みなさん、こんにちわ。gattsです。 これから何回かに渡ってWindbgについての技術的な話をしようと思います。 私は仕事でwindowsの案件をやっています。仕事をしていく中でOSがトラブルになったりシステムを検証したりします。そんな時に助けてくれるツールがWi... 続きを読む
This step-by-step article describes how to debug a Windows service by using the WinDbg debugger (windbg.exe). To debug a Windows service, you can attach the WinDbg debugger to the process that hosts the service after the service starts, or yo... 続きを読む
この資料ではハンドルリークに関する調査方法についてお話したいと思います。 ハンドルリークとは? 開発者が Windows API を使ってカーネルオブジェクトを作成すると、Windows はカーネル内部にカーネルオブジェクトを作成し、 それを操作するための ハンドル ... 続きを読む
1/12 の勉強会で WinDBG の使い方なども教えていただいたので忘れないうちにメモしておこう。とりあえず、VMware 環境に Windows XP Sp2 を用意し、古典的な rootkit ということで Hacker Defender をインストールする。これで INI ファイルに定義されている文... 続きを読む
First time here? Check out the post index for a categorized list of posts, or Top 21 for the most popular posts. Feel free to leave a comment or ask a question, and consider subscribing to the latest posts via RSS or e-mail. Thanks for visiti... 続きを読む
WinDbg. From A to Z! Everything you need to know about WinDbg. And nothing you don't. Published: Dezember, 2007 Description: A quick start and introduction to WinDbg. 111 slides with examples. Download Color PDF (1605 Kb) Download Black & Whi... 続きを読む
These postings are provided as is with no warranties, and confers no rights. Additionally, views expressed herein are my own and not those of my employer, Microsoft. My name is Norman and I’ve been working with customers the past few years d... 続きを読む
Rootkit 等で使われる、EPROCESS の操作を windbg で行ってみました。始め の画像が使用前で、後の方の画像が使用後になります。良く見ると、CMD.EXE が無くなってるのが分かります。EPROCESS のリストからはずしたからで、別 に CMD.EXE を終了させたわけでは... 続きを読む
Did you know you can build your own advanced commands using for each, if, etc? The complete list of control tokens are: .if .else .elseif .foreach .for .while .do .break .continue .catch .leave .printf .block Using these command tokes you can... 続きを読む
There is such debugger - WinDbg. It is developed by Microsoft and can be downloaded from this location: http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx. In general there are 2 possible ways of debugging: with single machine a... 続きを読む
Implying no warranties and conferring no rights: "AS IS" since 1988 If you think you've got memory leaks, or if you're just wondering what kind of stuff is on your heap you can follow the very same steps that I do and get fabulous results you... 続きを読む
The following direct links can be used to order the book now: Buy Paperback or Hardcover or Digital from Lulu This is a revised, edited, cross-referenced and thematically organized volume of selected DumpAnalysis.org blog posts about crash du... 続きを読む
Display . commands Display . commands in DML format (top bar of links is given) Display . commands that start with a* (wildcard) as DML 続きを読む
Exploring Crash Dumps and Debugging Techniques on Windows Platforms Sometimes the root cause of a problem is not obvious from a memory dump. Here is the first version of crash dump analysis checklist to help experienced engineers not to miss ... 続きを読む
“If the” modules “in my” process “don’t work with or without” yours, “I cannot blame” you. Francisco Alves, “If the brakes in my car don’t work with or without petrol in the fuel tank, I cannot blame the fuel” - Dmitry Vostokov @ ... 続きを読む
If you want the entire set of symbols for Windows Server 2008, Windows Vista, Windows Server 2003, Windows XP, or Windows 2000, then you can download a symbol package and install it on your computer: Private symbols files have all information... 続きを読む
All my posts are provided "AS IS" with no warranties, and confer no rights. I just closed a case that I thought was a bit interesting. I could skip directly to the old Problem, Resolution format, but I think that most of the time there is a... 続きを読む
It will show statistics for the objects on the heap in a nice little summary divided in tho four columns. The method table of the object The number of objects of this type on the heap The total size of these objects in bytes The name of the o... 続きを読む
All my posts are provided "AS IS" with no warranties, and confer no rights. Install Windbg Windbg is the tool for the ASP.NET support engineer. It is free and it's available at www.microsoft.com/whdc/devtools/debugging/default.mspx. The lea... 続きを読む