Windbg命令学习1(vertarget和lm和lmvm)

1.g可以让目标程序继续执行，ctrl+break可以挂起正在运行的目标程序回到调试模式

2.vertarget

vertarget 命令显示目标机的Microsoft Windows操作系统版本

给个示例:

0:011> vertarget
Windows XP Version 2600 (Service Pack 3) MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
kernel32.dll version: 
Machine Name:
Debug session time: Wed May  9 16:33:38.600 2012 (GMT+8)
System Uptime: 1 days 7:30:56.583
Process Uptime: 0 days 0:06:44.442
  Kernel time: 0 days 0:00:01.062
  User time: 0 days 0:00:01.843

上面示例的意思是X86，4核，XPSP3，该机已持续运行1天7小时30分56秒,当前调试进程运行时间为6分44秒.

 3.lm

lm命令显示指定的已加载/未加载模块。输出中包含模块状态和路径

给个例子:

0:015> lm
start    end        module name
00400000 00670000   360se      (export symbols)       C:\Program Files\360\360se3\360se.exe
00de0000 00edd000   Favorites   (export symbols)       C:\Program Files\360\360se3\Favorites\Favorites.dll
00ee0000 01029000   LoginEnrol   (export symbols)       C:\Program Files\360\360se3\LoginEnrol\LoginEnrol.dll
01130000 011e0000   safemon    (export symbols)       C:\Program Files\360\360Safe\safemon\safemon.dll
017e0000 0183c000   urlproc    (export symbols)       C:\Program Files\360\360Safe\safemon\urlproc.dll
01b60000 01bdb000   heavygate   (export symbols)       C:\Program Files\360\360Safe\deepscan\heavygate.dll
020c0000 02126000   sqlite3    (export symbols)       C:\Program Files\360\360se3\sqlite3.dll
021d0000 023be000   doctor     (export symbols)       C:\Program Files\360\360se3\doctor.dll
024c0000 02567000   ExtLoginAssis   (export symbols)       C:\Documents and Settings\Administrator\Application Data\360SE\apps\LoginAssis\ExtLoginAssis.dll
025a0000 02ae9000   xpsp2res   (no symbols)           
02e50000 02e8d000   sepro      (export symbols)       C:\Program Files\360\360Safe\safemon\sepro.dll
035f0000 0365f000   PENCHS     (export symbols)       C:\Program Files\Common Files\Microsoft Shared\INK\PENCHS.DLL
039e0000 03b3e000   wdui2      (export symbols)       C:\Program Files\360\360se3\SafeCentral\wdui2.dll
066d0000 07010000   Flash32_11_2_202_235   (export symbols)       C:\WINDOWS\system32\Macromed\Flash\Flash32_11_2_202_235.ocx
10000000 100ea000   SafeCentral   (export symbols)       C:\Program Files\360\360se3\SafeCentral\SafeCentral.dll
25060000 25077000   net_monitor2_0_2_6   (export symbols)       C:\Program Files\Common Files\Thunder Network\NetMon\net_monitor2.0.2.6.dll
4ae90000 4b03b000   gdiplus    (pdb symbols)          C:\MyLocalSymbols\gdiplus.pdb\E55758F17CA94EDBAC732C65F6FD77DF2\gdiplus.pdb
5adc0000 5adf7000   UxTheme    (pdb symbols)          C:\WINDOWS\symbols\dll\uxtheme.pdb
5dd50000 5de73000   msxml3     (pdb symbols)          C:\MyLocalSymbols\msxml3.pdb\2D362E3E2D824B188B516102CA1D0EFC2\msxml3.pdb
5e400000 5e40c000   pngfilt    (deferred)             
5fdd0000 5fe25000   NETAPI32   (deferred)             
60180000 601bd000   sptip      (deferred)             
60fd0000 61025000   hnetcfg    (deferred)             
61880000 618ba000   OLEACC     (deferred)             
61be0000 61bed000   MFC42LOC   (deferred)             
62c20000 62c29000   LPK        (deferred)             
64000000 64021000   mdnsNSP    (deferred)             
65700000 65727000   iNetSafe   (deferred)             
65d00000 65d38000   urlproc_65d00000   (deferred)             
66b50000 66b5c000   ImgUtil    (deferred)             
67140000 67180000   iepeers    (deferred)             
68000000 68036000   rsaenh     (deferred)             
6c140000 6c176000   dxtrans    (deferred)             
6c180000 6c1da000   dxtmsft    (deferred)             
6d7c0000 6d7ca000   ddrawex    (deferred)             
71800000 7187c000   shdoclc    (deferred)             
719c0000 719fe000   mswsock    (deferred)             
71a00000 71a08000   wshtcpip   (deferred)             
71a10000 71a18000   WS2HELP    (deferred)             
71a20000 71a37000   WS2_32     (deferred)             
71a40000 71a4b000   wsock32    (deferred)             
72240000 72245000   sensapi    (deferred)             
727a0000 72892000   mfc42u     (deferred)             
72c80000 72c88000   msacm32    (deferred)             
72c90000 72c99000   wdmaud     (deferred)             
72f70000 72f96000   WINSPOOL   (deferred)             
73640000 7366e000   msctfime   (deferred)             
736d0000 7371b000   DDRAW      (deferred)             
73aa0000 73ab5000   mscms      (deferred)             
73b30000 73b36000   DCIMAN32   (deferred)             
73c50000 73c71000   T2EMBED    (deferred)             
73dc0000 73dc3000   LZ32       (deferred)             
73e70000 73ecc000   dsound     (deferred)             
73fa0000 7400b000   USP10      (deferred)             
74620000 74647000   msls31     (deferred)             
74650000 7467a000   msimtf     (deferred)             
74680000 746cc000   MSCTF      (deferred)             
74cf0000 74d81000   MLANG      (deferred)             
75430000 754a1000   CRYPTUI    (deferred)             
759d0000 75a7f000   USERENV    (deferred)             
75bc0000 75c3d000   jscript    (deferred)             
75e00000 75eae000   SXS        (deferred)             
75ff0000 76055000   MSVCP60    (deferred)             
76060000 761b6000   SETUPAPI   (deferred)             
762f0000 762f5000   MSIMG32    (deferred)             
76300000 7631d000   IMM32      (deferred)             
76320000 76367000   comdlg32   (deferred)             
765e0000 76673000   CRYPT32    (deferred)             
76680000 76726000   WININET    (deferred)             
76760000 7676c000   cryptdll   (deferred)             
767c0000 767e9000   schannel   (deferred)             
76990000 76ace000   ole32      (deferred)             
76af0000 76b01000   ATL        (deferred)             
76b10000 76b3a000   WINMM      (deferred)             
76bc0000 76bcb000   psapi      (deferred)             
76c00000 76c2e000   WINTRUST   (deferred)             
76c60000 76c88000   IMAGEHLP   (deferred)             
76d30000 76d48000   iphlpapi   (deferred)             
76d70000 76d92000   appHelp    (deferred)             
76db0000 76dc2000   MSASN1     (deferred)             
76e50000 76e5e000   rtutils    (deferred)             
76e60000 76e72000   rasman     (deferred)             
76e80000 76eaf000   TAPI32     (deferred)             
76eb0000 76eec000   RASAPI32   (deferred)             
76ef0000 76f17000   DNSAPI     (deferred)             
76f30000 76f5c000   WLDAP32    (deferred)             
76f90000 76f96000   rasadhlp   (deferred)             
76fa0000 7701f000   CLBCATQ    (deferred)             
77020000 770ba000   COMRes     (deferred)             
770f0000 7717b000   OLEAUT32   (deferred)             
77180000 77283000   COMCTL32   (deferred)             
77ba0000 77ba7000   midimap    (deferred)             
77bb0000 77bc5000   MSACM32_77bb0000   (deferred)             
77bd0000 77bd8000   VERSION    (deferred)             
77be0000 77c38000   msvcrt     (deferred)             
77c40000 77c65000   msv1_0     (deferred)             
77d10000 77da0000   USER32     (deferred)             
77da0000 77e49000   ADVAPI32   (deferred)             
77e50000 77ee3000   RPCRT4     (deferred)             
77ef0000 77f39000   GDI32      (deferred)             
77f40000 77fb6000   SHLWAPI    (deferred)             
77fc0000 77fd1000   Secur32    (deferred)             
7c340000 7c396000   MSVCR71    (deferred)             
7c3a0000 7c41b000   MSVCP71    (deferred)             
7c800000 7c91e000   kernel32   (deferred)             
7c920000 7c9b3000   ntdll      (pdb symbols)          C:\WINDOWS\symbols\dll\ntdll.pdb
7c9c0000 7cc7c000   msi        (deferred)             
7d590000 7dd84000   SHELL32    (deferred)             
7e210000 7e50c000   mshtml     (deferred)             
7e550000 7e6c3000   shdocvw    (deferred)             
7eae0000 7eb81000   urlmon     (deferred)             

Unloaded modules:
753b0000 75421000   mshtmled.dll
74d90000 74dfd000   RichEd20.dll
71dd0000 71de5000   msapsspc.dll
78080000 78091000   MSVCRT40.dll
767c0000 767e9000   schannel.dll
759d0000 75a7f000   USERENV.dll
757f0000 75805000   digest.dll
72f10000 72f57000   msnsspc.dll
78080000 78091000   MSVCRT40.dll
72c90000 72c99000   wdmaud.drv
06200000 06218000   360verify.dll
066d0000 07010000   Flash32_11_2_202_235.ocx
73aa0000 73ab5000   mscms.dll
753b0000 75421000   mshtmled.dll
67140000 67180000   iepeers.dll
72f70000 72f96000   WINSPOOL.DRV

deferred表示目前并没有加载对应模块的symbol，注意是symbol，我当初就想歪了，还以为是未加载这个模块呢，事实上，未加载模块用Unloaded modules:表示出来了.

 4.lmvm

如果想要了解该模块的详细信息，使用lmvm 命令

lmvm命令可以查看任意一个已加载的DLL/EXE的详细信息，以及symbol的情况, 特别提醒的是，不要加后缀名（无论EXE/DLL）,我开始学习时就出过这样的错

针对3的已加载模块

给个例子:

0:015> lmvm ntdll
start    end        module name
7c920000 7c9b3000   ntdll      (pdb symbols)          C:\WINDOWS\symbols\dll\ntdll.pdb
    Loaded symbol image file: C:\WINDOWS\system32\ntdll.dll
    Image path: C:\WINDOWS\system32\ntdll.dll
    Image name: ntdll.dll
    Timestamp:        Mon Apr 14 10:13:25 2008 (4802BDC5)
    CheckSum:         00097CB7
    ImageSize:        00093000
    File version:     5.1.2600.5512
    Product version:  5.1.2600.5512
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0804.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft(R) Windows(R) Operating System
    InternalName:     ntdll.dll
    OriginalFilename: ntdll.dll
    ProductVersion:   5.1.2600.5512
    FileVersion:      5.1.2600.5512 (xpsp.080413-2111)
    FileDescription:  NT Layer DLL
    LegalCopyright:   (C) Microsoft Corporation. All rights reserved.

对比前面，可以看到symbol位置都被打印了,

如果加后缀名，就是这样了：

0:015> lmvm ntdll.dll
start    end        module name

这意思就是没找到

我们再打印个前面deferred的模块试试：

0:015> lmvm urlmon
start    end        module name
7eae0000 7eb81000   urlmon     (deferred)             
    Image path: C:\WINDOWS\system32\urlmon.dll
    Image name: urlmon.dll
    Timestamp:        Wed Feb 29 02:49:46 2012 (4F4D21CA)
    CheckSum:         000A06D3
    ImageSize:        000A1000
    File version:     6.0.2900.6197
    Product version:  6.0.2900.6197
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0804.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft(R) Windows(R) Operating System
    InternalName:     UrlMon.dll
    OriginalFilename: UrlMon.dll
    ProductVersion:   6.00.2900.6197
    FileVersion:      6.00.2900.6197 (xpsp_sp3_gdr.120228-1720)
    FileDescription:  OLE32 Extensions for Win32
    LegalCopyright:   (C) Microsoft Corporation. All rights reserved.

 

可以看出它和lm打印出来的一样，

我们再打印Unloaded modules:下的模块：

0:015> lmvm mshtmled
start    end        module nme

很明显，这意思就是没找到

所以lmvm可以查看任意一个已加载的DLL/EXE的详细信息,但不能查看未加载的DLL/EXE，也不能带后缀名

hgy413 ---2012.5.22附加:

lmvm可以打印出带通配符的模块：

0:002> lmvm s*
start    end        module name
5cc30000 5cc56000   ShimEng    (deferred)             
    Image path: C:\WINDOWS\system32\ShimEng.dll
    Image name: ShimEng.dll
    Timestamp:        Mon Apr 14 10:13:13 2008 (4802BDB9)
    CheckSum:         0001F66F
    ImageSize:        00026000
    File version:     5.1.2600.5512
    Product version:  5.1.2600.5512
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     Shim Engine DLL (IAT)
    OriginalFilename: Shim Engine DLL (IAT)
    ProductVersion:   5.1.2600.5512
    FileVersion:      5.1.2600.5512 (xpsp.080413-2105)
    FileDescription:  Shim Engine DLL
    LegalCopyright:   © Microsoft Corporation. All rights reserved.
77f40000 77fb6000   SHLWAPI    (deferred)             
    Image path: C:\WINDOWS\system32\SHLWAPI.dll
    Image name: SHLWAPI.dll
    Timestamp:        Tue Dec 08 17:23:33 2009 (4B1E1B15)
    CheckSum:         00079E4B
    ImageSize:        00076000
    File version:     6.0.2900.5912
    Product version:  6.0.2900.5912
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0804.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft(R) Windows(R) Operating System
    InternalName:     SHLWAPI
    OriginalFilename: SHLWAPI.DLL
    ProductVersion:   6.00.2900.5912
    FileVersion:      6.00.2900.5912 (xpsp_sp3_gdr.091207-1454)
    FileDescription:  Shell Light-weight Utility Library
    LegalCopyright:   (C) Microsoft Corporation. All rights reserved.
77fc0000 77fd1000   Secur32    (deferred)             
    Image path: C:\WINDOWS\system32\Secur32.dll
    Image name: Secur32.dll
    Timestamp:        Thu Jun 25 16:24:50 2009 (4A433452)
    CheckSum:         00015AE9
    ImageSize:        00011000
    File version:     5.1.2600.5834
    Product version:  5.1.2600.5834
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft® Windows® Operating System
    InternalName:     security.dll
    OriginalFilename: security.dll
    ProductVersion:   5.1.2600.5834
    FileVersion:      5.1.2600.5834 (xpsp_sp3_gdr.090624-1305)
    FileDescription:  Security Support Provider Interface
    LegalCopyright:   © Microsoft Corporation. All rights reserved.
7d590000 7dd84000   SHELL32    (deferred)             
    Image path: C:\WINDOWS\system32\SHELL32.dll
    Image name: SHELL32.dll
    Timestamp:        Fri Jan 21 22:44:09 2011 (4D399BB9)
    CheckSum:         007FB35C
    ImageSize:        007F4000
    File version:     6.0.2900.6072
    Product version:  6.0.2900.6072
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0804.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft(R) Windows(R) Operating System
    InternalName:     SHELL32
    OriginalFilename: SHELL32.DLL
    ProductVersion:   6.00.2900.6072
    FileVersion:      6.00.2900.6072 (xpsp_sp3_gdr.110121-1719)
    FileDescription:  Windows Shell Common Dll
    LegalCopyright:   (C) Microsoft Corporation. All rights reserved.

 

hgy413记于2012.5.9日晚.