久久精品中文闷骚内射,久久电影网,久久久久亚洲av无码专区导航

Tiany — Sun, 24 Mar 2013 08:10:00 GMT

元命�?Meta-Command)用来提供标准命��o没有提供的常用调试功�? 与标准命令一�? 元命令也是内建在调试器引擎或者WinDBG�E�序文�g中的. 所有元命��o都已一个点(.)开�? 所以元命��o也被�U�Cؓ点命�?Dot Command).

按照功能, 可以把元命��o分成如下几类.

昄��和设�|�调试会话和调试器选项.

用于�W�号选项�?strong>.symopt- Set Symbol Options
用于�W�号路径�?sympath- Set Symbol Path, �?strong>.symfix- Set Symbol Store Path.
用于�E�序源文件的.srcpath- Set Source Path, .srcnoisy- Noisy Source Loading, .srcfix- Use Source Server
用于扩展命��o模块路径�?strong>.extpath- Set Extension Path
用于匚w��扩展命��o�?strong>.extmatch- Display All Matching Extensions
用于可执行文件的.exepath- Set Executable Path
讄��反汇�~�选项�?strong>.asm- Change Disassembly Options
控制表达式评估器�?strong>.expr- Choose Expression Evaluator

控制调试会话或者调试目�?

重新开始调试会话的.restart- Restart Kernel Connection(Kernel Mode) �?Restart Target Application(User Mode)
攑ּ�用户态调试目�?�q�程)�?strong>.abandon- Abandon Process
创徏新进�E�的.create- Create Process
附加到存在进�E�的.attach- Attach to Process
打开转储文�g�?strong>.opendump- Open Dump File
分离调试目标�?strong>.detach- Detach from Process
用于杀掉进�E�的.kill- Kill Process

��理扩展命��o模块

加蝲模块�?strong>.load- Load Extension DLL
卸蝲模块.unload- Unload Extension DLL�?strong>.unloadall- Unload All Extension DLLs
昄��已加载模块的.chain- List Debugger Extensions

��理调试器日志文�?/li>
- 昄��信息 .logfile- Display Log File Status
- 打开 .logopen- Open Log File
- �q�加 .logappend- Append Log File
- 关闭 .logclose- Close Log File
�q�程调试

用于启动remote.exe服务�?strong>.remote- Create Remote.exe Server
用于启动调试引擎服务器的.server- Create Debugging Server
列出可用服务器的.servers- List Debugging Servers
用于向远�E�服务器发送文件的.send_file- Send File
用于�l�束�q�程�q�程服务器的.endpsrv- End Process Server
用于�l�束引擎服务器的.endsrv- End Debugging Server

控制调试�?/li>
- 让调试器睡眠一�D�|��间的.sleep- Pause Debugger
- 唤醒处于睡眠状态的调试器的.wake- Wake Debugger
- 启动另一个调试器来调试当前调试器�?strong>.dbgdbg- Debug Current Debugger
�~�写命��o�E�序

包括一�p�d��c�M��C语言关键字的命��o, �?/li>
- .if, .else, .elsif, .foreach, .do, .while. .continue, .catch, .break, .continue, .leave, .printf, .block. �?lt;软�g调试>一书第30章的�W?8节有介绍命��o�E�序的编写方�?

昄��或者�{储调试目标数�?/li>
- 产生转储文�g�?strong>.dump- Create Dump File
- ��原始内存数据写到文件的.writemem- Write Memory to File
- 昄��调试会话旉��?strong>.time- Display System Time
- 昄��U�程旉��?strong>.ttime- Display Thread Times
- 昄��d��列表�?strong>.tlist- List Process IDs
- 以不同格式显�C�数字的.formats- Show Number Formats
- 可以列出所有元命��o和每个命令的��单说明的.help- Meta-Command Help

Tiany 2013-03-24 16:10 发表评论

WinDBG命��o概览(�? - 标准命��o

Tiany — Sun, 24 Mar 2013 08:01:00 GMT

摘要: WinDBG的大多数功能是以命��o方式工作�? 本系列将介绍WinDBG的三�c�d��? 标准命��o, 元命令和扩展命��o. 标准命��o =============== 标准命��o用来提供适用于所有调试目标的基本调试功能. 所有基本命令都是实现在WinDBG内部�? 执行�q�些命��o时不需要加载�Q何扩展模�? 大多数标准命令是一两个字符或者符�? 只有version�{�少数命令除�? 标准命��o... 阅读全文

Tiany 2013-03-24 16:01 发表评论

VS2008�~�译驱动环境配置

Tiany — Sat, 23 Mar 2013 12:20:00 GMT

新徏一个空�?/span>win32控制台程�?/span>

1、选（文�g→新徏→��目→Visual C++��目→win32→win32控制台项目）创徏一�?/span>

填写上名�U?/span>event然后按确�?/span>
在弹出的win32应用�E�序向导�?/span> 选应用程序设�|?/span> →附加选项 ��N��空��目→完成�?/span>

�?/span> �?nbsp; 选项目菜�?#8594;��d��现有��?#8594;��d��所有驱动相关的*.h,*.c,*.cpp,*.rc之类的文件�?/span>

选工�?/span>(T)→选项(O)....→��目→VC++目录→

1、在可执行文�?/span>目录中添加：

D:/WINDDK/3790.1830/BIN/X86 //VS2003(没测),VS2005(没测),VS2008内不需�?/span>

2、在包含文�g目录��d��如下路径

    D:/WINDDK/3790.1830/inc/wxp
    D:/WINDDK/3790.1830/inc/crt    (可�?/span>)
    D:/WINDDK/3790.1830/inc/ddk/wxp
    D:/WINDDK/3790.1830/inc/ddk/wdm/wxp

3、在库文�?/span>目录中添加：

D:/WINDDK/3790.1830/LIB/WXP/I386

��目event属性设�|?/span>

新徏��目配置check //必�?/span>

(一)C/C++属性设�|?/span>

常规选项�?/span>

1调试信息格式(C7兼容(/Z7) //可�?/span>

2警告�{�� Q?/span>2�U?/span>(/W2) //可�?/span>

3��警告视为错�?/span>(�?/span>(/wx) //可�?/span>

优化选项�?/span>

1优化(��用/Od) //可�?/span>

预处理器

预处理器定义�Q?/span>WIN32=100;_X86_=1;WINVER=0x501;DBG=1 //必�?/span>

代码生成

启用最��重新生成：�?/span> //可�?/span>

基本�q�行时检查：默认�?/span>//可�?/span>

�q�行时库�Q�多�U�程调试(/MTd) �?/span> 多线�E?/span>(/MT) //��?/span>

�~�冲区安全检查：�?/span> //可�?/span>

(可避免出�?/span>LINK : error LNK2001: 无法解析外部�W�号__security_cookie)

高��

调用�U�定__stdcall(/Gz) //必�?/span>

链接�?/span>

常规�Q?/span>

输出文�g�Q?/span>$(OutDir)/$(ProjectName).sys //必�?/span>

启用增量链接�Q�否(/INCREMENTAL:NO) //��选上

忽略导入库：�?/span>//可�?/span>( 讄��为此值时�Q�必��d��附加库目录中加：D:/WINDDK/3790.1830/lib/wxp/i386 �Q�这样项目就不会依赖IDE环境的设�|?/span>) �?/span>( 讄��为此值时�Q�将依赖IDE 的环境的相关讄��)

输入�Q?/span>

附加依赖��?/span>ntoskrnl.lib Hal.lib wdm.lib wdmsec.lib wmilib.lib ndis.lib MSVCRT.LIB LIBCMT.LIB //必选其12

//NT式驱�?/span>ntoskrnl.lib WDM式驱�?/span> wdm.lib
( HalXXX函数�?/span>Hal.lib�Q?/span>WmiXXX函数�?/span>wmilib.lib �Q?/span>NdisXXX函数�?/span>ndis.lib )
( 必要旉��要增加微软的标准�?/span>MSVCRT.LIB MSVCRTD.LIB(调试�?/span>) LIBCMT.LIBIBCMTD.LIB(调试�?/span>) )
( 如果源码中有source 文�g�Q�那么该文�g�?/span>TARGETLIBS 字段会列��目需要的�?/span>)

忽略所有默认库�Q�是(/NODEFAULTLIB)

清单文�g�Q?/span>

启用用户账户控制�Q?/span>UAC�Q?/span> �?/span>//必�?/span> 不然会出�?/span> >LINK : fatal error LNK1295: “/MANIFESTUAC”�?/span>“/DRIVER”规范不兼容；链接时不使用“/MANIFESTUAC”

调试�Q?/span>

生成调试信息 �?/span>(/DEBUG) //可�?/span>

生成映像文�g�Q�是(/MAP) //可�?/span>

映像文�g名：$(TargetDir)$(TargetName).map //可�?/span>

�pȝ��(System)�Q?/span>

子系�l?/span>:控制�?/span>(/SUBSYSTEM:CONSOLE) //必�?/span>

堆栈保留大小�Q?/span>4194304 //可�?/span>

堆栈提交大小�Q?/span>4096 //可�?/span>

驱动�E�序: 驱动�E�序(/DRIVER) //必�?/span>

高��Q?/span>

入口点：DriverEntry //必�?/span>

随机基址:默认�?/span> //必�?/span> 不然会出�?/span> 1>G:/event2008/check/event2008.exe : fatal error LNK1295: “/DYNAMICBASE”�?/span>“/DRIVER”规范不兼容；链接时不使用“/DYNAMICBASE”

数据执行保护(DEP): 默认�?/span>//必�?/span> 不然会出�?/span>G:/event2008/check/event2008.sys : fatal error LNK1295: “/NXCOMPAT:NO”�?/span>“/DRIVER”规范不兼容；链接时不使用“/NXCOMPAT:NO”

讄��效应和：�?/span>(/RELEASE) //可�?/span>

基址�Q?/span>0x10000 //��选上

命��o�?/span>”->附加选项�Q?/span>

��d��开养I��/SECTION:INIT,D /IGNORE:4078 //��填上

      可以避免以下错误提示
      LINK : warning LNK4078: 扑ֈ�多个“INIT”节，它们��h��不同的属�?/span>(E2000020)
      LINK : error LNK2001: 无法解析的外部符�?/span>__load_config_used

五．�~�译�Q�链接�?/span>

一些要修改DDK例子源码方能成功的问题，目前不知道什么选项可以不改�Q?/span>
源码中的关键�?/span>try 要改�?/span>__try , except 要改�?/span>__except .

Tiany 2013-03-23 20:20 发表评论

VMware + WinDbg 配置内核调试

Tiany — Fri, 02 Mar 2012 16:47:00 GMT

借助VMware实现单机使用WinDbg�q�行调试的方法�?

安裝VMware Workstation 6.0, WinDbg�?br />
具体步骤如下�Q?br />
1 讄�� VMware 的虚拟com

1.1 �q�行 VMware �Q�点�?"Edit virtual machine settings"

1.2 点击 "Add..." 来运�?VMware �?Hardware Wizard

1.3 选择 "Serial Port"�Q�点 "下一�?

1.4 选择 "Output to named pipe",�?"下一�?

1.5 �W�一框里保持默认�?\\.\pipe\com_1 <==== 此可��Z�Q何名
�W�二框里�?This end is the server."
�W�三框里�?The other end is an application."
选中 "Connect at power on"
然后点击 "Advanced>>"

1.6 选中 "Yield CPU on poll"�Q�VMware Support 中提��C��q�一点）�Q�然后点完成�?br />

1.7 �q�样��完成了虚拟com的设�|��?br />

1.8 重新启动 VM�?br />
2 讄�� VMware 虚拟出来�?guest os

现在 power on 虚拟出来�?guest os

2.1 讄��boot.ini

在c:\下，可以扑ֈ�boot.ini�Q�可以用��C��本打开它。我们需要在 guest os 的启动项上加些参敎ͼ�才能够��用WinDbg调试它。我们可以在现有的行后面直接加参敎ͼ�不过强烈推荐复制一个新行，在新行的后面加参数。这样在调试启动有问题的时候，我们可以方便的换回原来的启动方式。下面就是我改好的boot.ini�?br />其中 " multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect "
是原来的行�?br />" multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional - debug" /fastdetect /noguiboot /debug /debugport=com1 /baudrate=115200 " 新加為用�?WinDbg 调试的行�?br />
------------------------------------------------------------------------------------------

[boot loader]
timeout=10
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional - debug" /fastdetect /debug /debugport=com1 /baudrate=115200

-------------------------------------------------------------------------------------------

�q�里�q�要注意的是,timeout不要�?�Q�否则直接启动默认的��V��新行后面加上了参数 /debug /debugport=com1 /baudrate=115200 �Q�可以看�?debugport=com1 �Q�baudrate=115200 。参数的具体作用�Q�可以参�?WinDbg 的帮助文件�?br />

2.2 讄��com1端口的速度
�?guest os 的设备管理器中把com1端口的速度也就�?每秒位数"��，设�ؓ和上面一��L��115200�?/span>

3 讄�� WinDbg

我们需要告诉WinDbg通过pipe�q�行�q�接和连接的速度。可以在命��o提示�W�（cmd.exe�Q�下加参�?br />-b -k com:port=\\.\pipe\com_1,baud=11520,pipe �q�行WinDbg�Q�VMware Support 中没有提�?baud=11520 �q�个参数�Q�其实这是个比较重要的参敎ͼ�。更方便的方法是在桌面徏立一个WinDbg的快��h��式，在该快捷方式的属性，"目标"框中�Q�加上参�?-k com:port=\\.\pipe\com_1,baud=11520,pipe 。这栯��行这个快��h��式启动的WinDbg��完成了讄��。参数的具体作用�Q�可以参�?WinDbg 的帮助文件�?br />

4 推荐的操作顺�?/strong>

4.1 首先�q�行 VMware �Q�启�?Guest OS �Q�到�pȝ��启动选择�Q�选择 "Microsoft Windows XP Professional - debug" ��，先不要按回�R�?br />
4.2 通过刚才讄��好的快捷方式�q�行WinDbg�?br />
4.3 �?Guest OS 中选择 "Microsoft Windows XP Professional - debug" ��，按回车�?br />
4.4 �E�等片刻�Q�就�q�接上了。如果很长时间没有连接上的话�Q�可以按 WinDbg 菜单中的 "Debug"->"Kernel Connection"->"Resynchronize"�?<=== 如有用命令選�?此應不會發生

4.5 最后按 WinDbg 菜单中的 "Debug"->"Break" �Q�你��可以向 WinDbg 下命令了�?br />

? 其他
?.1 VMware Support 中还提到了可以通过修改虚拟机的配置文�g来改变虚拟串口的速度�Q�有兴趣的话可以参�?VMware Support 中的�Ҏ��?br />?.2 WinDbg 的菜单项 "View"->"Show Version" 可以看到一些相关信息�?br />
参�?
Driver Debugging with WinDbg and VMWare http://silverstr.ufies.org/lotr0/windbg-vmware.html
VMware Support 相关部分 http://www.vmware.com/support/ws3/doc/ws32_devices3.html

One of the first useful things you will want to do when in the bowels of ring 0 is attack the thing from a debugger point of view. In my case I like using Windows Debugger [windbg] (hey its free, fully functional and does remote debugging really well), and found it neccessary to find a way to have it work with VMWare.

The trick to get it to work in VMWare is to get the host OS to believe it is able to connect to a serial port. Through VMWare, to accomplish this, you need to create a named pipe. The following steps will guide you to configuring VMWare (in my case v3.2):

Open up the Configuration Editor (Settings->Configuration Editor)

Click Add to run the Hardware Wizard

Select Serial Port, and then click the Next button

Select the Use named pipe radio button

Use the default pipe name. It SHOULD be \\.\pipe\com_1. If it is not, change it to that.

Select This end is the Server.

Select The other end is an application.

Click the Advanced Button.

Select the Yield CPU on poll checkbox

This is an important step as the Kernel in the target virtual machine uses the port in polled mode, not interrupt mode.

Click the Finish button, and then click Ok to close the Configuration Editor.
Once you have configured your VMWare session, you need to power it on. You will be able to confirm that the new virtual serial port is added by clicking on the Devices->serial0 menu item. You should note it is saying "Connecting". This means its now ready for a remote connection.

Once the actual virtual machine is configured, you need to configure the target operating system installed in the virtual machine to support remote debugging. This is accomplished by editing the boot.ini found in the root of the C:\ drive. To do this, you need to add a /debugport=some_com_port /baudrate=some_baud_rate to the end of an [operating systems] line. I would not recommend doing it to the one that is there. It would be better to copy the line and paste it with the ammendments, and then use the OS's menu selection to determine which mode you would like to boot into. This is what my boot.ini looks like for XP Pro as the operating system in the virtual machine:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional - Debug" /fastdetect /debugport=com1 /baudrate=115200

You will notice that the second option sets the debugport to com1, and sets the baudrate to 115200. I am told you can tweak this out to get even more speed out. But it seems fine for me at this speed, so I haven't mucked with it at all. If you do try this, drop me an email and let me know how it works out.

If you set up your boot.ini fine, save it and reboot. You should be prompted with something that looks like this:

At this point you have completed setting up the VMWare side of things. Now you need to set up the host to connect to it. This is actually rather easy. You just need to tell windbg at the command like to connect to the pipe, like this:
windbg -k com:port=\\.\pipe\com_1,pipe

If you are using WinDbg 6.x or newer, a better alternative is to use:
windbg -b -k com:pipe,port=\\.\pipe\com_1,resets=0

Thanks needs to go to Randhir Dugal for pointing out the new format for the latest Windbg version.

I am a rather anal type guy when it comes to security, so I actually made a shortcut on my desktop to WinDbg and added these command line arguments to the Target line. Originally this was so I could run WinDbg with differnet credentials as I do not run with administrator privileges on a day to day basis. I found that with XP's normal security settings for com ports, you can still work in a least privileged environment while doing the development WITHOUT having to use 'runas'. (You are logged into W2K/XP as a least priviledged environment aren't you? If not, you really should read my article on how, and why this is important to do so.)

At this point fire up the debugger. With any luck you should see something that looks like this:

If you are using a WinDbg version earlier than 6.x, you will find one issue with this approach. If you cannot seem to connect right away, close Windbg and restart it... it will then work. Seems flaky to me. But it works. And thats a Good Thing™. With the latest versions of WIndbg (6.x and newer) a new resets flag prevents this sort of hanging.

That is all there is to it. At this point, you can now go nuts with remote debugging. To make sure it works for ya just add some DbgPrint() messages to your ring 0 driver and watch them echo to the screen. Past that, I will leave it to your imagination how to use the debugger :)

Good luck!

Tiany 2012-03-03 00:47 发表评论

Tiany — Thu, 01 Mar 2012 10:25:00 GMT

一、WDK的介�l�、下载、安装及配制

1、关于WDK

Windows Driver Kit(驱动�E�序工具�?/strong>): 是一�U�完全集成的驱动�E�序开发系�l�，它包�?Windows Driver Device Kit (DDK)�Q�用于测�?Windows 驱动�E�序的可靠性和�E�_��性，包括�Q?/p>
Windows Driver Foundation (WDF) ��化了 Windows 驱动�E�序的开发和支持�?/li>
头文仉��?/strong> �Q�Windows Vista 和更高版本）通过提供更简单的目录�l�构、避免声明冲�H�以及对所有支持的 Windows 版本使用单一头文仉��Q�降低头文�g的复杂性�?/li>
Installable File Systems (IFS) Kit��头、库、示例以及文档作�?WDK 的一部分分发�?/li>
验证�E�序和静态分析工�?/strong>, �Q�如 PREfast �?nbsp;静态驱动程序验证程序）帮助您在�~�译时查�?bug�?/li>

2、下载WDK

曄��下蝲WDK好像�q�必��d��http://connect.microsoft.com/注册后才能下载，而且下蝲后还有一句提�C�：

“提醒�Q�您必须接受附带的许可条�ƾ才能��用此软�g。不得分发下载��Y件包�?#8221;

所以当时下载的时候还要走一些不得不走的路。不�q�，今天好像发现WDK能直接下载了

下蝲地址�Q�http://download.microsoft.com/download/4/A/2/4A25C7D5-EFBE-4182-B6A9-AE6850409A78/GRMWDK_EN_7600_1.ISO

如果不能正常下蝲�Q�具体操作请见如何下载WDK

3、安装WDK

用虚拟光驱加载下载好�?ISO镜像文�g�Q�双击运行，出现下面亲切的画�?nbsp;

接触�Q�出��C��下画面，在左侧的树�Ş复选框中选择要安装的�l��g及工��P��全部安装�Q�选择好后点击“OK”~~后面的就��单了~

��后�Q�一路确定默认即�?img title="image" border="0" alt="image" src="http://202.206.196.103/2010/rsy/spltx/img/VS2008WDKDDKWzard_9F4E/image_thumb_4.png" width="366" height="137" />

二、DDKWzard的介�l�、下载、安装及配制

在VS2008IDE中没有提供驱动开发的��目选项�Q�当然可以用普通工�E�，然后手动在）�Q�中配制相应的编辑连接以及调试选项�Q�但是如此只来，每次都要重复些复杂的步骤。在http://ddkwizard.assarbad.net/�|�站上发��C��一个很好用的辅助工具DDKWizard�Q�能够方便地对开发环境进行配�|�，真是适合��x��q�样懒�h啊，工具的作者也自称是因为懒惰才开发此工具�Q�看�?#8220;懒惰是推动科技发展的动�?#8221;一点不�?�?/p>
DDKwzard安装需要三个文�Ӟ��DDKWzard�ȝ��序：安装VS2008的项目模板ddkwizard_setup.exe
DDKBUILD.CMD�Q�应该是用VS2008调用WDK�~�辑�~�译器的一�p�d��脚本dkbuild_cmd.zip
DDKBUILD.BAT �Q�估计也是是用VS2008调用WDK�~�辑�~�译器的一�p�d��脚本ddkbuild_bat.zip

安装ddkwizard_setup�Q�默认安装，一路Next点过卛_��Q�将DDKBUILD.CMD与DDKBUILD.BAT考到WDK的安装目录，或者其它目录也行，只要在后�l�的讄��p��。如�Q�我��其攑֜�wdk的目录下�Q�如�?nbsp;

讄��环境变量
��d��相应的环境变量，如要开发XP�pȝ��下的驱动则添加WXPBASE�Q�变量��gؓWDK的根目录�Q�如�?nbsp;
如果为其它系�l�开发驱动则填写相应的环境变�?nbsp;
NT 4.0 ———–NT4BASE

windows2000—-W2KBASE

windowsXP——-WXPBASE

windows2003—-WNETBASE

win7/2008 R2—-W7BASE
打开VS 2008�Q�菜�?#8220;工具”->“选项”->左侧“��目和解��x��?#8221;->“VC++目录”->右侧“可执行文�?#8221;下拉列表->��d��一��D:/WINDDK(�Ҏ��你的实际情况�Q�就是第1步中DDKBUILD.CMD与DDKBUILD.BAT所在的路径)�?nbsp;

然后��可以在我们的VS2008中新建项目了�Q�如下图�Q�在Visual C++选项卡中多了DDK Project的项目类型，选择相应的模板添加我们的��目�Q�点�ȝ��?nbsp;
��定后出现DDKWzard的项目创建页面，�?#8220;Choose the DDKBUILD you want to use”中选择“ddkbuild.cmd”或�?#8220;ddkbuild.bat”�Q�在其下面选择我们要�ؓWho�Q?000�Q�xp……�Q�开发的驱动�?nbsp;
最后finish
在解��x��案中便是由DDKWzard为我们自动生成的一个简单的驱动�E�序框架�?nbsp;

最后点击F6生成解决�Ҏ��Q�成功生成后在项目的objchk_win7_x86/i386文�g夹下会生成几个文�?nbsp;
driver1.obj —�~�译生成�?�q�制文�g
driver1.pdb—用于调试时��用的�W�号文�g
vc90.pdb—–用于调试时��用的�W�号文�g
driver1.sys—��是我们拭目以待的驱动程序文�?nbsp;

Tiany 2012-03-01 18:25 发表评论