WinDbg简介.pptVIP

WinDbg简介 操作系统课程组 内容安排 WinDbg的特点 User Mode调试 Kernel Mode调试 Kernel Mode调试环境 启动kernel mode调试 WinDbg窗体 WinDbg命令 WinDbg的特点 Microsoft Windows Debugger(WinDbg) WinDbg is a powerful Windows-based debugging tool. It Has the capability of both user-mode and kernel-mode debugging. Provide full source-level debugging for the Windows kernel, kernel-mode drivers, and system services, as well as user-mode applications and drivers. Can view source code, set breakpoints, view variables (including C++ objects), stack traces, and memory. Its Debugger Command window allows the user to issue a wide variety of commands. Supports various remote debugging options for both user-mode and kernel-mode targets. Is the graphical-interface counterpart to CDB / NTSD and to KD. User Mode调试 User-mode debugging Is a debugger session in which the target is running in user mode. User mode In user mode, processes that run in user mode do so within their own virtual address spaces. They are restricted from gaining direct access to many parts of the system, including system hardware, memory that was not allocated for their use, and other portions of the system that might compromise system integrity. Categories of User-mode processes: System Processes. Server Processes. Environment Subsystems. User Applications. Kernel Mode调试 Kernel-mode debugging A debugger session in which the target is running in kernel mode. Kernel-mode Kernel-mode code has permission to access any part of the system, and is not restricted like user-mode code. It can gain access to any part of any other process running in either user mode or kernel mode. Kernel-mode components: Executive (执行体) Kernel(内核) Hardware Abstraction Layer (HAL,硬件抽象层) Window and Graphics Subsystem(窗体和图形子系统) Kernel Mode调试环境 硬件环境要求 Kernel Mode调试环境 我们的实验环境 启动kernel mode调试 启动方法 在主机(Host computer)启动“命令提示符”窗体(点击“开始?运行”,输入cmd,点击确定)，输入以下命令： set _NT_SYMBOL_PATH=D:\WRK-v1.2\base\ntos\BUILD\EXE;D:\WRK-v1.2\WS03SP1HALS\x86\halacpim path D:\WRK