Debug tool 学习笔记
GDB调试命令大全
gdb --pid 1235
gdb core.1234
where (bt) //where the segmentation fault occurred
f 1 //切换栈帧
info locals //打印内存
WinDBG调试技巧 . ybao@microsoft.com baoyunduan
.ecxr command displays the context record
kb display call stack with first 3 params
.hh --help
.sympath+ srv*c:\symsrv*http://msdl.microsoft.com/download/symbols
.sympath+ C:\training\Labfiles
.srcpath C:\training\Labfiles\ErrorCheck\FileCopy
srv*c:\symsrv*http://msdl.microsoft.com/download/symbols;C:\training\Labfiles
./realod /f
lm -----check the symbol file
Noninvasive -----only view, can't modify memory data
.detach
command line: c:/windbg /?
dash y == -y
slash ? == /?
process -p PID
service -pn name/global
k --- call stack
kn ---- show frame number
kf ---- show memory ocupy
~*k
~4k ---- show thread 4
~ --- show all thread
~S5 --- jump to thread 5
.frame 2 -- jump to frame
? --- convert hex to Decimal
.formats -- show all formats of a number
g --- continure run debugger
r --- list all the registers
rm ff
r@eax --- specific a registers
syspath
ft
tasklist svc
.hh ---help
.hh reload
.reload --- reload symboal
.reload /f
!chain
!ext analyze
c:/debuggers/winext
.load usbkd
unload usbkd
.kframes
logfile
logopen d:\log.txt
logclose
logappend d:\log.txt
d ---- display memory
dd* point ---- display data in the address store in the point
dv ----display local variable
dt ----display type
dt ps
dt ps -r1
e ---- edit data in memory
!grep
n 10
.formats -118
x---- list the function name/global variable
x notepad!*
x notepad!*file
------------------------mex debugging extension for windebug
c:/debugers/winext
!mex.help
.load mex
.unload mexextpath
!us
bl ----list break point
bp ----set break point
bm ----set multiple point
bm notepad!*file
bd ----disable break point
bc ----clear specific break point
|
||
vertarget ----Shows target computer version
? Evaluate expression
?? Evaluate an expression according to c++ expression rules
.dump
/f complete dump
/ma mini dump
.reload
/f
/u
lm ---- list all dlls, can be used to check if the symbol file was loaded
lmvm combase
.effmach x86 | amd64
t
p
pc
g
gu
gu; echo "hello"; gu; gu
u ---- show assembly code
u L30
uf ----The uf command displays an assembly translation of the specified function in memory
----------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------
eventvwr
!analyze -v
!dh badapp
dps +image base address + offset address
!error errorcode
!error 3
!gle
----GetLastError() in code
!teb
.unload ext ---- Load Extension DLL
.load ext
BOOL SafeDiv(INT32 dividend, INT32 divisor, INT32 *pResult)
{
__try
{
*pResult = dividend / divisor;
}
__except(GetExceptionCode() == EXCEPTION_INT_DIVIDE_BY_ZERO ?
EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH)
{
return FALSE;
}
return TRUE;
}
sx ---set exception
prodump.exe -----create dump file when some rules was trigger
-ma --very important
-i
-e
-c
-cl
-h
-n
---- show dump info
!peb -- !peb extension displays a formatted view of the information in the process environment block (PEB).
!teb -- !teb extension displays a formatted view of the information in the thread environment block (TEB).
!runway ---- show run time of thread
!runway f
stack:
1M
two pages
c++函数调用方法
32 bit 4种不同的调用方法
64bit 只有一种调用方法
STDCALL 从右往左压栈，适用于有固定参数个数，由调用函数来处理
CDECL
THISCALL
FASTCALL
----------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------
E:\Program Files (x86)\Microsoft Visual Studio 14.0\VC\bin
dumpbin
editbin /LARGEADORESSAWARE[:NO] 可在不重新编译的情况下，将用户可用内存空间大于2G
或者在VS--链接--系统--启用大地址中修改选项，然后重新编译
You can use /userva with /3Gb to further tune user VA space
!address -summary
Performance Monitor -- 1. 打开:Administrative Tools->Performance,或在运行中输入"perfmon"
C:\Program Files (x86)\Windows Kits\10\Windows Performance Toolkit\
1. Windows Performance recorder
WPRUI.exe
2. Windows Performance Analyzer
wpa.exe
C:\Program Files (x86)\Windows Resource Kits\Tools\consume 可以用来模拟系统资源占用比较严重的情况，我被弄死机了，差点笔记也没有了
consume -cpu-time
!address summary
!address analyze
!heap -s
!heap /?
!help -stat -h HANDLE
!heap -p -a ADDR
gflags -i heap_overrun_demo.exe +hpa
--------------------------------------------------------------------------------------------------------------------
check deadlock ----step
!locks, !cs, ~*k
children process -- command line
Semaphore -- multiple owner
CS/Mute -- One owner
WaitForMultipleObject() ---- 等多个条件齐了才能开始
!handle f
TLS 线程本地存储 ----- http://blog.csdn.net/xiaoliangsky/article/details/43158713
用ProcDump 来取dump是比较准确的
.reload /i C:\Users\admin\Downloads\wme4train_x64\mediaengine\maps\x64\Release
.reload /i wseclient.dll
.effmach x86
.load wow64exts
!analyze -v
!wow64exts k
