BYR Achieve · 镜像论坛

用CDB调试ring3程序首先，你最后设置好环境变量_NT_SYMBOL_PATH为 srv*C:\symbols*http://msdl.microsoft.com/download/symbols 然后，对于这样一份win32asm源文件： -------------------------------------------------- .model flat,stdcall option casemap:none include windows.inc include user32.inc includelib user32.lib include kernel32.inc includelib kernel32.lib .code start: invoke GetStdHandle,STD_OUTPUT_HANDLE MOV hStdOut,eax push eax invoke WriteFile,hStdOut,addr szHello,sizeof szHello,esp,0 pop eax invoke ExitProcess,NULL end start ---------------------------------------------- ---------Makefile------------------------------------- NAME = debug OBJS = $(NAME).obj RES = $(NAME).res LINK_FLAG = /subsystem:console /Debug /pdb:$(NAME).pdb ML_FLAG = /c /coff /Zi /Zd $(NAME).exe: $(OBJS) Link $(LINK_FLAG) $(OBJS) .asm.obj: ml $(ML_FLAG) $< clean: del *.obj del *.bak ------------------------------------------------------ nmake编译完以后，会在程序目录里产生debug.pdb和debug.eax 然后运行cdb debug.exe,会见到下面的输出 ---------------------------------------------------------------- C:\masm32\source\debug>cdb debug.exe Microsoft (R) Windows Debugger Version 6.6.0007.5 Copyright (c) Microsoft Corporation. All rights reserved. CommandLine: debug.exe Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: ModLoad: 00400000 00407000 debug.exe ModLoad: 7c920000 7c9b4000 ntdll.dll ModLoad: 7c800000 7c91c000 C:\WINDOWS\system32\kernel32.dll ModLoad: 77d10000 77d9f000 C:\WINDOWS\system32\user32.dll ModLoad: 77ef0000 77f37000 C:\WINDOWS\system32\GDI32.dll (708.3f8): Break instruction exception - code 80000003 (first chance) eax=00241eb4 ebx=7ffdd000 ecx=00000007 edx=00000080 esi=00241f48 edi=00241eb4 eip=7c921230 esp=0012fb20 ebp=0012fc94 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000202 ntdll!DbgBreakPoint: 7c921230 cc int 3 0:000> ---------------------------------------------------------------- 这时,运行.reload /f加载一下symbol文件，然后运行lm确认加载成功 ---------------------------------------------------------------- 0:000> .reload /f Reloading current modules .*** WARNING: Unable to verify checksum for debug.exe .... 0:000> lm start end module name 00400000 00407000 debug C (private pdb symbols) C:\masm32\source\debug\debug.pdb 77d10000 77d9f000 user32 (pdb symbols) C:\symbols\user32.pdb\EE2B714D83A34C9D88027621 272F83262\user32.pdb 77ef0000 77f37000 GDI32 (pdb symbols) C:\symbols\gdi32.pdb\C0EA66BE00A64BD7AEF79E443 A91869C2\gdi32.pdb 7c800000 7c91c000 kernel32 (pdb symbols) C:\symbols\kernel32.pdb\BCE8785C57B44245A66989 6B6A19B9542\kernel32.pdb 7c920000 7c9b4000 ntdll (pdb symbols) C:\symbols\ntdll.pdb\36515FB5D04345E491F672FA2 E2878C02\ntdll.pdb ---------------------------------------------------------------- 然后，在代码起始处下断 bp start或bp debug!start 然后，g命令运行 ---------------------------------------------------------------- 0:000> bp start 0:000> g ModLoad: 76300000 7631d000 C:\WINDOWS\system32\IMM32.DLL ModLoad: 77da0000 77e49000 C:\WINDOWS\system32\ADVAPI32.dll ModLoad: 77e50000 77ee1000 C:\WINDOWS\system32\RPCRT4.dll ModLoad: 62c20000 62c29000 C:\WINDOWS\system32\LPK.DLL ModLoad: 73fa0000 7400b000 C:\WINDOWS\system32\USP10.dll ModLoad: 77be0000 77c38000 C:\WINDOWS\system32\msvcrt.dll Breakpoint 0 hit eax=00000000 ebx=7ffdd000 ecx=0012ffb0 edx=7c92eb94 esi=7c9318f1 edi=00011970 eip=00401189 esp=0012ffc4 ebp=0012fff0 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246 debug!start: 00401189 6af5 push 0FFFFFFF5h ---------------------------------------------------------------- 这时，可以看到断在代码起始处。再运行 .lines(显示源代码的行号),l+t(单步时执行一行代码为一步),l+s(显示出源码) pr(单步执行一次，关闭寄存器显示) ---------------------------------------------------------------------------- 0:000> .lines Line number information will be loaded 0:000> l+t Source options are 1: 1/t - Step/trace by source line 0:000> l+s Source options are 5: 1/t - Step/trace by source line 4/s - List source code at prompt 0:000> pr > 32: MOV hStdOut,eax debug!start+0x7: 00401190 a300404000 mov dword ptr [debug!hStdOut (00404000)],eax ds:0023:00404000=00000000 0:000> p > 33: push eax debug!start+0xc: 00401195 50 push eax 0:000> > 34: invoke WriteFile,hStdOut,addr szHello,sizeof szHello,esp,0 debug!start+0xd: 00401196 6a00 push 0 0:000> ****Memory v1.0 List the status of your Memory.**** ***Copyright 2004 by flyingkisser. Using Win32Asm*** **************Specially thanks to AB:)************** > 35: pop eax debug!start+0x25: 004011ae 58 pop eax 0:000> > 36: invoke ExitProcess,NULL debug!start+0x26: 004011af 6a00 push 0 0:000> ntdll!KiFastSystemCallRet: 7c92eb94 c3 ret 0:000> ---------------------------------------------------------------------------- 后面就可随意调试了，p是跟出,t是跟入,u用来显示指令地址或函数名处的汇编代码 d用来查看或修改内存,r用来查看或修改寄存器,s用来查看堆栈信息当然，我还是习惯了用od调试ring3程序，但od的命令行功能太弱，也缺少像!peb, !struct或dt这样好用的命令。所以，二者各有长短吧。另外，cdb只能用来调ring3,调ring0驱动的话要用kd或windbg,并且单机调试的话还要用虚拟机，从本机调试虚拟机才行。但softice的内核分析功能要弱于kd。所以，自己写驱动调的话可用sice,研究内核的话kd更好一些。

[原创]用CDB调试ring3程序