windbg查看函数参数,调用堆栈,及返回值.
windbg查看函数参数,调用堆栈,及返回值. bp kernel32!CreateFileW ".echo ---------------------------------------;kL;du poi(@esp+4);gu;.echo =======;r eax;g" 用windbg打开qq看看 0:000> bp kernel32!CreateFileW ".echo ---------------------------------------;kL;du poi(@esp+4);gu;.echo =======;r eax;g" 0:000> g ModLoad: 62c20000 62c29000 C:/WINDOWS/system32/LPK.DLL ModLoad: 77180000 77283000 C:/WINDOWS/WinSxS/x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03/comctl32.dll --------------------------------------- ChildEBP RetAddr 0012e374 7c814d65 kernel32!CreateFileW 0012e5dc 7c801d3a