WinDbg 相关命令

1、基本命令帮助
(1)断点指令

B[C|D|E] [<bps>]

clear|disable|enable breakpoints

 

BL

list breakpoints

 

BP <address>

set soft breakpoints

 

BA <access> <size> <addr>

break on access

 

(2)数据查看指令

D[type][<range>]

dump memory

 

DT [-n|y] [[mod!]name] [[-n|y]fields][address] [-l list] [-a[]|c|i|o|r[#]|v]

dump using type information

 

DV [<name>] 

dump local variables

 

(3)数据修改指令

E[type] <address> [<values>]

enter memory values

 

(4)运行

G[H|N] [=<address> [<address>...]] 

go

 

P [=<addr>] [<value>]

step over

 

(5)堆栈操作

K[b|p|P|v]

 

(6)显示加载的模块列表

LM

list modules

 

(7)寄存器操作

R [[<reg> [= <expr>]]]

view or set registers

 

(8)Search指令

S[<opts>] <range> <values>

search memory

 

(9)跟踪指令T,TA,TB,TC,WT,P,PA,PC

 

(10)退出

Q 

 

(11)反汇编

U [<range>]

unassemble

UF

(12)版本查看

version 

show debuggee and debugger version

(13)查看符号

X [<*|module>!]<*|symbol>

view symbols

(14)查看表达式

? <expr>

display expression

?? <expr> 

display C++ expression

 

2.扩展命令

(1)!analyze

作用：该扩展命令执行大量分析，显示出当前异常或bug的大量信息

语法：

User-Mode

!analyze [ -v] [ -f |  -hang] [ -D  BucketID] 
!analyze  -c [  -load  KnownIssuesFile |  -unload |  -help ]

Kernel-Mode

!analyze [ -v] [ -f |  -hang]  [ -D  BucketID] 
!analyze  -c [  -load  KnownIssuesFile |  -unload |  -help ]
!analyze  -show  BugCheckCode [ BugParameters] 

 

(2)显示临界区

!locks 扩展、!critsec 扩展、!cs 扩展和 dt

 

3.WinDBG快捷键

ctrl+s: set symbol path

ctrl+i: set image path

ctrl+p: set source path

 

ctrl+d: load crash dump file
ctrl+e: load exe file

ctrl+o: open source file

ctrl+r: connect to remote session

ctrl+k: kernel debug

f6: attach to a process

 

f5: go

f10: step over

f11: step into

ctrl+shift+f5: restart

 

alt+1: command

alt+2: watch

alt+3: locals

alt+4: registers

alt+5: memory

alt+6: callstack

alt+7: disassambly

alt+8: stratch pad

alt+9: processes and threads

转载于:https://www.cnblogs.com/suiyingjie/archive/2008/01/25/1053007.html