如何使用Windbg打开转储并从命令提示符下启动一些Windbg命令?

时间:2019-01-21 15:48:13

标签: windbg

this other question中所述,我想启动Windbg,打开转储,并启动一些命令(.load pykd.pyd!py heap_stat.py)。

我认为这很容易,但是即使启动Windbg并打开故障转储也不是那么容易,如从以下不成功的示例中可以看到的那样:

Prompt>windbg.exe /?
Prompt>windbg.exe --help
Prompt>windbg.exe E:\Bugs\program.exe_181212_215503.dmp
Prompt>windbg.exe -D E:\Bugs\program.exe_181212_215503.dmp
Prompt>windbg.exe -zertyuiopqsdfghjklwxcvbn
Prompt>windbg.exe -help
Prompt>windbg.exe help

想法是得到类似的东西:

Prompt>windbg.exe -d <dumpfile> -c <command1;command2>

1 个答案:

答案 0 :(得分:1)

它已被记录并在windbg.chm和命令提示符中都可用-? 请注意,我在cdb上使用它,而控制台模式不在windbg上使用
windbg -? , -h , --help , /? , -B#llCr@p
一切都应该弹出debugger.chm(在17763中中断,但检查说14951)

enter image description here

C:\>cdb -? | grep -i dump
  -openPrivateDumpByHandle <HANDLE>
    specifies the handle of a crash dump file to debug
  -z <CrashDmpFile> specifies the name of a crash dump file to debug
  -zd <CrashDmpFile> specifies the name of a crash dump file to debugand
                     deletes that crash dump after the debugger has finished
                      crash dump

C:\>

要求创建转储

C:\>cdb -c ".dump /ma dominidumpi.dmp;q" cdb

Microsoft (R) Windows Debugger Version 10.0.17763.132 X86

ntdll!LdrpDoDebuggerBreak+0x2c:
774a05a6 cc              int     3
0:000> cdb: Reading initial command '.dump /ma dominidumpi.dmp;q'
Creating dominidumpi.dmp - mini user dump
Dump successfully written
quit:

加载转储文件并退出

C:\>cdb -c "lm;q" -z dominidumpi.dmp

Microsoft (R) Windows Debugger Version 10.0.17763.132 X86


Loading Dump File [C:\dominidumpi.dmp]
User Mini Dump File with Full Memory: Only application data is available



ntdll!LdrpDoDebuggerBreak+0x2c:
774a05a6 cc              int     3
0:000> cdb: Reading initial command 'lm;q'
start    end        module name
01250000 01278000   cdb        (deferred)
5b360000 5b4ef000   dbghelp    (deferred)
5b4f0000 5b5cc000   ucrtbase   (deferred)
5b5d0000 5bbac000   dbgeng     (deferred)

77400000 7753c000   ntdll      (pdb symbols)   xxx\ntdll.pdb
775a0000 775aa000   lpk        (deferred)
quit:


C:\>