windbg常用命令

.hh 打开windbg的帮助文档

Symbol path

https://www.csdn.net/tags/OtTaYgysNDMzNTUtYmxvZwO0O0OO0O0O.html ,讲的很全面。

打印出指定结构中的指定字段

dt 结构 -a 指定字段名 例:

0: kd> dt _KPRCB fffff8072db5d180 -a KernelDirectoryTableBase 
nt!_KPRCB
   +0x6e80 KernelDirectoryTableBase : 0x80000000`001aa002

直接 [dt 结构 字段名 地址] 就行了

获得当前cpu core的kprcb 和 kpcr

!prcb !pcr

获得指定进程名的一些信息

!process 0 0 进程名

挂靠某个进程

.process /i 指定进程的eprocess

加载某个模块的符号

.reload /f C:\Windows\System32\drivers\ndis.sys

显示某个对象的具体信息

!object 对象体地址

遍历某个链表
例子为遍历PsLoadedModuleList输出所有模块的BaseDllName
@$extret相当于每次list.flink(blink)后对应的地址,这里是LDR_DATA_TABLE_ENTRY

!list -t nt!_LIST_ENTRY.FLink -x "dt nt!_LDR_DATA_TABLE_ENTRY BaseDllName DllBase @$extret" PsLoadedModuleList

windbg单步常用命令

https://www.cnblogs.com/yilang/p/11459091.html

pct 执行程序,直到它到达调用指令或返回指令。 pr 单步并开启寄存器显示

条件断到某个地址
下面例子的效果是如果rax等于0不断,不等于0断

bp fffff801`e0292cf3 ".if(@rax == 0){g}"

windbg d系列命令
https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/d--da--db--dc--dd--dd--df--dp--dq--du--dw--dw--dyb--dyd--display-memor
加载所有内核模块符号

.reload /n

加载所有用户模块符号

.reload /user

windbg为了效率符号都是延迟导入的,.reload /f强制载入所有符号

根据驱动名 获得任意驱动的驱动对象和设备对象

!drvobj \FileSystem\FltMgr 这个路径参考winobj

windbg 分析驱动的PE文件信息
dt  _image_dos_header fffff802`dfe00000(驱动基址)
dt  _IMAGE_NT_HEADERS64 fffff802`dfe00000+e_lfanew
搜索内存(通配符不知道怎么搞)
1: kd> s 0xfffff804`2a011000 l100000 E8 BD 25 08 00 48 83 C4 38
1: kd> u NtOpenProcess
nt!NtOpenProcess:
fffff804`2a5b4460 4883ec38        sub     rsp,38h
fffff804`2a5b4464 65488b042588010000 mov   rax,qword ptr gs:[188h]
fffff804`2a5b446d 448a9032020000  mov     r10b,byte ptr [rax+232h]
fffff804`2a5b4474 4488542428      mov     byte ptr [rsp+28h],r10b
fffff804`2a5b4479 4488542420      mov     byte ptr [rsp+20h],r10b
fffff804`2a5b447e e8bd250800      call    nt!PsOpenProcess (fffff804`2a636a40)
fffff804`2a5b4483 4883c438        add     rsp,38h
fffff804`2a5b4487 c3              ret
1: kd> s 0xfffff804`2a011000 l1000000 E8 BD 25 08 00 48 83 C4 38
fffff804`2a4eebc0  e8 bd 25 08 00 48 83 c4-38 88 01 00 00 44 8a 90  ..%..H..8....D..
fffff804`2a4eebde  e8 bd 25 08 00 48 83 c4-38 c3 cc cc cc cc cc cc  ..%..H..8.......
fffff804`2a5b447e  e8 bd 25 08 00 48 83 c4-38 c3 cc cc cc cc cc cc  ..%..H..8.......
windbg !fltkd 调试扩展的使用

列举出系统上所有的minifilter

0: kd> !fltkd.filters  

Filter List: ffffac07059c3520 "Frame 0" 
   FLT_FILTER: ffffac07059ec530 "WdFilter" "328010"
      FLT_INSTANCE: ffffac0705978a90 "WdFilter Instance" "328010"
      FLT_INSTANCE: ffffac07058e0a20 "WdFilter Instance" "328010"
      FLT_INSTANCE: ffffac0705bbca80 "WdFilter Instance" "328010"
   FLT_FILTER: ffffac070966c050 "procmon" "321420"
   FLT_FILTER: ffffac07050d0990 "storqosflt" "244000"
   FLT_FILTER: ffffac07050e9990 "wcifs" "189900"
      FLT_INSTANCE: ffffac07050f6910 "wcifs Instance" "189900"
   FLT_FILTER: ffffac07050f0010 "CldFlt" "180451"
   FLT_FILTER: ffffac0705b1f6c0 "FileCrypt" "141100"
   FLT_FILTER: ffffac07050f6010 "luafv" "135000"
      FLT_INSTANCE: ffffac07050f4010 "luafv" "135000"
   FLT_FILTER: ffffac0705bb6260 "npsvctrig" "46000"
      FLT_INSTANCE: ffffac0705bb9ab0 "npsvctrig" "46000"
   FLT_FILTER: ffffac07059e9010 "Wof" "40700"
      FLT_INSTANCE: ffffac07058a1830 "Wof Instance" "40700"
   FLT_FILTER: ffffac07059e8240 "FileInfo" "40500"
      FLT_INSTANCE: ffffac07058a8840 "FileInfo" "40500"
      FLT_INSTANCE: ffffac07058db970 "FileInfo" "40500"
      FLT_INSTANCE: ffffac0705bbc4e0 "FileInfo" "40500"

列出一个minifilter的具体信息

0: kd> !fltkd.filter ffffac070966c050

FLT_FILTER: ffffac070966c050 "procmon" "321420"
   FLT_OBJECT: ffffac070966c050  [02000000] Filter
      RundownRef               : 0x0000000000000004 (2)
      PointerCount             : 0x00000002 
      PrimaryLink              : [ffffac07050d09a0-ffffac07059ec540] 
   Frame                    : ffffac07059c3470 "Frame 0" 
   Flags                    : [00000012] FilteringInitiated +10!!
   DriverObject             : ffffac070ac49e30 
   FilterLink               : [ffffac07050d09a0-ffffac07059ec540] 
   PreVolumeMount           : fffff800b6fd6fe0  procmon!ProcmonPreOperation 
   PostVolumeMount          : fffff800b6fd7370  procmon!ProcmonPostOperation 
   FilterUnload             : 0000000000000000  (null) 
   InstanceSetup            : fffff800b6fdf000  procmon!ProcmonInstanceSetup 
   InstanceQueryTeardown    : fffff800b6fdf030  procmon!ProcmonInstanceQueryTeardown 
   InstanceTeardownStart    : 0000000000000000  (null) 
   InstanceTeardownComplete : 0000000000000000  (null) 
   ActiveOpens              : (ffffac070966c208)  mCount=0 
   Communication Port List  : (ffffac070966c258)  mCount=1 
   Client Port List         : (ffffac070966c2a8)  mCount=0 
   VerifierExtension        : 0000000000000000 
   Operations               : ffffac070966c300 
   OldDriverUnload          : 0000000000000000  (null) 
   SupportedContexts        : (ffffac070966c180)
      VolumeContexts           : (ffffac070966c180)
      InstanceContexts         : (ffffac070966c188)
      FileContexts             : (ffffac070966c190)
      StreamContexts           : (ffffac070966c198)
      StreamHandleContexts     : (ffffac070966c1a0)
      TransactionContext       : (ffffac070966c1a8)
      (null)                   : (ffffac070966c1b0)
   InstanceList             : (ffffac070966c0b8)
将内存写入文件

.writemem C:\csagent_dump.sys fffff800`160f0000 L2B4000

x命令

0:000> x kernelbase!GetLocal*
74be0520          KERNELBASE!GetLocaleInfoW (void)
74be71d0          KERNELBASE!GetLocaleInfoEx (void)
74bf0eb0          KERNELBASE!GetLocalTime (void)
74bcf010          KERNELBASE!GetLocaleInfoA (void)
74bfe0a0          KERNELBASE!GetLocalPathFromNetResourceW (void)
74bfebe0          KERNELBASE!GetLocaleFromLanguageAndRegion (_GetLocaleFromLanguageAndRegion@16)
74bca42e          KERNELBASE!GetLocaleNullStringFromArrayInPoolTestArray (_GetLocaleNullStringFromArrayInPoolTestArray@12)
74be3f30          KERNELBASE!GetLocaleInfoHelper (_GetLocaleInfoHelper@16)
74c330ee          KERNELBASE!GetLocaleWordFromArrayInPoolUseDefault (_GetLocaleWordFromArrayInPoolUseDefault@16)
74c32832          KERNELBASE!GetLocaleInfoNativeDigits (_GetLocaleInfoNativeDigits@16)
74be81e2          KERNELBASE!GetLocaleFileInfo (_GetLocaleFileInfo@4)