windbg

WinDbg远程调试

由 隐身守侯 提交于 2020-01-19 21:21:21
1、环境及工具 　　 本地主机 　　目标主机，可以是虚拟机 　　调试工具：VS2008、msvsmon.exe（根据目标机系统版本选择X64还是X86，远程调试监视器，一般在安装目录下 C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger 可找到） 2、调试环境 　　本地需要：VS2008、可执行文件的源码 　　目标主机需要：msvsmon.exe、调试的可执行文件 3、调试方法一 　　1）远程主机：运行msvsmon.exe，Tool-->Options-->选择No Authentication(native only)下的Allow any user to debug，时间设置的大一点 　　2）本地主机：VS2008选择属性-->Debugging-->Debugger to launch(remote windows Debugger)--> remote Command(远程主机可执行文件的路径)-->remote server name(远程主机IP地址)-->Connection(Native only) 在VS2008源码中设置断点进行测试 　　3）选择vs菜单栏的Debug-->Start Debugging开始调试 4、调试方法二 　　1）配置项同3 　　2

Postprocess drmemory error stacks with new symbols after process exits

由 点点圈 提交于 2020-01-17 06:09:04
问题 After running a set of tests with drmemory overnight I am trying to resolve the error stacks by providing pdb symbols. The pdb's come from a large samba-mapped repository and using _NT_SYMBOL_PATH at runtime slowed things down too much. Does anyone know of a tool that post-processes results.txt and pulls new symbols (via NT_SYMBOL_PATH or otherwise) as required to produce more detailed stacks ? If not, any hints for adapting asan_symbolize.py to do this ? https://llvm.org/svn/llvm-project

Windbg command's each result as parameter in script

由 为君一笑 提交于 2020-01-17 04:58:06
问题 I intend to search opcodes in specific memory area in process's dump. I want to have some conditions while searching. like: $$><<>script.wds #call 00400000 L? 01000000 for(00400000 ~ 01000000) { // this condition is if argument's opcode which is address is not in this area .if(arg1's opcode !in 00400000 ~ 01000000) .print arg1 } 回答1: You can use a combination of #, .foreach and $spat. Lets say you want to find the few first call opcodes in notepad!WinMain . You could do something like this: 0

I've set symbol path in windbg, but why each time windbg downloads same symbol for same exe?

由 一曲冷凌霜 提交于 2020-01-16 04:11:06
问题 I used windbg.exe to debug the same exe. Each time windbg loads this exe, it will spend a minute to download symbols. On the left-bottom corner of windbg window, it shows ""Downloading symbols [winnt.dll]..."". I've see this multiple times. I've set my symbol path, and one line is: ************* Symbol Path validation summary ************** Deferred SRV*D:\SymCache\Microsoft*http://msdl.microsoft.com/download/symbols This is weird to me, as long as I've set the microsoft download URL and the

In Windbg how to get the whole content from !do Command

由 ≡放荡痞女 提交于 2020-01-16 00:36:10
问题 I'm currently working in a memory issue on a .NET application, I'm debugging the Issue using Windbg I have come across to what the memory issue is, but during the investigation !do command is getting me the object which has a content that is excessive large BUT the Content that gets displayed by the command is truncated, Is there a way that I can get the Content in its entirely from the !do command? The result of the command looks something like this: 0:000> !do [Address] Name: System.Byte[]

WinDbg: range limit for dd <address> L <length>

由 泄露秘密 提交于 2020-01-15 15:25:07
问题 WinDbg has a range limit applied for the d-command series. According to the documentation, the limit is at 256 MB. This limit can be bypassed using the L? syntax. L? Size (with a question mark) means the same as LSize, except that L? Size removes the debugger's automatic range limit. Typically, there is a range limit of 256 MB, because larger ranges are typographic errors. If you want to specify a range that is larger than 256 MB, you must use the L? Size syntax. However, I tried to do a du

Large number of dead threads in .Net memory dump

由 霸气de小男生 提交于 2020-01-15 14:21:07
问题 during the analysis of a memory dump for a .Net4.5 WCF w3wp process, I encountered many threads identified as dead. !threads shows 68 out of 107 threads are dead which appear to be quite high. I was wondering if these threads could hold large amount of memory since the process eventually goes as high as 20GB+ and seem to never go down. How can I inspect such threads and see the objects/memory held by these? Is it normal to have so many? 0:000> !threads ThreadCount: 107 UnstartedThread: 0

Large number of dead threads in .Net memory dump

由 三世轮回 提交于 2020-01-15 14:19:08
问题 during the analysis of a memory dump for a .Net4.5 WCF w3wp process, I encountered many threads identified as dead. !threads shows 68 out of 107 threads are dead which appear to be quite high. I was wondering if these threads could hold large amount of memory since the process eventually goes as high as 20GB+ and seem to never go down. How can I inspect such threads and see the objects/memory held by these? Is it normal to have so many? 0:000> !threads ThreadCount: 107 UnstartedThread: 0

Large number of dead threads in .Net memory dump

由 不羁的心 提交于 2020-01-15 14:19:08
问题 during the analysis of a memory dump for a .Net4.5 WCF w3wp process, I encountered many threads identified as dead. !threads shows 68 out of 107 threads are dead which appear to be quite high. I was wondering if these threads could hold large amount of memory since the process eventually goes as high as 20GB+ and seem to never go down. How can I inspect such threads and see the objects/memory held by these? Is it normal to have so many? 0:000> !threads ThreadCount: 107 UnstartedThread: 0

How do I share Javascript code between files in Windbg preview?

由 拜拜、爱过 提交于 2020-01-15 12:06:19
问题 How do I share Javascript code between files in Windbg preview? Right now I have several helper methods that I have copied and pasted into different javascript files. I'm not all that experienced with javascript, so my apologies if this is a stupid question. As an example, let's say I want to use this function in more than one file: function GetGuid( objectPtr ) { return ExecuteCommandToString( "dt nt!_GUID " + objectPtr ) .FindLineContaining("{").trim().replace("{", "").replace("}",""); }
订阅 windbg