windbg技巧：列出当前进程所有装载的模块(dll/exe)

调试的时候想要知道当前进程装载了哪些模块，每个模块被装载的代码地址段是在哪个范围，可以使用lm命令。 拿notepad为例，输入lm命令可以发现：

0:001> lm
start end module name
00830000 00858000 notepad (pdb symbols) c:\debuggers\externalsymbols\notepad.pdb\7dac7b3d7d1d4e68be2132eab080d42c2\notepad.pdb
70990000 709d2000 winspool (export symbols) c:\windows\system32\winspool.drv
738c0000 738ff000 uxtheme (pdb symbols) c:\debuggers\externalsymbols\uxtheme.pdb\d6b5a4e899af4946ba6e4611d58409c02\uxtheme.pdb
74a80000 74c1d000 comctl32 (export symbols) c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.16497_none_5cc0004408832c27\comctl32.dll
75e30000 75e7b000 gdi32 (export symbols) c:\windows\system32\gdi32.dll
75ec0000 75f32000 comdlg32 (export symbols) c:\windows\system32\comdlg32.dll
75f40000 75fdd000 user32 (pdb symbols) c:\debuggers\externalsymbols\user32.pdb\750e7375884c4ea592c8b0c8adb018542\user32.pdb

（....省略）

从上面结果可以看出，uxtheme.dll 模块被装载在地址738c0000 ~ 738ff000。

如果lm列表很长，希望过滤出自己感兴趣的模块，可以使用lm m 表达式 命令。

0:001> lm m *theme*
start end module name
738c0000 738ff000 uxtheme (pdb symbols) c:\debuggers\externalsymbols\uxtheme.pdb\d6b5a4e899af4946ba6e4611d58409c02\uxtheme.pdb

如果想要了解该模块的详细信息（比如版本，日期等）还可以加上v选项，使用lmvm 命令：

0:001> lmvm *theme*
start end module name
738c0000 738ff000 uxtheme (pdb symbols) c:\debuggers\externalsymbols\uxtheme.pdb\d6b5a4e899af4946ba6e4611d58409c02\uxtheme.pdb
loaded symbol image file: c:\windows\system32\uxtheme.dll
image path: c:\windows\system32\uxtheme.dll
image name: uxtheme.dll
timestamp: fri jan 18 23:32:10 2008 (4791a77a)
checksum: 0004868f
imagesize: 0003f000
file version: 6.0.6001.18000
product version: 6.0.6001.18000
file flags: 0 (mask 3f)
file os: 40004 nt win32
file type: 2.0 dll
file date: 00000000.00000000
translations: 0409.04b0
companyname: microsoft corporation
productname: microsoft® windows® operating system
internalname: uxtheme.dll
originalfilename: uxtheme.dll
productversion: 6.0.6001.18000
fileversion: 6.0.6001.18000 (longhorn_rtm.080118-1840)
filedescription: microsoft uxtheme library
legalcopyright: © microsoft corporation. all rights reserved.

想要了解该uxtheme.dll 的详细调试文件（pdb）信息，可以使用!lmi 命令：

0:001> !lmi uxtheme
loaded module info: [uxtheme] 
module: uxtheme
base address: 738c0000
image name: c:\windows\system32\uxtheme.dll
machine type: 332 (i386)
time stamp: 4791a77a fri jan 18 23:32:10 2008
size: 3f000
checksum: 4868f
characteristics: 2102 perf
debug data dirs: type size va pointer
codeview 24, 375a0, 369a0 rsds - guid: {d6b5a4e8-99af-4946-ba6e-4611d58409c0}
age: 2, pdb: uxtheme.pdb
clsid 4, 3759c, 3699c [data not mapped]
image type: file - image read successfully from debugger.
c:\windows\system32\uxtheme.dll
symbol type: pdb - symbols loaded successfully from symbol server.
c:\debuggers\externalsymbols\uxtheme.pdb\d6b5a4e899af4946ba6e4611d58409c02\uxtheme.pdb
load report: public symbols , not source indexed 
c:\debuggers\externalsymbols\uxtheme.pdb\d6b5a4e899af4946ba6e4611d58409c02\uxtheme.pdb