Tips

1. "x" command in windbg requires the module name.
For example, if we only type "x createprocessa" in windbg, we will get nothing. "x kernel32!createprocessa" is the correct way.
If you really do not know the module name, but want to search certain symbol, you can do something like tihs:
x *!kiuserexceptiondispatcher

2. "call" and "ret" instructors
"call" and "ret" instructors in Windows are both in near form.
Call: place the next instructor address on the stack top, then transfer control to the operand address.
Ret: pop the DWORD from the stack top and load it into the EIP.

3. Calculate string length for WriteFile, ReadFile
When calculating string buffer length for string mainpulation API, we have 2 scenarios: string array and string pointer. The correct solution is listed below:

string array:
TCHAR szBuf[dwMessageLen];
dwMessageLen*sizeof(TCHAR) or sizeof(szBuf) +sizeof(TCHAR)

string pointer:
PTSTR pszMessage=TEXT("Default message from server...");
(_tcslen(pszMessage) +1)*sizeof(TCHAR)

Note: you should not use sizeof(pszMessage) for string pointer. This will yeild the pointer length instead of string buffer length. Also, for string pointer, we should count the last zero terminator since _tcslen will not take the zero terminator into account.  This is the same for sizeof, so we should add sizeof(TCHAR) to the sizeof(szBuf).

4. Return type and calling convention order
When definiting and declaring function, we should place return type BEFORE the calling convention, or a compile-time error will generate. For example, we should declare like this:
LONG WINAPI MSJExceptionHandler::MSJUnhandledExceptionHandler(PEXCEPTION_POINTERS pExceptionInfo)
instead of
WINAPI  LONG MSJExceptionHandler::MSJUnhandledExceptionHandler(PEXCEPTION_POINTERS pExceptionInfo)

转载于:https://www.cnblogs.com/jeffreytan/archive/2006/03/28/360865.html