WinDbg KP KB Command test

In order to be familiar with WinDbg KB,KP command, write a simple program debugging observation, the program is as follows:

#include <stdio.h> #include <windows.h>void printstr (char *str, int b) {printf ("xxx B is:%d\n", b);} int kbtest (int a) {char str[] = "Xxxxxxxxxx";p rintstr (str, a); return 1;} int main () {kbtest (1); System ("pause"); return 1;}

Set the windbg symbol table path (compile the generated symbol table path),

1. Using the WinDbg loader program

2, BP windbg_k!printstr in the function out of the breakpoint

3, G running program, program suspension such as:

When calling a function, it is usually the first argument in the stack, then the function of the next instruction address into the stack, and then the EBP

Call Fun (Arg1, arg2)

Push Arg2push arg1push ret  //  parameter after the stack is finished, call-fun is called, then the calling fun next day instruction address into the stack, that is, the function's return address push Ebpmov EBP, ESP

It can be learned that the parameters shown in KB are from left to right for EBP, ret, arg1, arg2

Using the R command to view the register value, the EBP is 003DF7E0

WinDbg KP KB Command test