日期:2014-05-16  浏览次数:20471 次

dbg命令使用
1) Built-in help commands Cmd Variants / Params Description

?

?
? /D

Display regular commands
Display regular commands as DML

.help

.help
.help /D
.help /D a*

Display . commands
Display . commands in DML format (top bar of links is given)
Display . commands that start with a* (wildcard) as DML

.chain

.chain
.chain /D

Lists all loaded debugger extensions
Lists all loaded debugger extensions as DML (where extensions are linked to a .extmatch)

.extmatch

.extmatch /e ExtDLL FunctionFilter
.extmatch /D /e ExtDLL FunctionFilter

Show all exported functions of an extension DLL. FunctionFilter = wildcard string
Same in DML format (functions link to "!ExtName.help FuncName" commands)

Example: .extmatch /D /e uext * (show all exported functions of uext.dll)

.hh

.hh
.hh Text

Open WinDbg's help
Text = text to look up in the help file index
Example: .hh dt

Go up Go up
2) General WinDbg's commands (show version, clear screen, etc.) Cmd Variants / Params Description

version

?

Dump version info of debugger and loaded extension DLLs

vercommand

?

Dump command line that was used to start the debugger

vertarget

?

Version of target computer

CTRL+ALT+V

?

Toggle verbose mode ON/OFF
In verbose mode some commands (such as register dumping) have more detailed output.

n

n [8 | 10 | 16]

Set number base

.formats

.formats Expression

Show number formats = evaluates a numerical expression or symbol and displays it in multiple numerical formats (hex, decimal, octal, binary, time, ..)
Example 1: .formats 5
Example 2: .formats poi(nLocal1) == .formats @@($!nLocal1)

.cls

?

Clear screen

.lastevent

?

Displays the most recent exception or event that occurred (why the debugger is waiting?)

.effmach

.effmach
.effmach .
.effmach #
.effmach x86 | amd64 | ia64 | ebc

Dump effective machine (x86, amd64, ..):
Use target computer's native processor mode
Use processor mode of the code that is executing for the mos