Quick Start with several windbg commands

1: use! Sym noisy command to get more information about windbg try to get symbols.
! Sym noisy

2 :! How much information does windbg know about ntoskrnl.
! LMIS Kernel32

3:. srcpath E:/win2003sp1
It means: To view the source file, see the E:/win2003sp1 directory.

4: breakpoint: bu sioctl! DriverEntry
The bu ("breakpoint unresolved") Command will delay the breakpoint setting time until the module is loaded. That is, windbg will detect "DriverEntry ". If there is nothing to do, press F5 (you can also enter g, "go ")
5: Not loaded all drive breakpoints ---- CTRL-ALT-K
6: normal breakpoint ----
BP mydriver! XYZ
BP f89adeaa
The first line indicates the name of the breakpoint in the module (<module>! <Name>)
6: You can use BL ("breakpoint list") to view all preset breakpoints:
7: Suppose you want to temporarily stop using a breakpoint. BD ("disable breakpoint") will complete it
Kd> BD 1
8: permanently remove the Checkpoint number and use BC 1 ("Clear breakpoint ")
9: Conditional breakpoint
10: D, da, DB, DC, DD, DD, DF, DP, DQ, Du, DW (Display memory) content within the specified memory range. -- d ESP + 100
11:. formats -- display multiple numerical formats
0: 000>. Formats 1c407e62
Evaluate expression:
HEX: 1c407e62
Decimal: 473988706
Octal: 03420077142
Binary: 00011100 01000000 01111110 01100010
Chars :.@~ B
Time: Mon Jan 07 15:31:46 1985
Float: Low 6.20.8e-022 high 0
Double: 2.34182e-315
12 :! Process -- view the current process ---! Process 0 0 -- view all processes in the form of a summary.
13 :! Dd -- displays the physical memory.
14: u --- display the compilation and translation of a piece of code in memory.
URange
UAddress
U
15: KP --- display stack tracing.
16: LM --- display loaded modules. And symbol files.
17 :! Drvobj srcdbgknldrv
Driver object (8219f5f0) is:
/Driver/srcdbgknldrv
Driver extension list: (ID, ADDR)

Device object list:
18 :! Devobj srcdbgknldrv
Equipment object (82138030) is:
Srcdbgknldrv/driver/srcdbgknldrv driverobject 8219f5f0
Current IRP 00000000 refcount 0 type 00000022 flags 000000c0
DACL e10361f4 devext 00000000 limit bjext 821380e8
Extensionflags (0000000000)
Device queue is not busy.
19 :! Devstack 82138030 --- Pass! Run the devhandles command to view the opened handle of the device.
! Mongobj! Drvobj! Devext objectname
> 82138030/driver/srcdbgknldrv00000000 srcdbgknldrv
20 :! Analyze-V --- get the summary. This command may propose the execution context (. cxr). By setting this context, you can access the call stack when an error occurs (the closest to the wrong one ).
21: 0: 000> DT nt! _ Peb LDR 7ffdf000 -- Display Data Structure
+ 0x00c LDR: 0x00191ea0
22: DDS, DPS, dqs (display words and symbols)-display the memory value in a given range
23: s [-[[flags] type] range pattern-search for an feature value in a memory range
0: 000> S 0012ff40 L20 'h'' e ''l'' o'
0: 000> S 0012ff40 L20 48 65 6C 6C 6f
0: 000> S-A 0012ff40 l20 "hello"
24 :! Process PID attributes -----
! Process 0 0 displays all processes and common attributes
15 :! IDT vectornum
! IDT 2e
26: ln address ----
Ln 8193f0a0
27: UF function name-translate a function using assembly, in memory
UF nt! Xxxxxxx