpoints at the same address that have different restrictions (for example, different values of the /p, /t, /c, and /C options).
When you debug in kernel mode, the target computer distinguishes between user-mode and kernel-mode data breakpoints. A user-mode data breakpoint cannot affect kernel execution or memory access. A kernel-mode data breakpoint might affect user-mode execution or memory access, depending on whether the user-mode code is using the debug register state and whether there is a user-mode debugger that is attached.
To apply the current process' existing data breakpoints to a different register context, use the .apply_dbp (Apply Data Breakpoint to Context) command.
The following examples show the ba command. The following command sets a breakpoint for read access on 4 bytes of the variable myVar.
0:000> ba r4 myVar
The following command adds a breakpoint on all serial ports with addresses from 0x3F8 through 0x3FB. This breakpoint is triggered if anything is read or written to these ports.
kd> ba i4 3f8
========