Windbg kp kb command test, windbgkp

Windbg kp kb command test, windbgkp

To familiarize yourself with the windbg kb and kp commands, write a simple program for debugging and observation. The program is as follows:

# Include <stdio. h> # include <Windows. h> void printstr (char * str, int B) {printf ("xxx B is: % d \ n", B);} int kbtest (int) {char str [] = "xxxxxxxxxx"; printstr (str, a); return 1 ;}int main () {kbtest (1); system ("pause "); return 1 ;}

Set the path of the windbg symbol table (the path of the compiled symbol table ),

1. Use windbg to load programs

2. bp windbg_k! Printstr breakpoint under function exit

3. Run the g program and pause the program, for example:

 

When a function is called, the parameter is first input to the stack, then the next instruction address of the function is input to the stack, and then there is ebp.

Call fun (arg1, arg2)

Push arg2push arg1push ret // After the parameter is pushed to the stack, call fun and add the call fun command address to the stack next day, that is, the return address of the function push ebpmov ebp, esp

We can know that the parameters displayed in kb are ebp, ret, arg1, and arg2 from left to right.

Run the r command to view the register value. The ebp value is 003df7e0.