没有合适的资源?快使用搜索试试~ 我知道了~
首页debugging_windbg.pdf
资源详情
资源评论
资源推荐

Debugging Windows Applications with IDA WinDbg Plugin
Copyright 2011 Hex-Rays SA
Quick overview:
The Windbg debugger plugin is an IDA Pro debugger plugin that uses Microsoft's debugging engine
(dbgeng) that is used by Windbg, Cdb or Kd.
To get started, you need to install the latest Debugging Tools from Microsoft website:
https://msdn.microsoft.com/en-us/windows/hardware/hh852365
or from the Windows SDK / DDK package.
Please make sure you should install the x86 version of the debugging tools which is used by both IDA
Pro and IDA Pro 64. The x64 version will NOT work.
After installing the debugging tools, make sure you select « Debugger / Switch Debugger » and select
the WinDbg debugger.
Also make sure you specify the correct settings in the “Debugger specific options” dialog:

• User mode: Select this mode for user mode application debugging (default mode)
• Kernel mode: Select this mode to attach to a live kernel.
• Non Invasive debugging: Select this mode to attach to a process non-invasively
• Output flags: These flags tell the debugging engine which kind of output messages to display
and which to omit
• Kernel mode debugging with reconnect and initial break: Select this option when
debugging a kernel and when the connection string contains 'reconnect'. This option will assure
that the debugger breaks as soon as possible after a reconnect.
To make these settings permanent, please edit the IDA\cfg\dbg_windbg.cfg file.
To specify the debugging tools folder you may add to the PATH environment variable the location of
Windbg.exe or edit %IDA%\cfg\ida.cfg and change the value of the DBGTOOLS key.
After the debugger is properly configured, edit the process options and leave the connection string
value empty because we intend to debug a local user-mode application.

Now hit F9 to start debugging:
The Windbg plugin is very similar to IDA Pro's Win32 debugger plugin, nonetheless by using the
former, one can benefit from the command line facilities and the extensions that ship with the
debugging tools.
For example, one can type “!chain” to see the registered Windbg extensions:
剩余12页未读,继续阅读


















安全验证
文档复制为VIP权益,开通VIP直接复制

评论0