Saturday, October 25, 2008

Windbg Commands Overview

As have introduced, windbg provides several categories commands, while I am going to categorize the commands from the operation perspective in this post, like memory management, execution control, register, etc...
Display and edit memory
, using d* serial commands to display certain types data start from ......specific memory address.
For example, db 0x0700,0000 displays bytes values and ASCII characters start from 0x0700,0000. Except db, there are also dw,dW,dd,dq,dp,dps,da,du, ds,dS to display different types memory content. Please refer to the help documents of windbg for details.
You can use
e* serial commands to modify memory. For example eb 0007,fed8 will edit 1 byte memory start from 0007,fed8:
............0:002> db 0007fed8 0007fed8
............0007fed8 1f .
............0:002> eb 0007fed8
............0007fed8 1f f1
............f1
............0007fed9 1f
............0:002> db 0007fed8 0007fed8
............0007fed8 f1
You can also use ew, ed, eq, ep to edit different kinds of memory. Notice that editing memory works on crash dumps but changes are not saved.

2 comments:

陈昕 said...

Why is this blog so short?

haowei said...

Still NOT finish this post yet:)