04 2011 档案

windbg help
摘要：.dml_startkd> .dml_startAnalyze last eventBrowse process informationBrowse core commandsBrowse extension chainBrowse dot commandskd> .help /D a*A B C D E F G H I J K L M N O P Q R S T U V W X Y Z All. commands matching a*: .allow_bp_ba_convert [0|1] - Control bp/bm/bu breakpoints to use hardwa 阅读全文
posted @ 2011-04-15 13:56 ahuo 阅读(383) 评论(0) 推荐(0) 编辑
windbg 驱动对象命令
摘要：!devnode \DEVICE\{A4F74E3A-7A5D-4BFA-8B76-AC26F16DE201}Dumping IopRootDeviceNode (= 0x81ebdce0)DevNode 0x81ebdce0 for PDO 0x81ebde18 Parent 0000000000 Sibling 0000000000 Child 0x81ebd840 InstancePath is "HTREE\ROOT\0" State = DeviceNodeStarted (0x308) Previous State = DeviceNodeEnumerateCo 阅读全文
posted @ 2011-04-10 20:58 ahuo 阅读(889) 评论(2) 推荐(0) 编辑
获得FDO by name
摘要：NTSTATUS ntStatus = STATUS_SUCCESS; PDEVICE_OBJECT DeviceObject = NULL; PFILE_OBJECT FileObject = NULL; ntStatus = IoGetDeviceObjectPointer(pObjectName,FILE_ALL_ACCESS,&FileObject,&DeviceObject); if(!NT_SUCCESS(ntStatus)) { KdPrint(("IoGetDeviceObjectPointer Failed,ntStatus = 0x%08lX\n& 阅读全文
posted @ 2011-04-10 15:16 ahuo 阅读(454) 评论(0) 推荐(0) 编辑

点击右上角即可分享
微信分享提示